@vigilbase/cli 0.1.4 → 0.2.1

package/dist/auth/device-auth.js

@@ -27,26 +27,31 @@ function isRetryableTokenStatus(status) {
         status >= 500);
 }
 async function postJson(config, path, body) {
-    const url = `${authBase(config)}${path}`;
+    const provider = config.authProvider;
+    const url = provider ? (path === '/device/code' ? provider.deviceEndpoint : provider.tokenEndpoint) : `${authBase(config)}${path}`;
+    const form = provider && path === '/device/token';
     const { response, text } = await requestText(config, url, {
         method: 'POST',
         headers: {
             Accept: 'application/json',
-            'Content-Type': 'application/json',
+            'Content-Type': form ? 'application/x-www-form-urlencoded' : 'application/json',
             'User-Agent': config.userAgent,
         },
-        body: JSON.stringify(body),
+        body: form ? new URLSearchParams(Object.entries(body).map(([key, value]) => [key, String(value)])) : JSON.stringify(body),
     });
-    return { status: response.status, json: parseJsonResponse(response, text) };
+    return { status: response.status, json: parseJsonResponse(response, text), origin: new URL(url).origin };
 }
 export async function requestDeviceCode(config, options) {
-    const { status, json } = await postJson(config, '/device/code', {
+    const { status, json, origin } = await postJson(config, '/device/code', {
         client_id: config.clientId,
+        ...(config.authProvider ? { resource: config.authProvider.resource, scope: 'openid profile email offline_access one:api' } : {}),
         ...(options?.scope ? { scope: options.scope } : {}),
     });
+    // origin is the Identity issuer, or One for legacy sign-in.
     if (status === 404) {
-        throw new DeviceAuthError(`Device authorization is not enabled on ${config.oneBaseUrl} yet. ` +
-            'Enable Better Auth\'s deviceAuthorization plugin on Vigilbase One, then retry `vigilbase login`.', { status, code: 'not_enabled' });
+        throw new DeviceAuthError(`Device sign-in isn't available at ${origin} right now. ` +
+            'If you set --one-url or --auth-url, check that it\'s correct; otherwise try again later or email help@vigilbase.com. ' +
+            'Public tools work without signing in.', { status, code: 'not_enabled' });
     }
     if (status < 200 || status >= 300) {
         throw new DeviceAuthError(`Device code request failed (HTTP ${status})`, { status });
@@ -75,6 +80,7 @@ export async function pollDeviceToken(config, deviceCode) {
             grant_type: DEVICE_GRANT,
             device_code: deviceCode,
             client_id: config.clientId,
+            ...(config.authProvider ? { resource: config.authProvider.resource } : {}),
         }));
     }
     catch (error) {
@@ -222,4 +228,3 @@ export async function waitForDeviceAuthorization(config, device, options) {
     }
     throw new DeviceAuthError('Timed out waiting for browser authorization. Run `vigilbase login` again.', { status: 0, code: 'timeout' });
 }
-//# sourceMappingURL=device-auth.js.map

package/dist/auth/index.d.ts

@@ -1,4 +1,6 @@
-export { clearOneCredentials, credentialsPath, getOneAccessToken, readCredentials, writeOneCredentials, } from './store.js';
+export { clearOneCredentials, credentialsPath, getOneAccessToken, getOptionalOneAccessToken, hasUsableSignIn, identityCredentialsPath, readCredentials, writeOneCredentials, } from './store.js';
 export { DeviceAuthError, pollDeviceToken, requestDeviceCode, waitForDeviceAuthorization, } from './device-auth.js';
 export type { CredentialsFile, DeviceCodeResponse, DeviceTokenSuccess, OneCredentials, StoredUser, } from './types.js';
-//# sourceMappingURL=index.d.ts.map
+export { discoverAuthProvider, identityProvider } from './provider.js';
+export { managedAccessToken, revokeSavedCredentials } from './refresh.js';
+export type { AuthProvider } from './provider.js';

