@todoist/outline-cli 0.0.0-stage → 3.0.0

package/dist/lib/auth.js

@@ -0,0 +1,188 @@
+import { refreshAccessToken, SecureStoreUnavailableError, } from '@todoist/cli-core/auth';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { createOutlineAuthProvider, createOutlineTokenStore, getActiveTokenSource, } from './auth-provider.js';
+import { getConfig, getConfigPath } from './config.js';
+import { CliError } from './errors.js';
+import { getRequestedUserRef } from './global-args.js';
+import { DEFAULT_BASE_URL } from './outline-account.js';
+import { getDefaultUserRecord, recordForRef } from './user-records.js';
+import { withUserRefAware } from './user-ref-store.js';
+export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
+export class NoTokenError extends CliError {
+    constructor() {
+        super('NO_TOKEN', `No API token found. Set ${TOKEN_ENV_VAR} env var or run: ol auth login`, [`Set ${TOKEN_ENV_VAR} or run: ol auth login`], 'info');
+        this.name = 'NoTokenError';
+    }
+}
+/**
+ * Module-level token-store singleton. Built lazily on first call; reused
+ * across every `apiRequest` so the request hot path doesn't reconstruct
+ * the keyring + user-record adapters per POST.
+ */
+let storeSingleton;
+function tokenStore() {
+    // Wrapped so a global `--user <ref>` flows into every no-ref store read on
+    // the request hot path (token lookup + refresh). Without `--user`,
+    // `getRequestedUserRef()` is undefined and the wrap is a pass-through.
+    if (!storeSingleton)
+        storeSingleton = withUserRefAware(createOutlineTokenStore());
+    return storeSingleton;
+}
+/**
+ * The `--user` ref to apply on the request path, or `undefined` when an
+ * `OUTLINE_API_TOKEN` is set — an env token wins outright, so base URL and
+ * client id resolve from the default account rather than the named one,
+ * keeping token / base URL / client id pinned to the same source.
+ */
+function requestPathUserRef() {
+    if (process.env[TOKEN_ENV_VAR]?.trim())
+        return undefined;
+    return getRequestedUserRef();
+}
+let providerSingleton;
+function authProvider() {
+    if (!providerSingleton)
+        providerSingleton = createOutlineAuthProvider();
+    return providerSingleton;
+}
+// Caller-provided O_EXCL lock so concurrent `ol` invocations don't issue
+// parallel refresh grants. Resolved per-call (not cached) to honour test
+// config-path mocking, mirroring `getConfigPath`.
+function refreshLockPath() {
+    return `${getConfigPath()}.refresh.lock`;
+}
+/**
+ * Best-effort proactive rotation before a request. Returns the token to use
+ * (the rotated one, or the current one if no rotation was needed) so the
+ * caller doesn't re-read the store; `undefined` when the account isn't
+ * refreshable (no refresh token / env / failure) — the caller then falls back
+ * to `getApiToken()` and the 401 path stays authoritative. The wrapped store
+ * scopes the bundle to any global `--user`; `handshake` pins the token
+ * endpoint to that account's instance + client id.
+ */
+export async function proactiveRefresh(handshake) {
+    try {
+        const { bundle } = await refreshAccessToken({
+            store: tokenStore(),
+            provider: authProvider(),
+            lockPath: refreshLockPath(),
+            handshake,
+        });
+        return bundle.accessToken;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Refresh wiring for cli-core's `auth status` / `auth token view` attachers,
+ * so both hand back a token that is usable right now rather than whatever
+ * was last stored. The attachers pass their own (`--user`-aware) store, so
+ * the handshake is resolved from the account cli-core actually selected —
+ * pinning the refresh to that account's instance and client id. Env, legacy
+ * and record-less accounts carry no refresh token and are served as-is.
+ */
+export function getTokenRefreshOptions() {
+    return {
+        provider: authProvider(),
+        lockPath: refreshLockPath(),
+        handshake: ({ account }) => ({ baseUrl: account.baseUrl, clientId: account.oauthClientId }),
+    };
+}
+/**
+ * Reactive rotation after a 401. Returns `true` when the token rotated (the
+ * caller retries once). A rejected/absent refresh token surfaces as
+ * `NoTokenError` (re-login); a transient failure propagates unchanged.
+ */
+export async function reactiveRefresh(handshake) {
+    try {
+        const result = await refreshAccessToken({
+            store: tokenStore(),
+            provider: authProvider(),
+            lockPath: refreshLockPath(),
+            force: true,
+            handshake,
+        });
+        return result.rotated;
+    }
+    catch (err) {
+        // Match on the structural `.code` rather than `instanceof`: cli-core
+        // throws its own CliError, and class identity isn't reliable across
+        // package boundaries (duplicate module instances under linking).
+        const code = err?.code;
+        if (code === 'AUTH_REFRESH_EXPIRED' || code === 'AUTH_REFRESH_UNAVAILABLE') {
+            throw new NoTokenError();
+        }
+        throw err;
+    }
+}
+/**
+ * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
+ * return it directly without consulting the token store, since
+ * `apiRequest` already resolves the base URL separately — going through
+ * `store.active()` here would trigger a redundant `getBaseUrl()` lookup
+ * per request just to synthesise an account we don't need.
+ */
+export async function getApiToken() {
+    const envToken = process.env[TOKEN_ENV_VAR]?.trim();
