@doist/twist-cli 2.41.1 → 2.42.0

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [2.42.0](https://github.com/Doist/twist-cli/compare/v2.41.2...v2.42.0) (2026-05-21)
+
+### Features
+
+- **auth:** adopt cli-core createDcrProvider for OAuth ([#243](https://github.com/Doist/twist-cli/issues/243)) ([670d6df](https://github.com/Doist/twist-cli/commit/670d6dfac79c0e9059ff62a5a8defb4a7a2c00c7))
+
+## [2.41.2](https://github.com/Doist/twist-cli/compare/v2.41.1...v2.41.2) (2026-05-20)
+
+### Bug Fixes
+
+- **deps:** update dependency @doist/twist-sdk to v2.7.0 ([#240](https://github.com/Doist/twist-cli/issues/240)) ([1ae4864](https://github.com/Doist/twist-cli/commit/1ae4864837c26859402d442a776793d4ff81be1b))
+
 ## [2.41.1](https://github.com/Doist/twist-cli/compare/v2.41.0...v2.41.1) (2026-05-18)
 
 ### Bug Fixes

package/dist/commands/auth/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAIH,KAAK,eAAe,EACvB,MAAM,4BAA4B,CAAA;AAKnC,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CA0BxF"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAGH,KAAK,eAAe,EACvB,MAAM,4BAA4B,CAAA;AAKnC,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CA0BxF"}

package/dist/commands/auth/login.js

@@ -1,7 +1,7 @@
 import { attachLoginCommand } from '@doist/cli-core/auth';
 import chalk from 'chalk';
 import { renderError, renderSuccess } from '../../lib/auth-pages.js';
-import { createTwistAuthProvider, READ_ONLY_SCOPES, READ_WRITE_SCOPES, } from '../../lib/auth-provider.js';
+import { createTwistAuthProvider, getScopes, } from '../../lib/auth-provider.js';
 import { logTokenStorageResult } from './helpers.js';
 const PREFERRED_CALLBACK_PORT = 8766;
 export function attachTwistLoginCommand(parent, store) {
@@ -10,7 +10,7 @@ export function attachTwistLoginCommand(parent, store) {
         provider,
         store,
         preferredPort: PREFERRED_CALLBACK_PORT,
-        resolveScopes: ({ readOnly }) => (readOnly ? READ_ONLY_SCOPES : READ_WRITE_SCOPES),
+        resolveScopes: ({ readOnly }) => getScopes(readOnly),
         renderSuccess,
         renderError,
         onSuccess({ view, account }) {

package/dist/commands/auth/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,GAEpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEpD,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,MAAM,UAAU,uBAAuB,CAAC,MAAe,EAAE,KAAsB;IAC3E,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAA;IAE1C,OAAO,kBAAkB,CAAC,MAAM,EAAE;QAC9B,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,uBAAuB;QACtC,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAClF,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAA;gBACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACT,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;YACL,CAAC;QACL,CAAC;KACJ,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAA;AAC9D,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACH,uBAAuB,EACvB,SAAS,GAEZ,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEpD,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,MAAM,UAAU,uBAAuB,CAAC,MAAe,EAAE,KAAsB;IAC3E,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAA;IAE1C,OAAO,kBAAkB,CAAC,MAAM,EAAE;QAC9B,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,uBAAuB;QACtC,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;QACpD,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAA;gBACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACT,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;YACL,CAAC;QACL,CAAC;KACJ,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAA;AAC9D,CAAC"}

package/dist/lib/auth-provider.d.ts

@@ -5,6 +5,13 @@ export declare const TOKEN_URL = "https://twist.com/oauth/access_token";
 export declare const REGISTRATION_URL = "https://twist.com/oauth/register";
 export declare const READ_WRITE_SCOPES: string[];
 export declare const READ_ONLY_SCOPES: string[];
+/**
+ * The scope set a login is granted, as a pure function of `--read-only`. Single
+ * source of truth shared by `attachTwistLoginCommand`'s `resolveScopes` (what we
+ * request at authorize) and the provider's `validate` (what we record on the
+ * account), so the two can't drift.