package/dist/auth/index.js

@@ -1,3 +1,4 @@
-export { clearOneCredentials, credentialsPath, getOneAccessToken, readCredentials, writeOneCredentials, } from './store.js';
+export { clearOneCredentials, credentialsPath, getOneAccessToken, getOptionalOneAccessToken, hasUsableSignIn, identityCredentialsPath, readCredentials, writeOneCredentials, } from './store.js';
 export { DeviceAuthError, pollDeviceToken, requestDeviceCode, waitForDeviceAuthorization, } from './device-auth.js';
-//# sourceMappingURL=index.js.map
+export { discoverAuthProvider, identityProvider } from './provider.js';
+export { managedAccessToken, revokeSavedCredentials } from './refresh.js';

package/dist/auth/provider.d.ts

@@ -0,0 +1,18 @@
+import { type CliConfig } from '../lib/config.js';
+export interface AuthProvider {
+    issuer: string;
+    tokenEndpoint: string;
+    deviceEndpoint: string;
+    userinfoEndpoint: string;
+    revocationEndpoint: string;
+    resource: string;
+}
+/** An issuer (discovered from One, or saved with credentials) is trusted only when its origin is exactly trustedIdentityIssuer(config). */
+export declare function validateIdentityIssuer(raw: string, config: Pick<CliConfig, 'oneBaseUrl' | 'identityBaseUrl'>): string;
+export declare function identityProvider(config: CliConfig, issuer: string): Promise<AuthProvider>;
+/**
+ * Older One deployments answer the protected-resource path with a sign-in
+ * redirect or an HTML page; those mean "no Identity metadata" (legacy login).
+ * JSON that is present but malformed or names another resource still aborts.
+ */
+export declare function discoverAuthProvider(config: CliConfig): Promise<AuthProvider | undefined>;

package/dist/auth/provider.js

@@ -0,0 +1,71 @@
+import { DeviceAuthError } from './device-auth.js';
+import { z } from 'zod';
+import { DEFAULT_IDENTITY_ISSUER, parseOrigin, STAGING_IDENTITY_ISSUER, trustedIdentityIssuer, validateOneOrigin } from '../lib/config.js';
+import { requestText, parseJsonResponse } from '../lib/network.js';
+/** An issuer (discovered from One, or saved with credentials) is trusted only when its origin is exactly trustedIdentityIssuer(config). */
+export function validateIdentityIssuer(raw, config) {
+    const trusted = trustedIdentityIssuer(config);
+    let origin;
+    // Do not echo a malformed issuer: it can contain credentials.
+    try {
+        origin = parseOrigin(raw, 'The Identity issuer');
+    }
+    catch {
+        throw new Error('Untrusted Identity issuer: not an HTTP(S) origin.');
+    }
+    if (origin === trusted)
+        return origin;
+    throw new Error(config.identityBaseUrl
+        ? `Untrusted Identity issuer ${origin}: --auth-url / VIGILBASE_AUTH_URL is ${trusted}. Set it to the issuer for this One, or unset it to use ${DEFAULT_IDENTITY_ISSUER}.`
+        : `Untrusted Identity issuer ${origin}: only ${DEFAULT_IDENTITY_ISSUER} is trusted by default. For staging, pass --auth-url ${STAGING_IDENTITY_ISSUER} or set VIGILBASE_AUTH_URL.`);
+}