+    if (envToken)
+        return envToken;
+    const snapshot = await tokenStore().active();
+    if (!snapshot?.token)
+        throw new NoTokenError();
+    return snapshot.token;
+}
+/**
+ * Account-agnostic base URL cascade: env var → default user record (v2) →
+ * legacy `base_url` config (v1) → built-in default. Deliberately ignores the
+ * global `--user` selector so the login flow (which resolves its default
+ * prompt through here) isn't skewed by account selection; the request path
+ * applies `--user` separately via {@link getRequestContext}.
+ */
+export async function getBaseUrl() {
+    const envUrl = process.env.OUTLINE_URL;
+    if (envUrl)
+        return envUrl.replace(/\/$/, '');
+    const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.account.baseUrl)
+        return record.account.baseUrl.replace(/\/$/, '');
+    if (config.base_url)
+        return config.base_url.replace(/\/$/, '');
+    return DEFAULT_BASE_URL;
+}
+/**
+ * Account-agnostic OAuth client id cascade: env var → default user record
+ * (v2) → legacy `oauth_client_id` config (v1) → undefined (caller prompts).
+ * Like {@link getBaseUrl}, ignores `--user` so login stays default-driven.
+ */
+export async function getOAuthClientId() {
+    const envClientId = process.env.OUTLINE_OAUTH_CLIENT_ID;
+    if (envClientId)
+        return envClientId;
+    const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.account.oauthClientId)
+        return record.account.oauthClientId;
+    return config.oauth_client_id;
+}
+/**
+ * Resolve the base URL — and, when a `--user` account is selected, the refresh
+ * handshake (its instance + client id) — for a single managed request. Falls
+ * back to the account-agnostic {@link getBaseUrl} cascade without `--user`.
+ * An unknown ref resolves no handshake and the default base URL; the wrapped
+ * token store then raises `ACCOUNT_NOT_FOUND` when the token is read, so the
+ * request never fires.
+ */
+export async function getRequestContext() {
+    const ref = requestPathUserRef();
+    if (ref !== undefined) {
+        const record = recordForRef(await getConfig(), ref);
+        if (record) {
+            const baseUrl = record.account.baseUrl.replace(/\/$/, '');
+            return { baseUrl, handshake: { baseUrl, clientId: record.account.oauthClientId } };
+        }
+    }
+    return { baseUrl: await getBaseUrl() };
+}
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,kBAAkB,EAClB,2BAA2B,GAE9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EACH,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GAEvB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAuB,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAQtD,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAA;AAE3E,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACtC;QACI,KAAK,CACD,UAAU,EACV,2BAA2B,aAAa,gCAAgC,EACxE,CAAC,OAAO,aAAa,wBAAwB,CAAC,EAC9C,MAAM,CACT,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC9B,CAAC;CACJ;AAED;;;;GAIG;AACH,IAAI,cAA6C,CAAA;AACjD,SAAS,UAAU;IACf,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAuE;IACvE,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,gBAAgB,CAAC,uBAAuB,EAAE,CAAC,CAAA;IACjF,OAAO,cAAc,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACvB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAA;IACxD,OAAO,mBAAmB,EAAE,CAAA;AAChC,CAAC;AAED,IAAI,iBAA2E,CAAA;AAC/E,SAAS,YAAY;IACjB,IAAI,CAAC,iBAAiB;QAAE,iBAAiB,GAAG,yBAAyB,EAAE,CAAA;IACvE,OAAO,iBAAiB,CAAA;AAC5B,CAAC;AAED,yEAAyE;AACzE,yEAAyE;AACzE,kDAAkD;AAClD,SAAS,eAAe;IACpB,OAAO,GAAG,aAAa,EAAE,eAAe,CAAA;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,SAAuC;IAEvC,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACxC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,SAAS;SACZ,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,WAAW,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAA;IACpB,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IAClC,OAAO;QACH,QAAQ,EAAE,YAAY,EAAE;QACxB,QAAQ,EAAE,eAAe,EAAE;QAC3B,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;KAC9F,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAuC;IACzE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACpC,KAAK,EAAE,UAAU,EAAE;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,QAAQ,EAAE,eAAe,EAAE;YAC3B,KAAK,EAAE,IAAI;YACX,SAAS;SACZ,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,OAAO,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,qEAAqE;QACrE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;QACrD,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;YACzE,MAAM,IAAI,YAAY,EAAE,CAAA;QAC5B,CAAC;QACD,MAAM,GAAG,CAAA;IACb,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC,MAAM,EAAE,CAAA;IAC5C,IAAI,CAAC,QAAQ,EAAE,KAAK;QAAE,MAAM,IAAI,YAAY,EAAE,CAAA;IAC9C,OAAO,QAAQ,CAAC,KAAK,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC7E,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9D,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACvD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,OAAO,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IACtE,OAAO,MAAM,CAAC,eAAe,CAAA;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACnC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAA;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,SAAS,EAAE,EAAE,GAAG,CAAC,CAAA;QACnD,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACzD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAA;QACtF,CAAC;IACL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE,EAAE,CAAA;AAC1C,CAAC"}

