@todoist/outline-cli 0.0.1 → 3.0.0

package/dist/lib/auth-provider.d.ts

@@ -0,0 +1,85 @@
+import { type AccountRef, type AuthProvider, type KeyringTokenStore } from '@todoist/cli-core/auth';
+import { type OutlineAccount } from './outline-account.js';
+export type { OutlineAccount } from './outline-account.js';
+export { matchOutlineAccount } from './outline-account.js';
+export type AuthInfoResponse = {
+    user: {
+        id: string;
+        name: string;
+        email: string;
+    };
+    team: {
+        name: string;
+        subdomain: string;
+    };
+};
+export type OutlineTokenStore = KeyringTokenStore<OutlineAccount>;
+/**
+ * Read a line from stdin, prompting on stderr so `--json` / `--ndjson`
+ * envelopes on stdout stay clean. With `hidden: true` the typed characters are
+ * masked (for secrets): the prompt label is shown, then readline's echo is
+ * routed through a muted `Writable` so keystrokes don't leak to the terminal.
+ */
+export declare function prompt(question: string, options?: {
+    hidden?: boolean;
+}): Promise<string>;
+export declare function resolveBaseUrl(options?: {
+    baseUrl?: unknown;
+}): Promise<string>;
+/**
+ * Verify a token by probing `auth.info` and map the response to the persisted
+ * account shape. Shared by the OAuth `validate` hook and `auth token` so the
+ * identity-resolution rules live in one place.
+ */
+export declare function identifyAccount(token: string, baseUrl: string, oauthClientId?: string): Promise<OutlineAccount>;
+export declare function createOutlineAuthProvider(): AuthProvider<OutlineAccount>;
+/**
+ * True when the v2 store is empty but a legacy v1 token snapshot is still
+ * the only thing keeping the CLI authenticated — typically because
+ * `migrateLegacyAuth` couldn't reach the Outline API to identify the
+ * account (`MigrateSkipReason: 'identify-failed'`) or the OS keyring is
+ * unreachable (`'legacy-keyring-unreachable'`, although outline has no
+ * v1 keyring slot to read from). Useful for downstream diagnostics.
+ */
+export declare function isLegacyAuthActive(): Promise<boolean>;
+/** Where `ol account current` resolves the active credential from. */
+export type ActiveAccountSource = {
+    source: 'stored';
+    account: OutlineAccount;
+    isDefault: boolean;
+} | {
+    source: 'env';
+} | {
+    source: 'legacy';
+} | null;
+/**
+ * Authoritatively classify the active credential without re-deriving the
+ * cascade from membership heuristics. Mirrors `active()`'s precedence — env
+ * (only when no explicit ref) → stored v2 → legacy snapshot — but reports
+ * *which* branch matched, so `ol account current` can render the right shape.
+ *
+ * The v2 lookup uses the bare keyring store (no legacy fallback) and matches by
+ * `ref`, so a renamed legacy snapshot sharing a UUID with a v2 record can't be
+ * misreported as `stored`: a `--user <old-name>` that the v2 record no longer
+ * matches falls through to the legacy branch.
+ */
+export declare function resolveActiveAccountSource(ref?: AccountRef): Promise<ActiveAccountSource>;
+export declare function createOutlineTokenStore(): OutlineTokenStore;
+/**
+ * Where the currently-active token lives. Mirrors `active()`'s resolution
+ * order — env → v2 record → legacy plaintext — so the answer can never
+ * contradict the token the runtime is actually using.
+ *
+ * Pass `ref` to report the source of a specific `--user` account (used by
+ * `auth status --user <ref>`): a ref selects the matching record and skips the
+ * env short-circuit, so the source reflects the account being shown rather
+ * than an ambient env token. Without a ref the default/env cascade applies.
+ *
+ * The precedence cascade is intentionally duplicated with `active()`:
+ * the only true dedupe options either (a) add an extra config read on
+ * every `apiRequest` call (regressing the request hot path) or (b)
+ * augment cli-core's `TokenStore` contract. The drift the duplication
+ * invites is guarded by the `getActiveTokenSource` regression test that
+ * asserts v2-record presence wins over a lingering v1 `api_token`.