+ */
+export declare function getScopes(readOnly: boolean): string[];
 /**
  * Narrow account shape: only fields that round-trip through the local token
  * store. `id` is the stringified numeric Twist user id (so cli-core's
@@ -19,6 +26,18 @@ export type TwistAccount = AuthAccount & {
     authScope: string;
 };
 export type TwistTokenStore = KeyringTokenStore<TwistAccount>;
+/**
+ * Twist's OAuth flow uses RFC 7591 Dynamic Client Registration: each login
+ * mints a fresh `client_id` / `client_secret`, then runs the standard PKCE
+ * authorize + token exchange (HTTP Basic auth on the token endpoint). cli-core's
+ * `createDcrProvider` drives all of that via `oauth4webapi`; the only
+ * twist-specific piece is `validate`, which probes `getSessionUser` and records
+ * the auth mode/scope the login was granted.
+ *
+ * `authMode` / `authScope` are derived from `handshake.readOnly` (folded in by
+ * `runOAuthFlow`) rather than threaded through `authorize`, because the scope
+ * set is itself a pure function of `readOnly` (see `resolveScopes` in login.ts).
+ */
 export declare function createTwistAuthProvider(): AuthProvider<TwistAccount>;
 /**
  * Accepts `42`, `id:42`, and case-insensitive labels — `parseRef` normalises

package/dist/lib/auth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EAKjB,KAAK,iBAAiB,EAEzB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,KAAK,QAAQ,EAA0C,MAAM,aAAa,CAAA;AAOnF,eAAO,MAAM,iBAAiB,sCAAsC,CAAA;AACpE,eAAO,MAAM,SAAS,yCAAyC,CAAA;AAC/D,eAAO,MAAM,gBAAgB,qCAAqC,CAAA;AAKlE,eAAO,MAAM,iBAAiB,UAkB7B,CAAA;AAED,eAAO,MAAM,gBAAgB,UAW5B,CAAA;AAID;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;AAsE7D,wBAAgB,uBAAuB,IAAI,YAAY,CAAC,YAAY,CAAC,CAsHpE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAKjF;AA8ED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAK3D;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CASvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CAkDvD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,KAAK,GAAG,cAAc,GAAG,aAAa,CAAC,CAQ5F"}
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EAIjB,KAAK,iBAAiB,EAEzB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,KAAK,QAAQ,EAA0C,MAAM,aAAa,CAAA;AAOnF,eAAO,MAAM,iBAAiB,sCAAsC,CAAA;AACpE,eAAO,MAAM,SAAS,yCAAyC,CAAA;AAC/D,eAAO,MAAM,gBAAgB,qCAAqC,CAAA;AAKlE,eAAO,MAAM,iBAAiB,UAkB7B,CAAA;AAED,eAAO,MAAM,gBAAgB,UAW5B,CAAA;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAErD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;AAE7D;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,IAAI,YAAY,CAAC,YAAY,CAAC,CAwCpE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAKjF;AA8ED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAK3D;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CASvB;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CA6CvD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,KAAK,GAAG,cAAc,GAAG,aAAa,CAAC,CAQ5F"}

package/dist/lib/auth-provider.js

@@ -1,4 +1,4 @@
-import { createKeyringTokenStore, createSecureStore, deriveChallenge, generateVerifier, } from '@doist/cli-core/auth';
+import { createDcrProvider, createKeyringTokenStore, createSecureStore, } from '@doist/cli-core/auth';
 import { createWrappedTwistClient } from './api.js';
 import { LEGACY_KEYRING_ACCOUNT, SECURE_STORE_SERVICE } from './auth-constants.js';
 import { getConfig, getConfigPath, updateConfig } from './config.js';
@@ -43,140 +43,63 @@ export const READ_ONLY_SCOPES = [
     'notifications:read',
 ];
 const AUTH_HINTS = ['Try again: tw auth login', 'Or set TWIST_API_TOKEN environment variable'];
-function asHandshake(value) {
-    return value;
-}
-function authFailed(message, cause) {
-    const detail = cause instanceof Error && cause.message ? `: ${cause.message}` : '';
-    return new CliError('AUTH_FAILED', `${message}${detail}`, AUTH_HINTS);
-}
-async function registerDynamicClient(redirectUri) {
-    let response;
-    try {
-        response = await fetch(REGISTRATION_URL, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-            body: JSON.stringify({
-                client_name: 'Twist CLI',
-                client_uri: 'https://github.com/doist/twist-cli',
-                redirect_uris: [redirectUri],
-                grant_types: ['authorization_code'],
-                response_types: ['code'],
-                token_endpoint_auth_method: 'client_secret_basic',
-                application_type: 'native',
-                logo_uri: LOGO_URI,
-            }),
-        });
-    }
-    catch (error) {
-        if (error instanceof CliError)
-            throw error;
-        throw authFailed('Failed to register OAuth client', error);
-    }
-    if (!response.ok) {
-        const errorText = await response.text().catch(() => '');
-        throw new CliError('AUTH_FAILED', `Client registration failed: ${response.status} ${response.statusText} - ${errorText}`, AUTH_HINTS);
-    }
-    let result;
-    try {
-        result = (await response.json());
-    }
-    catch (error) {
-        throw authFailed('Invalid client registration response', error);
-    }
-    if (!result.client_id || !result.client_secret) {
-        throw new CliError('AUTH_FAILED', 'Invalid client registration response: missing client_id or client_secret', AUTH_HINTS);
-    }
-    return { clientId: result.client_id, clientSecret: result.client_secret };
+/**
+ * The scope set a login is granted, as a pure function of `--read-only`. Single
+ * source of truth shared by `attachTwistLoginCommand`'s `resolveScopes` (what we
+ * request at authorize) and the provider's `validate` (what we record on the
+ * account), so the two can't drift.