package/dist/lib/config.d.ts

@@ -0,0 +1,45 @@
+import { type CoreConfig } from '@todoist/cli-core';
+/**
+ * One row of the `users[]` array. `id` is the Outline user UUID. `token` is
+ * a plaintext fallback persisted only when the OS keyring is unavailable at
+ * write time (WSL, headless Linux, missing native binary).
+ */
+export type StoredUser = {
+    id: string;
+    name: string;
+    base_url?: string;
+    oauth_client_id?: string;
+    team_name?: string;
+    /** Plaintext access-token fallback, present only when the keyring was unavailable at write time. */
+    token?: string;
+    /** Access-token expiry (unix-epoch ms); drives proactive refresh. */
+    access_token_expires_at?: number;
+    /** Refresh-token expiry (unix-epoch ms), when the server returns one. */
+    refresh_token_expires_at?: number;
+    /** Whether a refresh token is stored (keyring slot or `refresh_token`). */
+    has_refresh_token?: boolean;
+};
+export type Config = CoreConfig & {
+    config_version?: number;
+    users?: StoredUser[];
+    default_user_id?: string;
+    /**
+     * Legacy v1 single-user fields. Read by the migration helper; removed
+     * from disk by `cleanupLegacyConfig` after the v2 record write succeeds.
+     */
+    api_token?: string;
+    base_url?: string;
+    oauth_client_id?: string;
+    auth_user_id?: string;
+    auth_user_name?: string;
+    auth_team_name?: string;
+};
+/**
+ * Resolve the canonical config path on every call. Caching at module load
+ * would pin the path to the unmocked `node:os.homedir` before vitest's
+ * `vi.mock('node:os', …)` hoist takes effect in a fresh test file.
+ */
+export declare function getConfigPath(): string;
+export declare function getConfig(): Promise<Partial<Config>>;
+export declare function setConfig(config: Config): Promise<void>;
+export declare function updateConfig(updates: Partial<Config>): Promise<void>;

