@vigilbase/cli 0.2.0 → 0.2.1

package/dist/auth/device-auth.js

@@ -39,17 +39,19 @@ async function postJson(config, path, body) {
         },
         body: form ? new URLSearchParams(Object.entries(body).map(([key, value]) => [key, String(value)])) : JSON.stringify(body),
     });
-    return { status: response.status, json: parseJsonResponse(response, text) };
+    return { status: response.status, json: parseJsonResponse(response, text), origin: new URL(url).origin };
 }
 export async function requestDeviceCode(config, options) {
-    const { status, json } = await postJson(config, '/device/code', {
+    const { status, json, origin } = await postJson(config, '/device/code', {
         client_id: config.clientId,
         ...(config.authProvider ? { resource: config.authProvider.resource, scope: 'openid profile email offline_access one:api' } : {}),
         ...(options?.scope ? { scope: options.scope } : {}),
     });
+    // origin is the Identity issuer, or One for legacy sign-in.
     if (status === 404) {
-        throw new DeviceAuthError(`Device authorization is not enabled on ${config.oneBaseUrl} yet. ` +
-            'Enable Better Auth\'s deviceAuthorization plugin on Vigilbase One, then retry `vigilbase login`.', { status, code: 'not_enabled' });
+        throw new DeviceAuthError(`Device sign-in isn't available at ${origin} right now. ` +
+            'If you set --one-url or --auth-url, check that it\'s correct; otherwise try again later or email help@vigilbase.com. ' +
+            'Public tools work without signing in.', { status, code: 'not_enabled' });
     }
     if (status < 200 || status >= 300) {
         throw new DeviceAuthError(`Device code request failed (HTTP ${status})`, { status });
@@ -226,4 +228,3 @@ export async function waitForDeviceAuthorization(config, device, options) {
     }
     throw new DeviceAuthError('Timed out waiting for browser authorization. Run `vigilbase login` again.', { status: 0, code: 'timeout' });
 }
-//# sourceMappingURL=device-auth.js.map

package/dist/auth/index.d.ts

@@ -1,7 +1,6 @@
-export { clearOneCredentials, credentialsPath, getOneAccessToken, readCredentials, writeOneCredentials, } from './store.js';
+export { clearOneCredentials, credentialsPath, getOneAccessToken, getOptionalOneAccessToken, hasUsableSignIn, identityCredentialsPath, readCredentials, writeOneCredentials, } from './store.js';
 export { DeviceAuthError, pollDeviceToken, requestDeviceCode, waitForDeviceAuthorization, } from './device-auth.js';
 export type { CredentialsFile, DeviceCodeResponse, DeviceTokenSuccess, OneCredentials, StoredUser, } from './types.js';
 export { discoverAuthProvider, identityProvider } from './provider.js';
 export { managedAccessToken, revokeSavedCredentials } from './refresh.js';
 export type { AuthProvider } from './provider.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.js

@@ -1,5 +1,4 @@
-export { clearOneCredentials, credentialsPath, getOneAccessToken, readCredentials, writeOneCredentials, } from './store.js';
+export { clearOneCredentials, credentialsPath, getOneAccessToken, getOptionalOneAccessToken, hasUsableSignIn, identityCredentialsPath, readCredentials, writeOneCredentials, } from './store.js';
 export { DeviceAuthError, pollDeviceToken, requestDeviceCode, waitForDeviceAuthorization, } from './device-auth.js';
 export { discoverAuthProvider, identityProvider } from './provider.js';
 export { managedAccessToken, revokeSavedCredentials } from './refresh.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/provider.d.ts

@@ -7,6 +7,7 @@ export interface AuthProvider {
     revocationEndpoint: string;
     resource: string;
 }
+/** An issuer (discovered from One, or saved with credentials) is trusted only when its origin is exactly trustedIdentityIssuer(config). */
 export declare function validateIdentityIssuer(raw: string, config: Pick<CliConfig, 'oneBaseUrl' | 'identityBaseUrl'>): string;
 export declare function identityProvider(config: CliConfig, issuer: string): Promise<AuthProvider>;
 /**
@@ -15,4 +16,3 @@ export declare function identityProvider(config: CliConfig, issuer: string): Pro
  * JSON that is present but malformed or names another resource still aborts.
  */
 export declare function discoverAuthProvider(config: CliConfig): Promise<AuthProvider | undefined>;
-//# sourceMappingURL=provider.d.ts.map