+ */
+export function getScopes(readOnly) {
+    return readOnly ? READ_ONLY_SCOPES : READ_WRITE_SCOPES;
 }
+/**
+ * Twist's OAuth flow uses RFC 7591 Dynamic Client Registration: each login
+ * mints a fresh `client_id` / `client_secret`, then runs the standard PKCE
+ * authorize + token exchange (HTTP Basic auth on the token endpoint). cli-core's
+ * `createDcrProvider` drives all of that via `oauth4webapi`; the only
+ * twist-specific piece is `validate`, which probes `getSessionUser` and records
+ * the auth mode/scope the login was granted.
+ *
+ * `authMode` / `authScope` are derived from `handshake.readOnly` (folded in by
+ * `runOAuthFlow`) rather than threaded through `authorize`, because the scope
+ * set is itself a pure function of `readOnly` (see `resolveScopes` in login.ts).
+ */
 export function createTwistAuthProvider() {
-    return {
-        async prepare({ redirectUri }) {
-            const { clientId, clientSecret } = await registerDynamicClient(redirectUri);
-            const handshake = { clientId, clientSecret };
-            return { handshake };
+    return createDcrProvider({
+        registrationUrl: REGISTRATION_URL,
+        authorizeUrl: AUTHORIZATION_URL,
+        tokenUrl: TOKEN_URL,
+        clientMetadata: {
+            clientName: 'Twist CLI',
+            clientUri: 'https://github.com/doist/twist-cli',
+            logoUri: LOGO_URI,
+            applicationType: 'native',
+            // Twist client_ids contain `_` (e.g. `twd_…`). oauth4webapi's
+            // `client_secret_basic` form-url-encodes the Basic credential per
+            // RFC 6749 §2.3.1 (`_` → `%5F`), and Twist's token endpoint doesn't
+            // url-decode it, so the lookup fails with "client_id not found".
+            // `client_secret_post` sends the credential in the body via
+            // URLSearchParams, which preserves `_`, sidestepping the mismatch.
+            tokenEndpointAuthMethod: 'client_secret_post',
         },
-        async authorize({ redirectUri, state, scopes, readOnly, handshake }) {
-            const hs = asHandshake(handshake);
-            const codeVerifier = generateVerifier();
-            const codeChallenge = deriveChallenge(codeVerifier);
-            const authMode = readOnly ? 'read-only' : 'read-write';
-            const authScope = scopes.join(' ');
-            const params = new URLSearchParams({
-                client_id: hs.clientId,
-                response_type: 'code',
-                redirect_uri: redirectUri,
-                scope: authScope,
-                state,
-                code_challenge: codeChallenge,
-                code_challenge_method: 'S256',
-            });
-            const nextHandshake = {
-                ...hs,
-                codeVerifier,
-                authMode,
-                authScope,
-            };
-            return {
-                authorizeUrl: `${AUTHORIZATION_URL}?${params.toString()}`,
-                handshake: nextHandshake,
-            };
-        },
-        async exchangeCode({ code, redirectUri, handshake }) {
-            const hs = asHandshake(handshake);
-            if (!hs.codeVerifier) {
-                throw new CliError('AUTH_FAILED', 'Missing PKCE code verifier from authorize step', AUTH_HINTS);
-            }
-            const body = new URLSearchParams({
-                grant_type: 'authorization_code',
-                code,
-                redirect_uri: redirectUri,
-                code_verifier: hs.codeVerifier,
-            });
-            const credentials = btoa(`${hs.clientId}:${hs.clientSecret}`);
-            let response;
-            try {
-                response = await fetch(TOKEN_URL, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded',
-                        Accept: 'application/json',
-                        Authorization: `Basic ${credentials}`,
-                    },
-                    body: body.toString(),
-                });
-            }
-            catch (error) {
-                if (error instanceof CliError)
-                    throw error;
-                throw authFailed('Failed to exchange code for token', error);
+        errorHints: AUTH_HINTS,
+        async validate({ token, handshake }) {
+            // `runOAuthFlow` folds a boolean `readOnly` into the handshake.