+ */
+export declare function getActiveTokenSource(ref?: AccountRef): Promise<'env' | 'secure-store' | 'config-file'>;

package/dist/lib/auth-provider.js

@@ -0,0 +1,363 @@
+import { createInterface } from 'node:readline/promises';
+import { Writable } from 'node:stream';
+import { createKeyringTokenStore, createPkceProvider, } from '@todoist/cli-core/auth';
+import { fetchWithRetry } from '../transport/fetch-with-retry.js';
+import { apiRequest } from './api.js';
+import { LEGACY_CLEAR_PAYLOAD, SECURE_STORE_SERVICE, TOKEN_ENV_VAR } from './auth-constants.js';
+import { getBaseUrl, getOAuthClientId } from './auth.js';
+import { getConfig, getConfigPath, updateConfig } from './config.js';
+import { runMigrateLegacyAuth } from './migrate-auth.js';
+import { makeOutlineAccount, matchOutlineAccount } from './outline-account.js';
+import { createOutlineUserRecordStore, getDefaultUserRecord, recordForRef } from './user-records.js';
+export { matchOutlineAccount } from './outline-account.js';
+function stringFlag(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+/**
+ * Read a line from stdin, prompting on stderr so `--json` / `--ndjson`
+ * envelopes on stdout stay clean. With `hidden: true` the typed characters are
+ * masked (for secrets): the prompt label is shown, then readline's echo is
+ * routed through a muted `Writable` so keystrokes don't leak to the terminal.
+ */
+export async function prompt(question, options = {}) {
+    if (!options.hidden) {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        try {
+            return (await rl.question(question)).trim();
+        }
+        finally {
+            rl.close();
+        }
+    }
+    // Echo the prompt label, then mute so typed characters aren't shown. A muted
+    // `Writable` (public API) avoids poking readline's private `_writeToOutput`.
+    let muted = false;
+    const output = new Writable({
+        write(chunk, _encoding, callback) {
+            if (!muted)
+                process.stderr.write(chunk);
+            callback();
+        },
+    });
+    const rl = createInterface({ input: process.stdin, output, terminal: true });
+    try {
+        const pending = rl.question(question);
+        muted = true;
+        const answer = (await pending).trim();
+        process.stderr.write('\n');
+        return answer;
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function resolveBaseUrl(options = {}) {
+    const fromFlag = stringFlag(options.baseUrl);
+    if (fromFlag)
+        return fromFlag.replace(/\/$/, '');
+    const fromEnv = process.env.OUTLINE_URL?.trim();
+    if (fromEnv)
+        return fromEnv.replace(/\/$/, '');
+    const configured = await getBaseUrl();
+    // Never block a non-interactive shell (CI, piped input) on a prompt —
+    // `auth token` is meant to be scriptable, so fall back to the default.
+    if (!process.stdin.isTTY)
+        return configured.replace(/\/$/, '');
+    const answered = await prompt(`Base URL (default: ${configured}): `);
+    return (answered || configured).replace(/\/$/, '');
+}
+/**
+ * Verify a token by probing `auth.info` and map the response to the persisted
+ * account shape. Shared by the OAuth `validate` hook and `auth token` so the
+ * identity-resolution rules live in one place.
+ */
+export async function identifyAccount(token, baseUrl, oauthClientId) {
+    const { data } = await apiRequest('auth.info', {}, { token, baseUrl });
+    return makeOutlineAccount({
+        id: data.user.id,
+        label: data.user.name,
+        baseUrl,
+        oauthClientId,
+        teamName: data.team.name,
+    });
+}
+async function resolveClientId(flags) {
+    const fromFlag = stringFlag(flags.clientId);
+    if (fromFlag)
+        return fromFlag;
+    const existing = await getOAuthClientId();
+    if (existing)
+        return existing;
+    const answered = await prompt('OAuth Client ID: ');
+    if (!answered) {
+        throw new Error('OAuth client ID is required. Create a public OAuth app in Outline settings, then pass --client-id <id> or set OUTLINE_OAUTH_CLIENT_ID.');
+    }
+    return answered;
+}
+/**
+ * Routes cli-core's OAuth HTTP through outline's transport so the proxy /
+ * decompression dispatcher applies — to the token exchange AND the
+ * oauth4webapi refresh grant (cli-core threads this into oauth4webapi's
+ * `customFetch`), which would otherwise capture the bare global `fetch`.