package/dist/auth/provider.js

@@ -1,13 +1,23 @@
 import { DeviceAuthError } from './device-auth.js';
 import { z } from 'zod';
-import { validateOneOrigin } from '../lib/config.js';
+import { DEFAULT_IDENTITY_ISSUER, parseOrigin, STAGING_IDENTITY_ISSUER, trustedIdentityIssuer, validateOneOrigin } from '../lib/config.js';
 import { requestText, parseJsonResponse } from '../lib/network.js';
+/** An issuer (discovered from One, or saved with credentials) is trusted only when its origin is exactly trustedIdentityIssuer(config). */
 export function validateIdentityIssuer(raw, config) {
-    const origin = validateOneOrigin(raw);
-    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(new URL(origin).hostname);
-    if (!['https://auth.vigilbase.com', 'https://identity-staging.vigilbase.com'].includes(origin) && !(loopback && config.identityBaseUrl === origin && ['localhost', '127.0.0.1', '[::1]'].includes(new URL(config.oneBaseUrl).hostname)))
-        throw new Error('Untrusted Identity issuer. Configure --auth-url explicitly for loopback development.');
-    return origin;
+    const trusted = trustedIdentityIssuer(config);
+    let origin;
+    // Do not echo a malformed issuer: it can contain credentials.
+    try {
+        origin = parseOrigin(raw, 'The Identity issuer');
+    }
+    catch {
+        throw new Error('Untrusted Identity issuer: not an HTTP(S) origin.');
+    }
+    if (origin === trusted)
+        return origin;
+    throw new Error(config.identityBaseUrl
+        ? `Untrusted Identity issuer ${origin}: --auth-url / VIGILBASE_AUTH_URL is ${trusted}. Set it to the issuer for this One, or unset it to use ${DEFAULT_IDENTITY_ISSUER}.`
+        : `Untrusted Identity issuer ${origin}: only ${DEFAULT_IDENTITY_ISSUER} is trusted by default. For staging, pass --auth-url ${STAGING_IDENTITY_ISSUER} or set VIGILBASE_AUTH_URL.`);
 }
 async function json(config, url) { const { response, text } = await requestText(config, url, { headers: { Accept: 'application/json', 'User-Agent': config.userAgent } }); return { response, body: parseJsonResponse(response, text) }; }
 export async function identityProvider(config, issuer) {
@@ -59,4 +69,3 @@ export async function discoverAuthProvider(config) {
         return undefined;
     return identityProvider(config, issuer);
 }
-//# sourceMappingURL=provider.js.map

package/dist/auth/refresh.d.ts

@@ -3,8 +3,27 @@ import type { OneCredentials } from './types.js';
 export declare function boundIdentityCredentials(config: CliConfig, one: OneCredentials): boolean;
 /** Library callers may omit or mistype timeoutMs; NaN would make the wait unbounded. */
 export declare function credentialsLockWaitMs(timeoutMs: unknown): number;
-/** Never steal a stale lock: a crashed refresh may have consumed the rotating token. */
-export declare function withCredentialsLock<T>(config: CliConfig, callback: () => Promise<T>, replaceDeadLock?: boolean): Promise<T>;
+/** Another command holds credentials.json.lock. */
+export declare class CredentialsLockedError extends Error {
+    constructor();
+}
+/**
+ * credentials.json.lock guards both credentials files; CLI 0.2.0 takes the same lock.
+ * Never steal a stale lock: a crashed refresh may have consumed the rotating token.
+ * With `wait` false, a held lock fails at once instead of after the lock wait.
+ */
+export declare function withCredentialsLock<T>(config: Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'timeoutMs'>>, callback: () => Promise<T>, replaceDeadLock?: boolean, wait?: boolean): Promise<T>;
 export declare function managedAccessToken(config: CliConfig, failedToken?: string): Promise<string | null>;
-export declare function revokeSavedCredentials(config: CliConfig): Promise<boolean>;
-//# sourceMappingURL=refresh.d.ts.map
+/**
+ * Revoke one saved refresh grant. Identity answers 400 (`invalid_request` or `invalid_grant`) for a token it no
+ * longer knows or has already revoked, for example after a browser sign-out ended the session that approved it,
+ * or a refresh rotated it; nothing is left to revoke then. Other failures throw.
+ */
+export declare function revokeIdentityGrant(config: CliConfig, one: OneCredentials): Promise<void>;
+/**
+ * Revoke every saved Identity grant, then remove its file. A failed revocation keeps every file. A safe file that
+ * can't be parsed has no grant to revoke; the login that calls this replaces it. Callers hold the lock.
+ */
+export declare function revokeIdentityCredentials(config: CliConfig): Promise<boolean>;
+/** Revoke and remove every credentials file. A failed Identity revocation keeps them all. */
+export declare function revokeSavedCredentials(config: CliConfig, onWarning?: (message: string) => void): Promise<boolean>;