+            // Fail closed on a missing/malformed value rather than letting
+            // `Boolean(undefined)` silently grant read-write (which would relax
+            // the local `ensureWriteAllowed` guard).
+            const readOnly = handshake.readOnly;
+            if (typeof readOnly !== 'boolean') {
+                throw new CliError('AUTH_FAILED', 'Internal: auth handshake missing the readOnly flag.', AUTH_HINTS);
             }
-            if (!response.ok) {
-                const errorText = await response.text().catch(() => '');
-                throw new CliError('AUTH_FAILED', `Token exchange failed: ${response.status} ${response.statusText} - ${errorText}`, AUTH_HINTS);
-            }
-            let data;
-            try {
-                data = (await response.json());
-            }
-            catch (error) {
-                throw authFailed('Invalid token exchange response', error);
-            }
-            if (data.error) {
-                throw new CliError('AUTH_FAILED', `OAuth error: ${data.error} - ${data.error_description ?? 'Unknown error'}`, AUTH_HINTS);
-            }
-            if (!data.access_token) {
-                throw new CliError('AUTH_FAILED', 'No access token received from OAuth server', AUTH_HINTS);
-            }
-            return { accessToken: data.access_token };
-        },
-        async validateToken({ token, handshake }) {
-            const hs = asHandshake(handshake);
             const client = createWrappedTwistClient(token);
             const user = await client.users.getSessionUser();
-            return toTwistAccount(user, { authMode: hs.authMode, authScope: hs.authScope });
+            return toTwistAccount(user, {
+                authMode: readOnly ? 'read-only' : 'read-write',
+                authScope: getScopes(readOnly).join(' '),
+            });
         },
-    };
+    });
 }
 /**
  * Accepts `42`, `id:42`, and case-insensitive labels — `parseRef` normalises
@@ -287,6 +210,28 @@ export async function findAccountInStore(store, ref) {
     }
     return match.account;
 }
+/** Synthetic account for an env-token session (no stored identity). */
+const ENV_TOKEN_ACCOUNT = { id: '', label: '', authMode: 'unknown', authScope: '' };
+/**
+ * Resolve the env-token / legacy-snapshot override that takes precedence over
+ * the v2 keyring store, or `null` to defer to it. Shared by the store's
+ * `active()` and `activeBundle()` so the two reads can't diverge.
+ */
+async function resolveOverrideSnapshot(ref) {
+    if (ref === undefined) {
+        const envToken = process.env[TOKEN_ENV_VAR];
+        if (envToken)
+            return { token: envToken, account: ENV_TOKEN_ACCOUNT };
+    }
+    const result = await ensureMigrated();
+    if (result === null || !migrationIsConclusive(result)) {
+        const legacy = await readLegacyTokenSnapshot();
+        if (legacy && (ref === undefined || matchTwistAccount(legacy.account, ref))) {
+            return legacy;
+        }
+    }
+    return null;
+}
 /**
  * `TWIST_API_TOKEN` short-circuits `active()` only when no explicit ref is
  * supplied — cli-core's `KeyringTokenStore` doesn't know about the env var,
@@ -314,23 +259,18 @@ export function createTwistTokenStore() {
     }
     return Object.assign(Object.create(inner), {
         async active(ref) {
-            if (ref === undefined) {
-                const envToken = process.env[TOKEN_ENV_VAR];
-                if (envToken) {
-                    return {
-                        token: envToken,
-                        account: { id: '', label: '', authMode: 'unknown', authScope: '' },
-                    };
-                }
-            }
-            const result = await ensureMigrated();
-            if (result === null || !migrationIsConclusive(result)) {
-                const legacy = await readLegacyTokenSnapshot();
-                if (legacy && (ref === undefined || matchTwistAccount(legacy.account, ref))) {
-                    return legacy;
-                }
+            return (await resolveOverrideSnapshot(ref)) ?? inner.active(ref);
+        },
+        // Mirror `active()`: cli-core's auth commands read the live credential
+        // through `activeBundle()` (it carries the refresh slot too), so the
+        // env-token + legacy fallbacks must apply here as well or `tw auth
+        // status` would report no token for those users.