package/dist/lib/config.js

@@ -0,0 +1,20 @@
+import { getConfigPath as coreGetConfigPath, readConfig as coreReadConfig, updateConfig as coreUpdateConfig, writeConfig as coreWriteConfig, } from '@todoist/cli-core';
+const APP_NAME = 'outline-cli';
+/**
+ * Resolve the canonical config path on every call. Caching at module load
+ * would pin the path to the unmocked `node:os.homedir` before vitest's
+ * `vi.mock('node:os', …)` hoist takes effect in a fresh test file.
+ */
+export function getConfigPath() {
+    return coreGetConfigPath(APP_NAME);
+}
+export async function getConfig() {
+    return coreReadConfig(getConfigPath());
+}
+export async function setConfig(config) {
+    return coreWriteConfig(getConfigPath(), config);
+}
+export async function updateConfig(updates) {
+    return coreUpdateConfig(getConfigPath(), updates);
+}
+//# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,aAAa,IAAI,iBAAiB,EAClC,UAAU,IAAI,cAAc,EAC5B,YAAY,IAAI,gBAAgB,EAChC,WAAW,IAAI,eAAe,GACjC,MAAM,mBAAmB,CAAA;AAE1B,MAAM,QAAQ,GAAG,aAAa,CAAA;AAwC9B;;;;GAIG;AACH,MAAM,UAAU,aAAa;IACzB,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC3B,OAAO,cAAc,CAAS,aAAa,EAAE,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC1C,OAAO,eAAe,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB;IACvD,OAAO,gBAAgB,CAAS,aAAa,EAAE,EAAE,OAAO,CAAC,CAAA;AAC7D,CAAC"}

package/dist/lib/errors.d.ts

@@ -0,0 +1,8 @@
+import { CliError as CoreCliError, type CliErrorCode, type ErrorType } from '@todoist/cli-core';
+export { CoreCliError as BaseCliError };
+export type { ErrorType } from '@todoist/cli-core';
+export type ErrorCode = 'ACCOUNT_NOT_FOUND' | 'AUTH_VERIFICATION_FAILED' | 'CONFIRMATION_REQUIRED' | 'CONFLICTING_OPTIONS' | 'DOCUMENT_CHANGED' | 'INVALID_PARENT' | 'INVALID_TIMESTAMP' | 'INVALID_USER_FLAG' | 'MISSING_OPTION' | 'NO_TOKEN' | 'OAUTH_CALLBACK_PORT_INVALID' | 'OAUTH_CALLBACK_SERVER_FAILED' | 'OAUTH_CLIENT_ID_REQUIRED' | 'OAUTH_LOGIN_FAILED' | 'UNKNOWN_AGENT';
+export declare class CliError extends CoreCliError<ErrorCode> {
+    constructor(code: ErrorCode | CliErrorCode, message: string, hints?: string[], type?: ErrorType);
+}
+export { getErrorMessage } from '@todoist/cli-core';

package/dist/lib/errors.js

@@ -0,0 +1,9 @@
+import { CliError as CoreCliError } from '@todoist/cli-core';
+export { CoreCliError as BaseCliError };
+export class CliError extends CoreCliError {
+    constructor(code, message, hints, type = 'error') {
+        super(code, message, { hints, type });
+    }
+}
+export { getErrorMessage } from '@todoist/cli-core';
+//# sourceMappingURL=errors.js.map

package/dist/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqC,MAAM,mBAAmB,CAAA;AAE/F,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAA;AAoBvC,MAAM,OAAO,QAAS,SAAQ,YAAuB;IACjD,YACI,IAA8B,EAC9B,OAAe,EACf,KAAgB,EAChB,IAAI,GAAc,OAAO;QAEzB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;CACJ;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/lib/global-args.d.ts