package/dist/auth/refresh.js

@@ -5,7 +5,7 @@ import { dirname } from 'node:path';
 import { z } from 'zod';
 import { DEFAULT_TIMEOUT_MS, validateOneOrigin } from '../lib/config.js';
 import { requestText, parseJsonResponse } from '../lib/network.js';
-import { assertFile, checkDirectory, credentialsPath, readCredentials, writeOneCredentials, clearOneCredentials } from './store.js';
+import { assertFile, checkDirectory, credentialsPath, readCredentials, readLockedCredentials, readStoredCredentials, writeOneCredentials, clearOneCredentials, clearIdentityCredentials, DEFAULT_ONE_ORIGIN, UNCERTAIN_REFRESH } from './store.js';
 import { identityProvider, validateIdentityIssuer } from './provider.js';
 export function boundIdentityCredentials(config, one) {
     try {
@@ -21,8 +21,16 @@ export function credentialsLockWaitMs(timeoutMs) {
     const requested = typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : DEFAULT_TIMEOUT_MS;
     return Math.min(requested, MAX_LOCK_WAIT_MS);
 }
-/** Never steal a stale lock: a crashed refresh may have consumed the rotating token. */
-export async function withCredentialsLock(config, callback, replaceDeadLock = false) {
+/** Another command holds credentials.json.lock. */
+export class CredentialsLockedError extends Error {
+    constructor() { super('Credentials are locked by another command. A crashed refresh requires a new login; do not reuse its refresh token.'); this.name = 'CredentialsLockedError'; }
+}
+/**
+ * credentials.json.lock guards both credentials files; CLI 0.2.0 takes the same lock.
+ * Never steal a stale lock: a crashed refresh may have consumed the rotating token.
+ * With `wait` false, a held lock fails at once instead of after the lock wait.
+ */
+export async function withCredentialsLock(config, callback, replaceDeadLock = false, wait = true) {
     const path = `${credentialsPath(config)}.lock`;
     await checkDirectory(dirname(path), true);
     const deadline = Date.now() + credentialsLockWaitMs(config.timeoutMs);
@@ -36,12 +44,12 @@ export async function withCredentialsLock(config, callback, replaceDeadLock = fa
             if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST'))
                 throw error;
             const existing = await lstat(path);
-            assertFile(existing);
+            assertFile(existing, path);
             if (replaceDeadLock) {
                 const existingHandle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
                 let owner = '';
                 try {
-                    assertFile(await existingHandle.stat());
+                    assertFile(await existingHandle.stat(), path);
                     owner = await existingHandle.readFile('utf8');
                 }
                 finally {
@@ -65,14 +73,14 @@ export async function withCredentialsLock(config, callback, replaceDeadLock = fa
                     }
                 }
             }
-            if (Date.now() >= deadline)
-                throw new Error('Credentials are locked by another command. A crashed refresh requires a new login; do not reuse its refresh token.');
+            if (!wait || Date.now() >= deadline)
+                throw new CredentialsLockedError();
             await new Promise(resolve => setTimeout(resolve, 100));
         }
     }
     await handle.chmod(0o600);
     const info = await handle.stat();
-    assertFile(info);
+    assertFile(info, path);
     try {
         await handle.writeFile(String(process.pid));
         await handle.sync();
@@ -94,7 +102,7 @@ export async function managedAccessToken(config, failedToken) {
         return initial.one.accessToken;
     }
     return withCredentialsLock(config, async () => {
-        const current = await readCredentials(config), one = current.one;
+        const current = await readLockedCredentials(config), one = current.one;
         if (current.version !== 2 || !one || !boundIdentityCredentials(config, one))
             return null;
         if (failedToken && one.accessToken !== failedToken) {
@@ -106,14 +114,14 @@ export async function managedAccessToken(config, failedToken) {
             return one.accessToken;
         }
         if (one.refreshPending)
-            throw new Error('A previous refresh has an uncertain result. Run `vigilbase login` again; its token cannot be retried safely.');
+            throw new Error(UNCERTAIN_REFRESH);
         const provider = await identityProvider(config, one.issuer);
         await writeOneCredentials(config, { ...one, refreshPending: true });
         const { response, text } = await requestText(config, provider.tokenEndpoint, { method: 'POST', headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: one.refreshToken, client_id: one.clientId, resource: one.resource }) });
         const body = parseJsonResponse(response, text);
         if (!response.ok) {
             if (z.object({ error: z.literal('invalid_grant') }).safeParse(body).success)
-                await clearOneCredentials(config);
+                await clearIdentityCredentials(config);
             throw new Error('Identity refresh failed. Run `vigilbase login` again.');
         }
         const token = z.object({ access_token: z.string().min(1), refresh_token: z.string().min(1), expires_in: z.number().int().positive().max(300), scope: z.string().optional() }).safeParse(body);