+ */
+const outlineFetch = (input, init) => fetchWithRetry({ url: input, options: init ?? {} });
+export function createOutlineAuthProvider() {
+    // Captured at `authorize` (which may prompt for it) and reused by
+    // `exchangeCode` / `validate` so a single login can't double-prompt. A
+    // provider built only for silent refresh never runs `authorize`, so this
+    // stays undefined there and `tokenUrl` falls back to stored config — the
+    // refresh path must never prompt.
+    let baseUrl;
+    return createPkceProvider({
+        authorizeUrl: async ({ flags }) => {
+            baseUrl = await resolveBaseUrl(flags);
+            return `${baseUrl}/oauth/authorize`;
+        },
+        tokenUrl: async ({ handshake }) => {
+            // `handshake.baseUrl` lets a caller scope refresh to a specific
+            // account's instance (status --user); otherwise the authorize-time
+            // value, then the default config.
+            const base = baseUrl ?? handshake.baseUrl ?? (await getBaseUrl());
+            return `${base}/oauth/token`;
+        },
+        // Prefer a handshake-scoped client id (account-aware refresh); else
+        // resolve from flag/config (only prompts when neither is set, so it's
+        // safe on the refresh path — the logged-in record carries one).
+        clientId: ({ handshake, flags }) => {
+            const fromHandshake = handshake.clientId;
+            return typeof fromHandshake === 'string' && fromHandshake
+                ? fromHandshake
+                : resolveClientId(flags);
+        },
+        validate: async ({ token, handshake }) => {
+            const base = baseUrl ?? (await getBaseUrl());
+            return identifyAccount(token, base, handshake.clientId);
+        },
+        fetchImpl: outlineFetch,
+    });
+}
+/** True when the v2 store is the authoritative source. */
+function migrationIsConclusive(result) {
+    return (result.status === 'migrated' ||
+        result.status === 'already-migrated' ||
+        result.status === 'no-legacy-state');
+}
+/**
+ * Synthesise a snapshot from v1 plaintext state still on disk. Fallback for
+ * when migration can't complete (offline `identifyAccount`, WSL
+ * `legacy-keyring-unreachable`). Returns `null` when no legacy token is
+ * present. The synthesised account uses whatever identity fields the v1
+ * config has — for pre-#71 configs the id/label may be empty, but the
+ * runtime never renders those (status's `fetchLive` re-derives from the
+ * API), so empty placeholders are safe.
+ */
+async function readLegacyTokenSnapshot() {
+    const config = await getConfig();
+    const token = config.api_token?.trim() || null;
+    if (!token)
+        return null;
+    return {
+        token,
+        account: makeOutlineAccount({
+            id: config.auth_user_id ?? '',
+            label: config.auth_user_name ?? '',
+            baseUrl: config.base_url,
+            oauthClientId: config.oauth_client_id,
+            teamName: config.auth_team_name,
+        }),
+    };
+}
+/**
+ * Discharge v1 plaintext state. Runs **after** a successful v2 write/clear
+ * — never before — so a v2-op failure doesn't strand the user with no
+ * recoverable credentials. Caller decides whether to swallow or propagate
+ * the `updateConfig` failure:
+ *   - `set()` swallows (v2 record will win in `active()` regardless).
+ *   - `clear()` propagates (v2 is empty, so a stale legacy token would
+ *     shadow the logout via the fallback).
+ */
+async function dischargeLegacyState() {
+    await updateConfig(LEGACY_CLEAR_PAYLOAD);
+}
+/**
+ * Memoised one-shot migration trigger. Resolves with `null` on rejection so
+ * the CLI never fails to start because of a migration error — the legacy
+ * snapshot fallback handles that case. Tests reset the memo with
+ * `vi.resetModules()` + a dynamic re-import.
+ */
+let migrationPromise;
+function ensureMigrated() {
+    if (!migrationPromise) {
+        migrationPromise = runMigrateLegacyAuth({ silent: true }).catch(() => null);
+    }
+    return migrationPromise;
+}
+/**
+ * True when the v2 store is empty but a legacy v1 token snapshot is still
+ * the only thing keeping the CLI authenticated — typically because
+ * `migrateLegacyAuth` couldn't reach the Outline API to identify the
+ * account (`MigrateSkipReason: 'identify-failed'`) or the OS keyring is
+ * unreachable (`'legacy-keyring-unreachable'`, although outline has no
+ * v1 keyring slot to read from). Useful for downstream diagnostics.