@@ -0,0 +1,30 @@
+export declare const getGlobalArgs: () => import("@todoist/cli-core").GlobalArgs;
+export declare const resetGlobalArgs: () => void;
+export declare const isAccessible: () => boolean;
+export declare const shouldDisableSpinner: () => boolean;
+export declare function isJsonMode(): boolean;
+/**
+ * Pre-subcommand `ol --user <ref>` selector. cli-core's `parseGlobalArgs`
+ * already extracts it from argv; `applyUserSelector` strips the flag before
+ * Commander parses, so this reads the value off the warmed cache.
+ */
+export declare function getRequestedUserRef(): string | undefined;
+/**
+ * Guard a root `--user` against the two common footguns before it's stripped:
+ * a value-less flag (`--user`, `--user=`) and a forgotten value where the next
+ * token is actually a command (`ol --user document list`). Pure — pass the
+ * pre-strip argv and the set of registered command names. Silent when `--user`
+ * is absent, or when it appears *after* a command (a late flag is left for
+ * Commander to reject as an unknown option, matching what `stripUserFlag`
+ * leaves in argv).
+ */
+export declare function validateRootUserFlag(argv: string[], knownCommands: ReadonlySet<string>): void;
+/**
+ * Entrypoint wiring for the global `--user` selector, kept here so the
+ * validate → warm-cache → strip order is exercised by tests rather than living
+ * untested in `src/index.ts`. Validates the root flag, warms the global-args
+ * cache off the *original* argv (so the ref survives), then rewrites
+ * `process.argv` with the flag stripped for Commander. Throws `INVALID_USER_FLAG`
+ * on a malformed root flag.
+ */
+export declare function applyUserSelector(knownCommands: ReadonlySet<string>): void;

package/dist/lib/global-args.js

@@ -0,0 +1,66 @@
+import { createAccessibleGate, createGlobalArgsStore, createSpinnerGate, parseGlobalArgs, stripUserFlag, } from '@todoist/cli-core';
+import { CliError } from './errors.js';
+const store = createGlobalArgsStore();
+export const getGlobalArgs = store.get;
+export const resetGlobalArgs = store.reset;
+export const isAccessible = createAccessibleGate({
+    envVar: 'OL_ACCESSIBLE',
+    getArgs: store.get,
+});
+export const shouldDisableSpinner = createSpinnerGate({
+    envVar: 'OL_SPINNER',
+    getArgs: store.get,
+});
+export function isJsonMode() {
+    const args = store.get();
+    return args.json || args.ndjson;
+}
+/**
+ * Pre-subcommand `ol --user <ref>` selector. cli-core's `parseGlobalArgs`
+ * already extracts it from argv; `applyUserSelector` strips the flag before
+ * Commander parses, so this reads the value off the warmed cache.
+ */
+export function getRequestedUserRef() {
+    return store.get().user;
+}
+/**
+ * Guard a root `--user` against the two common footguns before it's stripped:
+ * a value-less flag (`--user`, `--user=`) and a forgotten value where the next
+ * token is actually a command (`ol --user document list`). Pure — pass the
+ * pre-strip argv and the set of registered command names. Silent when `--user`
+ * is absent, or when it appears *after* a command (a late flag is left for
+ * Commander to reject as an unknown option, matching what `stripUserFlag`
+ * leaves in argv).
+ */
+export function validateRootUserFlag(argv, knownCommands) {
+    const userIdx = argv.findIndex((a) => a === '--user' || a.startsWith('--user='));
+    if (userIdx === -1)
+        return;
+    const firstCmdIdx = argv.findIndex((a) => knownCommands.has(a));
+    if (firstCmdIdx !== -1 && userIdx > firstCmdIdx)
+        return;
+    const ref = parseGlobalArgs(argv).user;
+    if (!ref) {
+        throw new CliError('INVALID_USER_FLAG', '--user requires a value: <id|name>.', [
+            'Example: ol --user scott@example.com document list',
+        ]);
+    }
+    if (knownCommands.has(ref)) {
+        throw new CliError('INVALID_USER_FLAG', `--user requires a value: got "${ref}", which looks like a command — did you forget the value?`, [`Example: ol --user scott@example.com ${ref}`]);
+    }
+}
+/**
+ * Entrypoint wiring for the global `--user` selector, kept here so the
+ * validate → warm-cache → strip order is exercised by tests rather than living
+ * untested in `src/index.ts`. Validates the root flag, warms the global-args
+ * cache off the *original* argv (so the ref survives), then rewrites
+ * `process.argv` with the flag stripped for Commander. Throws `INVALID_USER_FLAG`
+ * on a malformed root flag.
+ */
+export function applyUserSelector(knownCommands) {
+    const original = process.argv.slice(2);
+    validateRootUserFlag(original, knownCommands);
+    getRequestedUserRef();
+    process.argv = [process.argv[0], process.argv[1], ...stripUserFlag(original)];
+}
+//# sourceMappingURL=global-args.js.map