+async function json(config, url) { const { response, text } = await requestText(config, url, { headers: { Accept: 'application/json', 'User-Agent': config.userAgent } }); return { response, body: parseJsonResponse(response, text) }; }
+export async function identityProvider(config, issuer) {
+    issuer = validateIdentityIssuer(issuer, config);
+    const { response, body } = await json(config, `${issuer}/.well-known/openid-configuration`);
+    const data = z.object({ issuer: z.literal(issuer), token_endpoint: z.string(), device_authorization_endpoint: z.string(), userinfo_endpoint: z.string(), revocation_endpoint: z.string() }).safeParse(body);
+    if (!response.ok || !data.success)
+        throw new Error('Invalid Identity discovery response.');
+    const endpoint = (raw, paths) => { let url; try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error('Invalid Identity endpoint.');
+    } ; if (url.origin !== issuer || url.username || url.password || url.search || url.hash || !paths.includes(url.pathname))
+        throw new Error('Untrusted Identity endpoint.'); return url.href; };
+    return { issuer, resource: validateOneOrigin(config.oneBaseUrl), tokenEndpoint: endpoint(data.data.token_endpoint, ['/api/auth/oauth2/token', '/token']), deviceEndpoint: endpoint(data.data.device_authorization_endpoint, ['/api/auth/device/code']), userinfoEndpoint: endpoint(data.data.userinfo_endpoint, ['/api/auth/oauth2/userinfo', '/userinfo']), revocationEndpoint: endpoint(data.data.revocation_endpoint, ['/api/auth/oauth2/revoke', '/revoke']) };
+}
+/**
+ * Older One deployments answer the protected-resource path with a sign-in
+ * redirect or an HTML page; those mean "no Identity metadata" (legacy login).
+ * JSON that is present but malformed or names another resource still aborts.
+ */
+export async function discoverAuthProvider(config) {
+    const one = validateOneOrigin(config.oneBaseUrl);
+    const { response, text } = await requestText(config, `${one}/.well-known/oauth-protected-resource`, { headers: { Accept: 'application/json', 'User-Agent': config.userAgent }, redirect: 'manual' });
+    if (response.type === 'opaqueredirect' || response.status === 0 || (response.status >= 300 && response.status < 400))
+        return undefined;
+    if (response.status === 404)
+        return undefined;
+    if (response.status === 429)
+        throw new DeviceAuthError('Discovery rate limit exceeded.', { status: 429, code: 'rate_limited' });
+    let body;
+    if (response.ok) {
+        const contentType = (response.headers.get('content-type') ?? '').split(';')[0].trim().toLowerCase();
+        if (contentType && contentType !== 'application/json' && !contentType.endsWith('+json'))
+            return undefined;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const metadata = z.object({ resource: z.literal(one), authorization_servers: z.array(z.string()).length(1) }).safeParse(body);
+    if (!response.ok || !metadata.success)
+        throw new Error('Invalid One protected-resource discovery response.');
+    const issuer = metadata.data.authorization_servers[0];
+    if (issuer === `${one}/api/auth`)
+        return undefined;
+    return identityProvider(config, issuer);
+}