+        async activeBundle(ref) {
+            const override = await resolveOverrideSnapshot(ref);
+            if (override) {
+                return { account: override.account, bundle: { accessToken: override.token } };
             }
-            return inner.active(ref);
+            return inner.activeBundle(ref);
         },
         async set(account, token) {
             await maybeDischargeLegacy();

package/dist/lib/auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAIH,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GAGnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAClF,OAAO,EAAiB,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAEpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAAmC,CAAA;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG,sCAAsC,CAAA;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,kCAAkC,CAAA;AAElE,MAAM,QAAQ,GACV,gHAAgH,CAAA;AAEpH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,cAAc;IACd,eAAe;IACf,aAAa;IACb,oBAAoB;CACvB,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,oBAAoB;CACvB,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,0BAA0B,EAAE,6CAA6C,CAAC,CAAA;AA0B9F,SAAS,WAAW,CAAC,KAA8B;IAC/C,OAAO,KAAuB,CAAA;AAClC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,KAAe;IAChD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClF,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,GAAG,OAAO,GAAG,MAAM,EAAE,EAAE,UAAU,CAAC,CAAA;AACzE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAChC,WAAmB;IAEnB,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,WAAW,EAAE,WAAW;gBACxB,UAAU,EAAE,oCAAoC;gBAChD,aAAa,EAAE,CAAC,WAAW,CAAC;gBAC5B,WAAW,EAAE,CAAC,oBAAoB,CAAC;gBACnC,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,0BAA0B,EAAE,qBAAqB;gBACjD,gBAAgB,EAAE,QAAQ;gBAC1B,QAAQ,EAAE,QAAQ;aACrB,CAAC;SACL,CAAC,CAAA;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,QAAQ;YAAE,MAAM,KAAK,CAAA;QAC1C,MAAM,UAAU,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QACvD,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,+BAA+B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,EACtF,UAAU,CACb,CAAA;IACL,CAAC;IAED,IAAI,MAAsD,CAAA;IAC1D,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmD,CAAA;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,UAAU,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;IACnE,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,0EAA0E,EAC1E,UAAU,CACb,CAAA;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,uBAAuB;IACnC,OAAO;QACH,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE;YACzB,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAA;YAC3E,MAAM,SAAS,GAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;YAC5D,OAAO,EAAE,SAAS,EAAE,CAAA;QACxB,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;YAC/D,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;YACvC,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YACnD,MAAM,QAAQ,GAAa,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAA;YAChE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAElC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBAC/B,SAAS,EAAE,EAAE,CAAC,QAAQ;gBACtB,aAAa,EAAE,MAAM;gBACrB,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,SAAS;gBAChB,KAAK;gBACL,cAAc,EAAE,aAAa;gBAC7B,qBAAqB,EAAE,MAAM;aAChC,CAAC,CAAA;YAEF,MAAM,aAAa,GAAmB;gBAClC,GAAG,EAAE;gBACL,YAAY;gBACZ,QAAQ;gBACR,SAAS;aACZ,CAAA;YACD,OAAO;gBACH,YAAY,EAAE,GAAG,iBAAiB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE;gBACzD,SAAS,EAAE,aAAa;aAC3B,CAAA;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;YAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;gBACnB,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,gDAAgD,EAChD,UAAU,CACb,CAAA;YACL,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC7B,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,EAAE,CAAC,YAAY;aACjC,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,CAAA;YAE7D,IAAI,QAAkB,CAAA;YACtB,IAAI,CAAC;gBACD,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;oBAC9B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACL,cAAc,EAAE,mCAAmC;wBACnD,MAAM,EAAE,kBAAkB;wBAC1B,aAAa,EAAE,SAAS,WAAW,EAAE;qBACxC;oBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;iBACxB,CAAC,CAAA;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,QAAQ;oBAAE,MAAM,KAAK,CAAA;gBAC1C,MAAM,UAAU,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;gBACvD,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,0BAA0B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,EACjF,UAAU,CACb,CAAA;YACL,CAAC;YAED,IAAI,IAIH,CAAA;YACD,IAAI,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAA;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