+ */
+export async function isLegacyAuthActive() {
+    const result = await ensureMigrated();
+    if (result !== null && migrationIsConclusive(result))
+        return false;
+    const legacy = await readLegacyTokenSnapshot();
+    return legacy !== null;
+}
+/**
+ * `OUTLINE_API_TOKEN` short-circuits `active()` only when no explicit ref
+ * is supplied — cli-core's `KeyringTokenStore` doesn't know about the env
+ * var, and an explicit ref means the caller targets a specific stored
+ * account.
+ *
+ * `ensureMigrated()` runs **before** every mutating v2 op so the post-op
+ * legacy discharge can't race a still-pending migration into re-grabbing
+ * the legacy `api_token` we just consumed. `set()` / `clear()` then
+ * discharge legacy state **after** the v2 op succeeds. `set()` swallows
+ * the cleanup failure (v2 wins in `active()` regardless); `clear()`
+ * propagates it so a failed logout fails loudly instead of leaving the
+ * user authenticated via the legacy fallback.
+ */
+/** The bare cli-core keyring store (v2 records only — no env/legacy fallback). */
+function createInnerStore() {
+    return createKeyringTokenStore({
+        serviceName: SECURE_STORE_SERVICE,
+        userRecords: createOutlineUserRecordStore(),
+        recordsLocation: getConfigPath(),
+        matchAccount: matchOutlineAccount,
+    });
+}
+/**
+ * Authoritatively classify the active credential without re-deriving the
+ * cascade from membership heuristics. Mirrors `active()`'s precedence — env
+ * (only when no explicit ref) → stored v2 → legacy snapshot — but reports
+ * *which* branch matched, so `ol account current` can render the right shape.
+ *
+ * The v2 lookup uses the bare keyring store (no legacy fallback) and matches by
+ * `ref`, so a renamed legacy snapshot sharing a UUID with a v2 record can't be
+ * misreported as `stored`: a `--user <old-name>` that the v2 record no longer
+ * matches falls through to the legacy branch.
+ */
+export async function resolveActiveAccountSource(ref) {
+    if (ref === undefined && process.env[TOKEN_ENV_VAR]?.trim())
+        return { source: 'env' };
+    await ensureMigrated();
+    const stored = await createInnerStore().activeAccount(ref);
+    if (stored)
+        return { source: 'stored', account: stored.account, isDefault: stored.isDefault };
+    const legacy = await readLegacyTokenSnapshot();
+    if (legacy && (ref === undefined || matchOutlineAccount(legacy.account, ref))) {
+        return { source: 'legacy' };
+    }
+    return null;
+}
+export function createOutlineTokenStore() {
+    const inner = createInnerStore();
+    async function migrationIsInconclusive() {
+        const result = await ensureMigrated(); // memoised
+        return result === null || !migrationIsConclusive(result);
+    }
+    /**
+     * Shared env → v2 → legacy resolution for `active` / `activeBundle`.
+     * `fromV2` reads the matching cli-core method; `fromEnvOrLegacy` maps an
+     * env/legacy token into the caller's shape (env + legacy carry no refresh
+     * material, so the bundle form surfaces as access-only).
+     */
+    async function resolveAuth(ref, fromV2, fromEnvOrLegacy) {
+        if (ref === undefined) {
+            const envToken = process.env[TOKEN_ENV_VAR]?.trim();
+            if (envToken) {
+                return fromEnvOrLegacy(envToken, makeOutlineAccount({ id: '', label: '', baseUrl: await getBaseUrl() }));
+            }
+        }
+        await ensureMigrated();
+        const fromStore = await fromV2();
+        if (fromStore)
+            return fromStore;
+        const legacy = await readLegacyTokenSnapshot();
+        if (legacy && (ref === undefined || matchOutlineAccount(legacy.account, ref))) {
+            return fromEnvOrLegacy(legacy.token, legacy.account);
+        }
+        return null;
+    }
+    // `ensureMigrated` runs before the v2 write so the post-write discharge
+    // can't race a pending migration into re-grabbing the legacy token. The
+    // discharge is best-effort: a lingering `api_token` is dormant because
+    // reads hit v2 first. (`clear` needs the stricter propagating variant.)