package/dist/auth/refresh.d.ts

@@ -0,0 +1,29 @@
+import type { CliConfig } from '../lib/config.js';
+import type { OneCredentials } from './types.js';
+export declare function boundIdentityCredentials(config: CliConfig, one: OneCredentials): boolean;
+/** Library callers may omit or mistype timeoutMs; NaN would make the wait unbounded. */
+export declare function credentialsLockWaitMs(timeoutMs: unknown): number;
+/** Another command holds credentials.json.lock. */
+export declare class CredentialsLockedError extends Error {
+    constructor();
+}
+/**
+ * credentials.json.lock guards both credentials files; CLI 0.2.0 takes the same lock.
+ * Never steal a stale lock: a crashed refresh may have consumed the rotating token.
+ * With `wait` false, a held lock fails at once instead of after the lock wait.
+ */
+export declare function withCredentialsLock<T>(config: Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'timeoutMs'>>, callback: () => Promise<T>, replaceDeadLock?: boolean, wait?: boolean): Promise<T>;
+export declare function managedAccessToken(config: CliConfig, failedToken?: string): Promise<string | null>;
+/**
+ * Revoke one saved refresh grant. Identity answers 400 (`invalid_request` or `invalid_grant`) for a token it no
+ * longer knows or has already revoked, for example after a browser sign-out ended the session that approved it,
+ * or a refresh rotated it; nothing is left to revoke then. Other failures throw.
+ */
+export declare function revokeIdentityGrant(config: CliConfig, one: OneCredentials): Promise<void>;
+/**
+ * Revoke every saved Identity grant, then remove its file. A failed revocation keeps every file. A safe file that
+ * can't be parsed has no grant to revoke; the login that calls this replaces it. Callers hold the lock.
+ */
+export declare function revokeIdentityCredentials(config: CliConfig): Promise<boolean>;
+/** Revoke and remove every credentials file. A failed Identity revocation keeps them all. */
+export declare function revokeSavedCredentials(config: CliConfig, onWarning?: (message: string) => void): Promise<boolean>;