package/dist/lib/global-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-args.js","sourceRoot":"","sources":["../../src/lib/global-args.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,GAChB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAA;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAA;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;IAC7C,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC,GAAG;CACrB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;IAClD,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,KAAK,CAAC,GAAG;CACrB,CAAC,CAAA;AAEF,MAAM,UAAU,UAAU;IACtB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACxB,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IAC/B,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAA;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAc,EAAE,aAAkC;IACnF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IAChF,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAM;IAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,OAAO,GAAG,WAAW;QAAE,OAAM;IAEvD,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,qCAAqC,EAAE;YAC3E,oDAAoD;SACvD,CAAC,CAAA;IACN,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CACd,mBAAmB,EACnB,iCAAiC,GAAG,2DAA2D,EAC/F,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAClD,CAAA;IACL,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAkC;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACtC,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IAC7C,mBAAmB,EAAE,CAAA;IACrB,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;AACjF,CAAC"}

package/dist/lib/markdown.d.ts

@@ -0,0 +1,2 @@
+export declare function preloadMarkdown(): Promise<void>;
+export declare function renderMarkdown(text: string): Promise<string>;

package/dist/lib/markdown.js

@@ -0,0 +1,12 @@
+import { preloadMarkdown as corePreloadMarkdown, renderMarkdown as coreRenderMarkdown, } from '@todoist/cli-core/markdown';
+let preloadPromise = null;
+export async function preloadMarkdown() {
+    if (!preloadPromise)
+        preloadPromise = corePreloadMarkdown();
+    return preloadPromise;
+}
+export async function renderMarkdown(text) {
+    await preloadMarkdown();
+    return coreRenderMarkdown(text);
+}
+//# sourceMappingURL=markdown.js.map

package/dist/lib/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../src/lib/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,eAAe,IAAI,mBAAmB,EACtC,cAAc,IAAI,kBAAkB,GACvC,MAAM,4BAA4B,CAAA;AAEnC,IAAI,cAAc,GAAyB,IAAI,CAAA;AAE/C,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,mBAAmB,EAAE,CAAA;IAC3D,OAAO,cAAc,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC7C,MAAM,eAAe,EAAE,CAAA;IACvB,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAA;AACnC,CAAC"}

package/dist/lib/migrate-auth.d.ts

@@ -0,0 +1,11 @@
+import { type MigrateAuthResult } from '@todoist/cli-core/auth';
+import { type OutlineAccount } from './outline-account.js';
+/**
+ * One-time migration of v1 plaintext auth state into the v2 `users[]`
+ * shape. Called lazily by `createOutlineTokenStore` on first store access.
+ * Idempotent via the `config_version` marker — once set to `>= 2`, this
+ * helper short-circuits with `already-migrated`.
+ */
+export declare function runMigrateLegacyAuth(options?: {
+    silent: boolean;
+}): Promise<MigrateAuthResult<OutlineAccount>>;