+    async function writeThenDischargeLegacy(write) {
+        await ensureMigrated();
+        await write();
+        if (await migrationIsInconclusive()) {
+            await dischargeLegacyState().catch(() => undefined);
+        }
+    }
+    return {
+        active(ref) {
+            return resolveAuth(ref, () => inner.active(ref), (token, account) => ({ token, account }));
+        },
+        activeAccount(ref) {
+            return resolveAuth(ref, () => inner.activeAccount(ref), (_token, account) => ({ account, isDefault: true }));
+        },
+        activeBundle(ref) {
+            return resolveAuth(ref, () => inner.activeBundle(ref), (token, account) => ({ account, bundle: { accessToken: token } }));
+        },
+        set(account, token) {
+            return writeThenDischargeLegacy(() => inner.set(account, token));
+        },
+        setBundle(account, bundle, options) {
+            return writeThenDischargeLegacy(() => inner.setBundle(account, bundle, options));
+        },
+        async clear(ref) {
+            await ensureMigrated();
+            const cleared = await inner.clear(ref);
+            if (await migrationIsInconclusive()) {
+                // Must succeed: v2 is now empty, so a surviving legacy
+                // token would shadow the logout via the fallback.
+                await dischargeLegacyState();
+            }
+            return cleared;
+        },
+        async list() {
+            await ensureMigrated();
+            return inner.list();
+        },
+        async setDefault(ref) {
+            await ensureMigrated();
+            return inner.setDefault(ref);
+        },
+        getLastStorageResult: () => inner.getLastStorageResult(),
+        getLastClearResult: () => inner.getLastClearResult(),
+    };
+}
+/**
+ * Where the currently-active token lives. Mirrors `active()`'s resolution
+ * order — env → v2 record → legacy plaintext — so the answer can never
+ * contradict the token the runtime is actually using.
+ *
+ * Pass `ref` to report the source of a specific `--user` account (used by
+ * `auth status --user <ref>`): a ref selects the matching record and skips the
+ * env short-circuit, so the source reflects the account being shown rather
+ * than an ambient env token. Without a ref the default/env cascade applies.
+ *
+ * The precedence cascade is intentionally duplicated with `active()`:
+ * the only true dedupe options either (a) add an extra config read on
+ * every `apiRequest` call (regressing the request hot path) or (b)
+ * augment cli-core's `TokenStore` contract. The drift the duplication
+ * invites is guarded by the `getActiveTokenSource` regression test that
+ * asserts v2-record presence wins over a lingering v1 `api_token`.
+ */
+export async function getActiveTokenSource(ref) {
+    if (ref === undefined && process.env[TOKEN_ENV_VAR]?.trim())
+        return 'env';
+    const config = await getConfig();
+    const record = ref !== undefined ? recordForRef(config, ref) : getDefaultUserRecord(config);
+    if (record)
+        return record.fallbackToken ? 'config-file' : 'secure-store';
+    if (ref === undefined && config.api_token?.trim())
+        return 'config-file';
+    return 'secure-store';
+}
+//# sourceMappingURL=auth-provider.js.map

package/dist/lib/auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAGH,uBAAuB,EACvB,kBAAkB,GAIrB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAuB,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAS1D,SAAS,UAAU,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CACxB,QAAgB,EAChB,OAAO,GAAyB,EAAE;IAElC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5E,IAAI,CAAC;YACD,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/C,CAAC;gBAAS,CAAC;YACP,EAAE,CAAC,KAAK,EAAE,CAAA;QACd,CAAC;IACL,CAAC;IACD,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;QACxB,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ;YAC5B,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACvC,QAAQ,EAAE,CAAA;QACd,CAAC;KACJ,CAAC,CAAA;IACF,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACrC,KAAK,GAAG,IAAI,CAAA;QACZ,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,OAAO,MAAM,CAAA;IACjB,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAO,GAA0B,EAAE;IACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAA;IACrC,sEAAsE;IACtE,uEAAuE;IACvE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAA;IACpE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,KAAa,EACb,OAAe,EACf,aAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAmB,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACxF,OAAO,kBAAkB,CAAC;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;QACrB,OAAO;QACP,aAAa;QACb,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;KAC3B,CAAC,CAAA;AACN,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,wIAAwI,CAC3I,CAAA;IACL,CAAC;IACD,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC/C,cAAc,CAAC,EAAE,GAAG,EAAE,KAA0B,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;AAE5E,MAAM,UAAU,yBAAyB;IACrC,kEAAkE;IAClE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,IAAI,OAA2B,CAAA;IAC/B,OAAO,kBAAkB,CAAiB;QACtC,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC9B,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YACrC,OAAO,GAAG,OAAO,kBAAkB,CAAA;QACvC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAC9B,gEAAgE;YAChE,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,IAAI,GACN,OAAO,IAAK,SAAS,CAAC,OAA8B,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAChF,OAAO,GAAG,IAAI,cAAc,CAAA;QAChC,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAA;YACxC,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa;gBACrD,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAC5C,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,QAAkB,CAAC,CAAA;QACrE,CAAC;QACD,SAAS,EAAE,YAAY;KAC1B,CAAC,CAAA;AACN,CAAC;AAED,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,MAAyC;IACpE,OAAO,CACH,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,MAAM,CAAC,MAAM,KAAK,kBAAkB;QACpC,MAAM,CAAC,MAAM,KAAK,iBAAiB,CACtC,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB;IAIlC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO;QACH,KAAK;QACL,OAAO,EAAE,kBAAkB,CAAC;YACxB,EAAE,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM,CAAC,eAAe;YACrC,QAAQ,EAAE,MAAM,CAAC,cAAc;SAClC,CAAC;KACL,CAAA;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB;IAC/B,MAAM,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,IAAI,gBAA+E,CAAA;AACnF,SAAS,cAAc;IACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,gBAAgB,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACpC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,kFAAkF;AAClF,SAAS,gBAAgB;IACrB,OAAO,uBAAuB,CAAiB;QAC3C,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,4BAA4B,EAAE;QAC3C,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,mBAAmB;KACpC,CAAC,CAAA;AACN,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAgB;IAC7D,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IACrF,MAAM,cAAc,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC1D,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IAC7F,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB;IACnC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;IAChC,KAAK,UAAU,uBAAuB;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAA,CAAC,WAAW;QACjD,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,CAAC;IACD;;;;;OAKG;IACH,KAAK,UAAU,WAAW,CACtB,GAA2B,EAC3B,MAA+B,EAC/B,eAA8D;QAE9D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,eAAe,CAClB,QAAQ,EACR,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE,EAAE,CAAC,CACzE,CAAA;YACL,CAAC;QACL,CAAC;QACD,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,MAAM,MAAM,EAAE,CAAA;QAChC,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/B,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAA;QAC9C,IAAI,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5E,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,IAAI,CAAA;IACf,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,KAAK,UAAU,wBAAwB,CAAC,KAA0B;QAC9D,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,KAAK,EAAE,CAAA;QACb,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;YAClC,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACvD,CAAC;IACL,CAAC;IAED,OAAO;QACH,MAAM,CAAC,GAAgB;YACnB,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EACvB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAC3C,CAAA;QACL,CAAC;QACD,aAAa,CAAC,GAAgB;YAC1B,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAC9B,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CACtD,CAAA;QACL,CAAC;QACD,YAAY,CAAC,GAAgB;YACzB,OAAO,WAAW,CACd,GAAG,EACH,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAC7B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CACpE,CAAA;QACL,CAAC;QACD,GAAG,CAAC,OAAuB,EAAE,KAAa;YACtC,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QACpE,CAAC;QACD,SAAS,CAAC,OAAuB,EAAE,MAAmB,EAAE,OAAO;YAC3D,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACpF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,MAAM,cAAc,EAAE,CAAA;YACtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtC,IAAI,MAAM,uBAAuB,EAAE,EAAE,CAAC;gBAClC,uDAAuD;gBACvD,kDAAkD;gBAClD,MAAM,oBAAoB,EAAE,CAAA;YAChC,CAAC;YACD,OAAO,OAAO,CAAA;QAClB,CAAC;QACD,KAAK,CAAC,IAAI;YACN,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,MAAM,cAAc,EAAE,CAAA;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE;QACxD,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE;KACvD,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,GAAgB;IAEhB,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3F,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAA;IACxE,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,aAAa,CAAA;IACvE,OAAO,cAAc,CAAA;AACzB,CAAC"}