,UAAU,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;YAC9D,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,gBAAgB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,iBAAiB,IAAI,eAAe,EAAE,EAC3E,UAAU,CACb,CAAA;YACL,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrB,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,4CAA4C,EAC5C,UAAU,CACb,CAAA;YACL,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAA;QAC7C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;YACjC,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAA;YAChD,OAAO,cAAc,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA;QACnF,CAAC;KACJ,CAAA;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAE,GAAe;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,EAAE,CAAA;IACjE,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC5F,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAEvC,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,MAAuC;IAClE,OAAO,CACH,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,MAAM,CAAC,MAAM,KAAK,kBAAkB;QACpC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CACtC,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB;IAIlC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;QACxC,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,sBAAsB;KAClC,CAAC;SACG,SAAS,EAAE;SACX,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,WAAW,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACH,KAAK;QACL,OAAO,EAAE,gBAAgB,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YACpE,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC9B,CAAC;KACL,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB;IAC/B,MAAM,OAAO,CAAC,UAAU,CAAC;QACrB,iBAAiB,CAAC;YACd,WAAW,EAAE,oBAAoB;YACjC,OAAO,EAAE,sBAAsB;SAClC,CAAC,CAAC,YAAY,EAAE;QACjB,YAAY,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,SAAS;YACvB,uBAAuB,EAAE,SAAS;SACrC,CAAC;KACL,CAAC,CAAA;AACN,CAAC;AAED;;;;;GAKG;AACH,IAAI,gBAA6E,CAAA;AACjF,SAAS,cAAc;IACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAsB,EACtB,GAAe;IAEf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,GAAG,IAAI,EAAE;YAC3E,sBAAsB;SACzB,CAAC,CAAA;IACN,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB;IACjC,MAAM,KAAK,GAAG,uBAAuB,CAAe;QAChD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,0BAA0B,EAAE;QACzC,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,iBAAiB;KAClC,CAAC,CAAA;IACF,KAAK,UAAU,oBAAoB;QAC/B,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;QACrC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,MAAM,oBAAoB,EAAE,CAAA;QAChC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAoB,EAAE;QAC1D,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACX,OAAO;wBACH,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;qBACrE,CAAA;gBACL,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;YACrC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;gBAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC1E,OAAO,MAAM,CAAA;gBACjB,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAqB,EAAE,KAAa;YAC1C,MAAM,oBAAoB,EAAE,CAAA;YAC5B,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,MAAM,oBAAoB,EAAE,CAAA;YAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,aAAa;QAAE,OAAO,aAAa,CAAA;IAC/C,IAAI,MAAM;QAAE,OAAO,cAAc,CAAA;IACjC,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,aAAa,CAAA;IAC9C,OAAO,cAAc,CAAA;AACzB,CAAC"}
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAIH,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,GAGpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAClF,OAAO,EAAiB,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAEpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAAmC,CAAA;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG,sCAAsC,CAAA;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,kCAAkC,CAAA;AAElE,MAAM,QAAQ,GACV,gHAAgH,CAAA;AAEpH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,cAAc;IACd,eAAe;IACf,aAAa;IACb,oBAAoB;CACvB,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,oBAAoB;CACvB,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,0BAA0B,EAAE,6CAA6C,CAAC,CAAA;AAE9F;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,QAAiB;IACvC,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAA;AAC1D,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB;IACnC,OAAO,iBAAiB,CAAe;QACnC,eAAe,EAAE,gBAAgB;QACjC,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,SAAS;QACnB,cAAc,EAAE;YACZ,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,oCAAoC;YAC/C,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,8DAA8D;YAC9D,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,4DAA4D;YAC5D,mEAAmE;YACnE,uBAAuB,EAAE,oBAAoB;SAChD;QACD,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/B,gEAAgE;YAChE,+DAA+D;YAC/D,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAA;YACnC,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,qDAAqD,EACrD,UAAU,CACb,CAAA;YACL,CAAC;YACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAA;YAChD,OAAO,cAAc,CAAC,IAAI,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;gBAC/C,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAC3C,CAAC,CAAA;QACN,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAE,GAAe;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,EAAE,CAAA;IACjE,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC5F,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAEvC,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,MAAuC;IAClE,OAAO,CACH,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,MAAM,CAAC,MAAM,KAAK,kBAAkB;QACpC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CACtC,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB;IAIlC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;QACxC,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,sBAAsB;KAClC,CAAC;SACG,SAAS,EAAE;SACX,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,WAAW,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACH,KAAK;QACL,OAAO,EAAE,gBAAgB,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YACpE,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC9B,CAAC;KACL,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB;IAC/B,MAAM,OAAO,CAAC,UAAU,CAAC;QACrB,iBAAiB,CAAC;YACd,WAAW,EAAE,oBAAoB;YACjC,OAAO,EAAE,sBAAsB;SAClC,CAAC,CAAC,YAAY,EAAE;QACjB,YAAY,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,SAAS;YACvB,uBAAuB,EAAE,SAAS;SACrC,CAAC;KACL,CAAC,CAAA;AACN,CAAC;AAED;;;;;GAKG;AACH,IAAI,gBAA6E,CAAA;AACjF,SAAS,cAAc;IACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAsB,EACtB,GAAe;IAEf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,GAAG,IAAI,EAAE;YAC3E,sBAAsB;SACzB,CAAC,CAAA;IACN,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAA;AACxB,CAAC;AAED,uEAAuE;AACvE,MAAM,iBAAiB,GAAiB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AAEjG;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CAClC,GAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC3C,IAAI,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,MAAM,CAAA;QACjB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB;IACjC,MAAM,KAAK,GAAG,uBAAuB,CAAe;QAChD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,0BAA0B,EAAE;QACzC,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,iBAAiB;KAClC,CAAC,CAAA;IACF,KAAK,UAAU,oBAAoB;QAC/B,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;QACrC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,MAAM,oBAAoB,EAAE,CAAA;QAChC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAoB,EAAE;QAC1D,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpE,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,iDAAiD;QACjD,KAAK,CAAC,YAAY,CAAC,GAAgB;YAC/B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAA;YACjF,CAAC;YACD,OAAO,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAqB,EAAE,KAAa;YAC1C,MAAM,oBAAoB,EAAE,CAAA;YAC5B,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,MAAM,oBAAoB,EAAE,CAAA;YAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,aAAa;QAAE,OAAO,aAAa,CAAA;IAC/C,IAAI,MAAM;QAAE,OAAO,cAAc,CAAA;IACjC,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,aAAa,CAAA;IAC9C,OAAO,cAAc,CAAA;AACzB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/twist-cli",
-    "version": "2.41.1",
+    "version": "2.42.0",
     "description": "TypeScript CLI for Twist",
     "type": "module",
     "main": "dist/index.js",
@@ -50,24 +50,25 @@
         "CHANGELOG.md"
     ],
     "dependencies": {
-        "@doist/cli-core": "0.16.1",
-        "@doist/twist-sdk": "2.6.0",
+        "@doist/cli-core": "0.20.0",
+        "@doist/twist-sdk": "2.7.0",
         "@pnpm/tabtab": "0.5.4",
         "chalk": "5.6.2",
         "commander": "14.0.3",
         "marked": "18.0.3",
         "marked-terminal-renderer": "2.2.0",
+        "oauth4webapi": "3.8.6",
         "open": "11.0.0"
     },
     "devDependencies": {
         "@semantic-release/changelog": "6.0.3",
         "@semantic-release/exec": "7.1.0",
         "@semantic-release/git": "10.0.1",
-        "@types/node": "25.7.0",
+        "@types/node": "25.8.0",
         "conventional-changelog-conventionalcommits": "9.3.1",
         "lefthook": "2.1.6",
-        "oxfmt": "0.49.0",
-        "oxlint": "1.63.0",
+        "oxfmt": "0.50.0",
+        "oxlint": "1.65.0",
         "semantic-release": "25.0.3",
         "typescript": "6.0.3",
         "vitest": "4.1.6"