package/dist/lib/migrate-auth.js

@@ -0,0 +1,92 @@
+import { migrateLegacyAuth } from '@todoist/cli-core/auth';
+import { fetchWithRetry } from '../transport/fetch-with-retry.js';
+import { LEGACY_CLEAR_PAYLOAD, LEGACY_KEYRING_ACCOUNT, SECURE_STORE_SERVICE, } from './auth-constants.js';
+import { getConfig, updateConfig } from './config.js';
+import { DEFAULT_BASE_URL, makeOutlineAccount } from './outline-account.js';
+import { createOutlineUserRecordStore } from './user-records.js';
+/**
+ * Pinned to this migration's target schema. Decoupled from any future
+ * `config_version` bump so this helper doesn't re-run for users already
+ * on v2 or beyond.
+ */
+const V2_SCHEMA_VERSION = 2;
+/**
+ * Cap migration's `auth.info` lookup so a stalled connection can't hang
+ * the CLI indefinitely on first command. cli-core treats the resulting
+ * timeout as `identify-failed`, falling back to the legacy snapshot.
+ */
+const IDENTIFY_TIMEOUT_MS = 10_000;
+/**
+ * Direct `auth.info` call used only by the migration path. We bypass
+ * `apiRequest` (and its spinner + `getApiToken`/`getBaseUrl` cascade) so
+ * this module stays out of the runtime auth/token-store import graph and
+ * so the silent migration doesn't render a spinner during postinstall-style
+ * invocations.
+ */
+async function identifyOutlineAccount(token) {
+    const config = await getConfig();
+    const baseUrl = (config.base_url ?? DEFAULT_BASE_URL).replace(/\/$/, '');
+    const res = await fetchWithRetry({
+        url: `${baseUrl}/api/auth.info`,
+        options: {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${token}`,
+            },
+            body: JSON.stringify({}),
+            timeout: IDENTIFY_TIMEOUT_MS,
+        },
+    });
+    if (!res.ok) {
+        throw new Error(`auth.info failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    return makeOutlineAccount({
+        id: json.data.user.id,
+        label: json.data.user.name,
+        baseUrl,
+        oauthClientId: config.oauth_client_id ?? '',
+        teamName: json.data.team.name,
+    });
+}
+/**
+ * One-time migration of v1 plaintext auth state into the v2 `users[]`
+ * shape. Called lazily by `createOutlineTokenStore` on first store access.
+ * Idempotent via the `config_version` marker — once set to `>= 2`, this
+ * helper short-circuits with `already-migrated`.
+ */
+export async function runMigrateLegacyAuth(options = { silent: true }) {
+    return migrateLegacyAuth({
+        serviceName: SECURE_STORE_SERVICE,
+        legacyAccount: LEGACY_KEYRING_ACCOUNT,
+        userRecords: createOutlineUserRecordStore(),
+        hasMigrated: async () => {
+            const config = await getConfig();
+            // Two signals of "already on v2": the explicit marker, or
+            // the structural presence of `users[]` (a fresh install that
+            // logged in directly via cli-core writes records without ever
+            // setting `config_version`, so the marker alone would
+            // miscount that case as "needs migration").
+            if ((config.config_version ?? 0) >= V2_SCHEMA_VERSION)
+                return true;
+            if ((config.users ?? []).length > 0)
+                return true;
+            return false;
+        },
+        markMigrated: async () => {
+            await updateConfig({ config_version: V2_SCHEMA_VERSION });
+        },
+        loadLegacyPlaintextToken: async () => {
+            const config = await getConfig();
+            return config.api_token?.trim() || null;
+        },
+        identifyAccount: identifyOutlineAccount,
+        cleanupLegacyConfig: async () => {
+            await updateConfig(LEGACY_CLEAR_PAYLOAD);
+        },
+        silent: options.silent,
+        logPrefix: 'outline-cli',
+    });
+}
+//# sourceMappingURL=migrate-auth.js.map

package/dist/lib/migrate-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-auth.js","sourceRoot":"","sources":["../../src/lib/migrate-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EACH,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAuB,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAE3B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAA;AASlC;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACxE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC7B,GAAG,EAAE,GAAG,OAAO,gBAAgB;QAC/B,OAAO,EAAE;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,mBAAmB;SAC/B;KACJ,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,GAAqB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC/C,OAAO,kBAAkB,CAAC;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACrB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC1B,OAAO;QACP,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE;QAC3C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;KAChC,CAAC,CAAA;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,OAAO,GAAwB,EAAE,MAAM,EAAE,IAAI,EAAE;IAE/C,OAAO,iBAAiB,CAAiB;QACrC,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,sBAAsB;QACrC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,WAAW,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,0DAA0D;YAC1D,6DAA6D;YAC7D,8DAA8D;YAC9D,sDAAsD;YACtD,4CAA4C;YAC5C,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,iBAAiB;gBAAE,OAAO,IAAI,CAAA;YAClE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YAChD,OAAO,KAAK,CAAA;QAChB,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;YAChC,OAAO,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;QAC3C,CAAC;QACD,eAAe,EAAE,sBAAsB;QACvC,mBAAmB,EAAE,KAAK,IAAI,EAAE;YAC5B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,aAAa;KAC3B,CAAC,CAAA;AACN,CAAC"}