package/dist/auth/refresh.js

@@ -0,0 +1,199 @@
+import { readIdentityTokenMetadata } from './token-metadata.js';
+import { constants } from 'node:fs';
+import { open, rm, lstat } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { z } from 'zod';
+import { DEFAULT_TIMEOUT_MS, validateOneOrigin } from '../lib/config.js';
+import { requestText, parseJsonResponse } from '../lib/network.js';
+import { assertFile, checkDirectory, credentialsPath, readCredentials, readLockedCredentials, readStoredCredentials, writeOneCredentials, clearOneCredentials, clearIdentityCredentials, DEFAULT_ONE_ORIGIN, UNCERTAIN_REFRESH } from './store.js';
+import { identityProvider, validateIdentityIssuer } from './provider.js';
+export function boundIdentityCredentials(config, one) {
+    try {
+        return one.clientId === config.clientId && one.resource === validateOneOrigin(config.oneBaseUrl) && one.oneBaseUrl === one.resource && validateIdentityIssuer(one.issuer, config) === one.issuer;
+    }
+    catch {
+        return false;
+    }
+}
+const MAX_LOCK_WAIT_MS = 15_000;
+/** Library callers may omit or mistype timeoutMs; NaN would make the wait unbounded. */
+export function credentialsLockWaitMs(timeoutMs) {
+    const requested = typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : DEFAULT_TIMEOUT_MS;
+    return Math.min(requested, MAX_LOCK_WAIT_MS);
+}
+/** Another command holds credentials.json.lock. */
+export class CredentialsLockedError extends Error {
+    constructor() { super('Credentials are locked by another command. A crashed refresh requires a new login; do not reuse its refresh token.'); this.name = 'CredentialsLockedError'; }
+}
+/**
+ * credentials.json.lock guards both credentials files; CLI 0.2.0 takes the same lock.
+ * Never steal a stale lock: a crashed refresh may have consumed the rotating token.
+ * With `wait` false, a held lock fails at once instead of after the lock wait.
+ */
+export async function withCredentialsLock(config, callback, replaceDeadLock = false, wait = true) {
+    const path = `${credentialsPath(config)}.lock`;
+    await checkDirectory(dirname(path), true);
+    const deadline = Date.now() + credentialsLockWaitMs(config.timeoutMs);
+    let handle;
+    for (;;) {
+        try {
+            handle = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            break;
+        }
+        catch (error) {
+            if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST'))
+                throw error;
+            const existing = await lstat(path);
+            assertFile(existing, path);
+            if (replaceDeadLock) {
+                const existingHandle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                let owner = '';
+                try {
+                    assertFile(await existingHandle.stat(), path);
+                    owner = await existingHandle.readFile('utf8');
+                }
+                finally {
+                    await existingHandle.close();
+                }
+                const pid = Number(owner);
+                let dead = false;
+                if (Number.isSafeInteger(pid) && pid > 0) {
+                    try {
+                        process.kill(pid, 0);
+                    }
+                    catch (error) {
+                        dead = error instanceof Error && 'code' in error && error.code === 'ESRCH';
+                    }
+                }
+                if (dead) {
+                    const current = await lstat(path);
+                    if (current.ino === existing.ino && current.dev === existing.dev) {
+                        await rm(path);
+                        continue;
+                    }
+                }
+            }
+            if (!wait || Date.now() >= deadline)
+                throw new CredentialsLockedError();
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+    }
+    await handle.chmod(0o600);
+    const info = await handle.stat();
+    assertFile(info, path);
+    try {
+        await handle.writeFile(String(process.pid));
+        await handle.sync();
+        return await callback();
+    }
+    finally {
+        await handle.close();
+        const current = await lstat(path).catch(() => null);
+        if (current?.ino === info.ino && current.dev === info.dev)
+            await rm(path);
+    }
+}
+export async function managedAccessToken(config, failedToken) {
+    const initial = await readCredentials(config);
+    if (initial.version !== 2 || !initial.one || !boundIdentityCredentials(config, initial.one))
+        return null;
+    if (!failedToken && Date.parse(initial.one.expiresAt ?? '') - Date.now() > 60_000) {
+        readIdentityTokenMetadata(initial.one.accessToken, { issuer: initial.one.issuer, clientId: initial.one.clientId, resource: initial.one.resource });
+        return initial.one.accessToken;
+    }
+    return withCredentialsLock(config, async () => {
+        const current = await readLockedCredentials(config), one = current.one;
+        if (current.version !== 2 || !one || !boundIdentityCredentials(config, one))
+            return null;
+        if (failedToken && one.accessToken !== failedToken) {
+            readIdentityTokenMetadata(one.accessToken, { issuer: one.issuer, clientId: one.clientId, resource: one.resource });
+            return one.accessToken;
+        }
+        if (!failedToken && Date.parse(one.expiresAt ?? '') - Date.now() > 60_000) {
+            readIdentityTokenMetadata(one.accessToken, { issuer: one.issuer, clientId: one.clientId, resource: one.resource });
+            return one.accessToken;
+        }
+        if (one.refreshPending)
+            throw new Error(UNCERTAIN_REFRESH);