package/dist/lib/auth.d.ts

@@ -0,0 +1,73 @@
+import { SecureStoreUnavailableError, type TokenRefreshOptions } from '@todoist/cli-core/auth';
+import { TOKEN_ENV_VAR } from './auth-constants.js';
+import { getActiveTokenSource } from './auth-provider.js';
+import { CliError } from './errors.js';
+import { type OutlineAccount } from './outline-account.js';
+/** Base URL + optional refresh handshake for a single request. */
+type RequestContext = {
+    baseUrl: string;
+    handshake?: {
+        baseUrl: string;
+        clientId: string;
+    };
+};
+export { SecureStoreUnavailableError, getActiveTokenSource, TOKEN_ENV_VAR };
+export declare class NoTokenError extends CliError {
+    constructor();
+}
+/**
+ * Best-effort proactive rotation before a request. Returns the token to use
+ * (the rotated one, or the current one if no rotation was needed) so the
+ * caller doesn't re-read the store; `undefined` when the account isn't
+ * refreshable (no refresh token / env / failure) — the caller then falls back
+ * to `getApiToken()` and the 401 path stays authoritative. The wrapped store
+ * scopes the bundle to any global `--user`; `handshake` pins the token
+ * endpoint to that account's instance + client id.
+ */
+export declare function proactiveRefresh(handshake?: RequestContext['handshake']): Promise<string | undefined>;
+/**
+ * Refresh wiring for cli-core's `auth status` / `auth token view` attachers,
+ * so both hand back a token that is usable right now rather than whatever
+ * was last stored. The attachers pass their own (`--user`-aware) store, so
+ * the handshake is resolved from the account cli-core actually selected —
+ * pinning the refresh to that account's instance and client id. Env, legacy
+ * and record-less accounts carry no refresh token and are served as-is.
+ */
+export declare function getTokenRefreshOptions(): TokenRefreshOptions<OutlineAccount>;
+/**
+ * Reactive rotation after a 401. Returns `true` when the token rotated (the
+ * caller retries once). A rejected/absent refresh token surfaces as
+ * `NoTokenError` (re-login); a transient failure propagates unchanged.
+ */
+export declare function reactiveRefresh(handshake?: RequestContext['handshake']): Promise<boolean>;
+/**
+ * Read the active token. Hot path: when `OUTLINE_API_TOKEN` is set we
+ * return it directly without consulting the token store, since
+ * `apiRequest` already resolves the base URL separately — going through
+ * `store.active()` here would trigger a redundant `getBaseUrl()` lookup
+ * per request just to synthesise an account we don't need.
+ */
+export declare function getApiToken(): Promise<string>;
+/**
+ * Account-agnostic base URL cascade: env var → default user record (v2) →
+ * legacy `base_url` config (v1) → built-in default. Deliberately ignores the
+ * global `--user` selector so the login flow (which resolves its default
+ * prompt through here) isn't skewed by account selection; the request path
+ * applies `--user` separately via {@link getRequestContext}.
+ */
+export declare function getBaseUrl(): Promise<string>;
+/**
+ * Account-agnostic OAuth client id cascade: env var → default user record
+ * (v2) → legacy `oauth_client_id` config (v1) → undefined (caller prompts).
+ * Like {@link getBaseUrl}, ignores `--user` so login stays default-driven.
+ */
+export declare function getOAuthClientId(): Promise<string | undefined>;
+/**
+ * Resolve the base URL — and, when a `--user` account is selected, the refresh
+ * handshake (its instance + client id) — for a single managed request. Falls
+ * back to the account-agnostic {@link getBaseUrl} cascade without `--user`.
+ * An unknown ref resolves no handshake and the default base URL; the wrapped
+ * token store then raises `ACCOUNT_NOT_FOUND` when the token is read, so the
+ * request never fires.
+ */
+export declare function getRequestContext(): Promise<RequestContext>;