package/dist/lib/outline-account.d.ts

@@ -0,0 +1,32 @@
+import type { AccountRef, AuthAccount } from '@todoist/cli-core/auth';
+/**
+ * Narrow account shape persisted by the keyring-backed token store.
+ *
+ * `id` is the Outline user UUID; `label` is the user's display name.
+ * `baseUrl` and `oauthClientId` ride along on the account because Outline
+ * is self-hostable — every persisted token is tied to the instance it was
+ * issued for, not to a global default. `teamName` is rendered by
+ * `ol auth status`; it's the only field we cache for display.
+ */
+export type OutlineAccount = AuthAccount & {
+    id: string;
+    label: string;
+    baseUrl: string;
+    oauthClientId: string;
+    teamName?: string;
+};
+export declare const DEFAULT_BASE_URL = "https://app.getoutline.com";
+/** Canonical `OutlineAccount` factory. Applies the `baseUrl` default. */
+export declare function makeOutlineAccount(input: {
+    id: string;
+    label: string;
+    baseUrl?: string;
+    oauthClientId?: string;
+    teamName?: string;
+}): OutlineAccount;
+/**
+ * Accepts the Outline user UUID or display name. Id matches are
+ * case-sensitive (UUIDs are canonical); label matches are case-insensitive
+ * so users can pass the name they see in `auth status`.
+ */
+export declare function matchOutlineAccount(account: OutlineAccount, ref: AccountRef): boolean;

package/dist/lib/outline-account.js

@@ -0,0 +1,22 @@
+export const DEFAULT_BASE_URL = 'https://app.getoutline.com';
+/** Canonical `OutlineAccount` factory. Applies the `baseUrl` default. */
+export function makeOutlineAccount(input) {
+    return {
+        id: input.id,
+        label: input.label,
+        baseUrl: input.baseUrl ?? DEFAULT_BASE_URL,
+        oauthClientId: input.oauthClientId ?? '',
+        teamName: input.teamName,
+    };
+}
+/**
+ * Accepts the Outline user UUID or display name. Id matches are
+ * case-sensitive (UUIDs are canonical); label matches are case-insensitive
+ * so users can pass the name they see in `auth status`.
+ */
+export function matchOutlineAccount(account, ref) {
+    if (account.id === ref)
+        return true;
+    return account.label.toLowerCase() === ref.toLowerCase();
+}
+//# sourceMappingURL=outline-account.js.map

package/dist/lib/outline-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outline-account.js","sourceRoot":"","sources":["../../src/lib/outline-account.ts"],"names":[],"mappings":"AAmBA,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAE5D,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,KAMlC;IACG,OAAO;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,gBAAgB;QAC1C,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KAC3B,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,GAAe;IACxE,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC"}

package/dist/lib/output.d.ts

@@ -0,0 +1,15 @@
+import { type ViewOptions } from '@todoist/cli-core';
+import type { Pagination } from './api.js';
+import { BaseCliError } from './errors.js';
+type AnyCliError = BaseCliError<string>;
+export type OutputOptions = ViewOptions & {
+    full?: boolean;
+};
+export declare function getOutputOptions(opts: Record<string, unknown>): OutputOptions;
+export declare function outputItem<T extends object>(item: T, humanFormatter: (item: T) => string, essentialKeys?: (keyof T)[], opts?: OutputOptions): void;
+export declare function outputList<T extends object>(items: T[], humanFormatter: (item: T) => string, essentialKeys?: (keyof T)[], opts?: OutputOptions, pagination?: Pagination, emptyMessage?: string): void;
+export declare function formatError(error: AnyCliError): string;
+export declare function formatError(code: string, message: string, hints?: string[]): string;
+export declare function formatErrorJson(error: AnyCliError): string;
+export declare function formatErrorJson(code: string, message: string, hints?: string[]): string;
+export {};