+        const provider = await identityProvider(config, one.issuer);
+        await writeOneCredentials(config, { ...one, refreshPending: true });
+        const { response, text } = await requestText(config, provider.tokenEndpoint, { method: 'POST', headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: one.refreshToken, client_id: one.clientId, resource: one.resource }) });
+        const body = parseJsonResponse(response, text);
+        if (!response.ok) {
+            if (z.object({ error: z.literal('invalid_grant') }).safeParse(body).success)
+                await clearIdentityCredentials(config);
+            throw new Error('Identity refresh failed. Run `vigilbase login` again.');
+        }
+        const token = z.object({ access_token: z.string().min(1), refresh_token: z.string().min(1), expires_in: z.number().int().positive().max(300), scope: z.string().optional() }).safeParse(body);
+        if (!token.success)
+            throw new Error('Invalid Identity refresh response.');
+        const metadata = readIdentityTokenMetadata(token.data.access_token, { issuer: one.issuer, clientId: one.clientId, resource: one.resource });
+        if (one.orgId && metadata.organizationId !== one.orgId)
+            throw new Error('Identity refresh changed its bound organization. Run `vigilbase login` again.');
+        await writeOneCredentials(config, { ...one, orgId: metadata.organizationId, refreshPending: false, accessToken: token.data.access_token, refreshToken: token.data.refresh_token, expiresAt: new Date(Date.now() + token.data.expires_in * 1000).toISOString(), scope: token.data.scope ?? one.scope });
+        return token.data.access_token;
+    });
+}
+const SAVED_FOR_OTHER_CONFIGURATION = 'Saved credentials belong to a different issuer, resource, or client. Use the matching configuration to log out.';
+/**
+ * Revoke one saved refresh grant. Identity answers 400 (`invalid_request` or `invalid_grant`) for a token it no
+ * longer knows or has already revoked, for example after a browser sign-out ended the session that approved it,
+ * or a refresh rotated it; nothing is left to revoke then. Other failures throw.
+ */
+export async function revokeIdentityGrant(config, one) {
+    if (!boundIdentityCredentials(config, one))
+        throw new Error(SAVED_FOR_OTHER_CONFIGURATION);
+    const provider = await identityProvider(config, one.issuer);
+    const { response, text } = await requestText(config, provider.revocationEndpoint, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ token: one.refreshToken, token_type_hint: 'refresh_token', client_id: one.clientId }) });
+    if (response.ok)
+        return;
+    if (response.status === 400 && z.object({ error: z.enum(['invalid_request', 'invalid_grant']) }).safeParse(parseJsonResponse(response, text)).success)
+        return;
+    throw new Error('Identity revocation failed, so your saved sign-in was kept. Try again later.');
+}
+async function revokeIdentityGrants(config, { identity, shared }) {
+    const grants = [identity, shared].flatMap((saved) => saved?.version === 2 && saved.one ? [saved.one] : []);
+    // Check every grant first, so a mismatch can't leave one revoked while its file stays.
+    if (grants.some((one) => !boundIdentityCredentials(config, one)))
+        throw new Error(SAVED_FOR_OTHER_CONFIGURATION);
+    for (const one of grants)
+        await revokeIdentityGrant(config, one);
+}
+/**
+ * Revoke every saved Identity grant, then remove its file. A failed revocation keeps every file. A safe file that
+ * can't be parsed has no grant to revoke; the login that calls this replaces it. Callers hold the lock.
+ */
+export async function revokeIdentityCredentials(config) {
+    const stored = await readStoredCredentials(config, () => { });
+    await revokeIdentityGrants(config, stored);
+    // credentials.json goes too only when it held a CLI 0.2.0 grant.
+    return stored.shared?.version === 2 ? clearOneCredentials(config) : clearIdentityCredentials(config);
+}
+/** Best effort: legacy One auth retires on 2026-10-31, and its session expires on its own. */
+async function signOutLegacySession(config, one) {
+    const origin = validateOneOrigin(one.oneBaseUrl ?? DEFAULT_ONE_ORIGIN);
+    const { response } = await requestText(config, `${origin}/api/auth/sign-out`, { method: 'POST', headers: { Accept: 'application/json', Authorization: `Bearer ${one.accessToken}`, 'User-Agent': config.userAgent }, redirect: 'manual', credentials: 'omit' });
+    if (!response.ok)
+        throw new Error('Legacy One sign-out failed.');
+}
+/** Revoke and remove every credentials file. A failed Identity revocation keeps them all. */
+export async function revokeSavedCredentials(config, onWarning) {
+    return withCredentialsLock(config, async () => {
+        // A safe file that cannot be parsed cannot be revoked either; removing it keeps logout from dead-ending.
+        const unreadable = [];
+        const stored = await readStoredCredentials(config, (path) => unreadable.push(path));
+        await revokeIdentityGrants(config, stored);
+        if (stored.shared?.version === 1 && stored.shared.one) {
+            try {
+                await signOutLegacySession(config, stored.shared.one);
+            }
+            catch {
+                onWarning?.('Could not sign out the legacy One session. Local credentials are removed anyway.');
+            }
+        }
+        const cleared = await clearOneCredentials(config);
+        if (unreadable.length)
+            onWarning?.(`Couldn't read the saved sign-in in ${unreadable.join(' and ')}, so it was removed without revoking it. It will expire on its own.`);
+        return cleared;
+    }, true);
+}

package/dist/auth/store.d.ts

@@ -1,10 +1,109 @@
-import type { CliConfig } from '../lib/config.js';
+import { type Stats } from 'node:fs';
+import { z } from 'zod';
+import { type CliConfig } from '../lib/config.js';
 import type { CredentialsFile, OneCredentials } from './types.js';
-type CredentialsConfig = Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'oneBaseUrl'>>;
+export declare const DEFAULT_ONE_ORIGIN = "https://one.vigilbase.com";
+export declare const UNCERTAIN_REFRESH = "A previous refresh has an uncertain result. Run `vigilbase login` again; its token cannot be retried safely.";
+type CredentialsConfig = Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'oneBaseUrl' | 'clientId' | 'identityBaseUrl' | 'timeoutMs' | 'userAgent'>>;
+export declare const OneCredentialsSchema: z.ZodObject<{
+    issuer: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    refreshTokenExpiresAt: z.ZodOptional<z.ZodString>;
+    refreshPending: z.ZodOptional<z.ZodBoolean>;
+    orgId: z.ZodOptional<z.ZodString>;
+    oneBaseUrl: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodString;
+    tokenType: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    obtainedAt: z.ZodString;
+    user: z.ZodOptional<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** Version 1 One session credentials, shared with CLI 0.1.x. */
 export declare function credentialsPath(config: Pick<CliConfig, 'configDir'>): string;
-export declare function readCredentials(config: Pick<CliConfig, 'configDir'>): Promise<CredentialsFile>;
+/** Version 2 Identity credentials with the rotating refresh grant. */
+export declare function identityCredentialsPath(config: Pick<CliConfig, 'configDir'>): string;
+/** A credentials file that passed the safety checks but cannot be parsed or is incomplete. */
+export declare class InvalidCredentialsError extends Error {
+    constructor(message: string);
+}
+/** Credentials cannot be protected by modes and owners on Windows yet. */
+export declare class SignInUnsupportedError extends Error {
+    readonly code = "SIGN_IN_UNSUPPORTED";
+    constructor();
+}
+/**
+ * A credentials directory or file the CLI refuses to use. `reason` names the path that failed and `remedy`
+ * says how to fix it; `vigilbase login` can't, because it runs the same checks.
+ */
+export declare class CredentialsPathError extends Error {
+    readonly reason: string;
+    readonly remedy: string;
+    constructor(reason: string, remedy: string, options?: ErrorOptions);
+}
+export declare function assertFile(info: Stats, path: string): void;
+/**
+ * Check every ancestor before traversing it; a writable non-sticky parent permits replacement.
+ * Every credentials read or write starts here, so on Windows they fail before touching the filesystem.
+ */
+export declare function checkDirectory(configDir: string, isCreate?: boolean): Promise<boolean>;
+/** Both files as saved. credentials.json is version 1, or version 2 when CLI 0.2.0 wrote it. */
+export type StoredCredentials = {
+    identity: CredentialsFile | null;
+    shared: CredentialsFile | null;
+};
+/**
+ * With `onInvalid`, a safe file that cannot be parsed reads as absent and is reported; unsafe files always throw.
+ * Without it, an unparseable credentials.json reads as absent when identity-credentials.json holds a sign-in, which wins anyway.
+ */
+export declare function readStoredCredentials(config: Pick<CliConfig, 'configDir'>, onInvalid?: (path: string) => void): Promise<StoredCredentials>;
+/** Identity credentials win. The first read moves a CLI 0.2.0 credentials.json aside under the lock. */
+export declare function readCredentials(config: Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'timeoutMs'>>): Promise<CredentialsFile>;
+/** readCredentials for callers that already hold credentials.json.lock. */
+export declare function readLockedCredentials(config: Pick<CliConfig, 'configDir'>): Promise<CredentialsFile>;
+/**
+ * The Identity grant that saving a new one replaces: identity-credentials.json's, or that of a CLI 0.2.0
+ * credentials.json which saving moves there. An unparseable file has no grant to revoke. Callers hold the lock.
+ */
+export declare function readReplacedIdentityGrant(config: Pick<CliConfig, 'configDir'>): Promise<OneCredentials | null>;
+/**
+ * Fail before a login starts, rather than after it was approved, when saving would fail: Windows, or an unsafe
+ * credentials directory or file. Unparseable files pass; login replaces them.
+ */
+export declare function checkCredentialsLocation(config: Pick<CliConfig, 'configDir'>): Promise<void>;
+/** CLI 0.2.0 can write credentials.json again after migration; that grant is ignored until logout revokes it. */
+export declare function hasIgnoredIdentityCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
 export declare function writeOneCredentials(config: CredentialsConfig, one: OneCredentials): Promise<void>;
+/** Remove every local credentials file without revoking anything. */
 export declare function clearOneCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
+/** Remove identity-credentials.json only; credentials.json stays for CLI 0.1.x. */
+export declare function clearIdentityCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
 export declare function getOneAccessToken(config: CredentialsConfig): Promise<string | null>;
+/** Saved sign-in for doctor, which reports problems instead of failing on them. */
+export type OptionalAccessToken = {
+    accessToken: string | null;
+    /** Why the saved sign-in could not be used: an unsafe credentials directory or file, unreadable credentials, a held lock, or a failed refresh. */
+    problem: string | null;
+};
+/**
+ * getOneAccessToken for doctor: any problem with the saved sign-in is returned, not thrown.
+ * Lock waits, discovery and refresh use the configured timeout. Windows skips the credential store entirely.
+ * With no saved sign-in there is no problem, even under a config path that fails the directory checks.
+ */
+export declare function getOptionalOneAccessToken(config: CredentialsConfig): Promise<OptionalAccessToken>;
+/**
+ * Whether list can show the saved sign-in as usable, judged from the files alone: no refresh, no network
+ * and no wait for the credentials lock. A legacy token must be unexpired; an Identity grant may hold an
+ * expired access token, which the next One command refreshes. Windows skips the credential store entirely.
+ * Any problem means signed out and one `warn` per process; an expired legacy token is not a problem.
+ * A credentials directory that fails the strict checks is never written to or opened, and is only warned
+ * about when a credentials file may exist there. Never throws.
+ */
+export declare function hasUsableSignIn(config: CliConfig, warn: (message: string) => void): Promise<boolean>;
 export {};
-//# sourceMappingURL=store.d.ts.map