@@ -126,18 +134,66 @@ export async function managedAccessToken(config, failedToken) {
         return token.data.access_token;
     });
 }
-export async function revokeSavedCredentials(config) {
+const SAVED_FOR_OTHER_CONFIGURATION = 'Saved credentials belong to a different issuer, resource, or client. Use the matching configuration to log out.';
+/**
+ * Revoke one saved refresh grant. Identity answers 400 (`invalid_request` or `invalid_grant`) for a token it no
+ * longer knows or has already revoked, for example after a browser sign-out ended the session that approved it,
+ * or a refresh rotated it; nothing is left to revoke then. Other failures throw.
+ */
+export async function revokeIdentityGrant(config, one) {
+    if (!boundIdentityCredentials(config, one))
+        throw new Error(SAVED_FOR_OTHER_CONFIGURATION);
+    const provider = await identityProvider(config, one.issuer);
+    const { response, text } = await requestText(config, provider.revocationEndpoint, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ token: one.refreshToken, token_type_hint: 'refresh_token', client_id: one.clientId }) });
+    if (response.ok)
+        return;
+    if (response.status === 400 && z.object({ error: z.enum(['invalid_request', 'invalid_grant']) }).safeParse(parseJsonResponse(response, text)).success)
+        return;
+    throw new Error('Identity revocation failed, so your saved sign-in was kept. Try again later.');
+}
+async function revokeIdentityGrants(config, { identity, shared }) {
+    const grants = [identity, shared].flatMap((saved) => saved?.version === 2 && saved.one ? [saved.one] : []);
+    // Check every grant first, so a mismatch can't leave one revoked while its file stays.
+    if (grants.some((one) => !boundIdentityCredentials(config, one)))
+        throw new Error(SAVED_FOR_OTHER_CONFIGURATION);
+    for (const one of grants)
+        await revokeIdentityGrant(config, one);
+}
+/**
+ * Revoke every saved Identity grant, then remove its file. A failed revocation keeps every file. A safe file that
+ * can't be parsed has no grant to revoke; the login that calls this replaces it. Callers hold the lock.
+ */
+export async function revokeIdentityCredentials(config) {
+    const stored = await readStoredCredentials(config, () => { });
+    await revokeIdentityGrants(config, stored);
+    // credentials.json goes too only when it held a CLI 0.2.0 grant.
+    return stored.shared?.version === 2 ? clearOneCredentials(config) : clearIdentityCredentials(config);
+}
+/** Best effort: legacy One auth retires on 2026-10-31, and its session expires on its own. */
+async function signOutLegacySession(config, one) {
+    const origin = validateOneOrigin(one.oneBaseUrl ?? DEFAULT_ONE_ORIGIN);
+    const { response } = await requestText(config, `${origin}/api/auth/sign-out`, { method: 'POST', headers: { Accept: 'application/json', Authorization: `Bearer ${one.accessToken}`, 'User-Agent': config.userAgent }, redirect: 'manual', credentials: 'omit' });
+    if (!response.ok)
+        throw new Error('Legacy One sign-out failed.');
+}
+/** Revoke and remove every credentials file. A failed Identity revocation keeps them all. */
+export async function revokeSavedCredentials(config, onWarning) {
     return withCredentialsLock(config, async () => {
-        const saved = await readCredentials(config);
-        if (saved.version === 2 && saved.one) {
-            if (!boundIdentityCredentials(config, saved.one))
-                throw new Error('Saved credentials belong to a different issuer, resource, or client. Use the matching configuration to log out.');
-            const provider = await identityProvider(config, saved.one.issuer);
-            const { response } = await requestText(config, provider.revocationEndpoint, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': config.userAgent }, body: new URLSearchParams({ token: saved.one.refreshToken, token_type_hint: 'refresh_token', client_id: saved.one.clientId }) });
-            if (!response.ok)
-                throw new Error('Identity revocation failed. Credentials retained so logout can be retried.');
+        // A safe file that cannot be parsed cannot be revoked either; removing it keeps logout from dead-ending.
+        const unreadable = [];
+        const stored = await readStoredCredentials(config, (path) => unreadable.push(path));
+        await revokeIdentityGrants(config, stored);
+        if (stored.shared?.version === 1 && stored.shared.one) {
+            try {
+                await signOutLegacySession(config, stored.shared.one);
+            }
+            catch {
+                onWarning?.('Could not sign out the legacy One session. Local credentials are removed anyway.');
+            }
         }
-        return clearOneCredentials(config);
+        const cleared = await clearOneCredentials(config);
+        if (unreadable.length)
+            onWarning?.(`Couldn't read the saved sign-in in ${unreadable.join(' and ')}, so it was removed without revoking it. It will expire on its own.`);
+        return cleared;
     }, true);
 }
-//# sourceMappingURL=refresh.js.map

package/dist/auth/store.d.ts

@@ -2,6 +2,8 @@ import { type Stats } from 'node:fs';
 import { z } from 'zod';
 import { type CliConfig } from '../lib/config.js';
 import type { CredentialsFile, OneCredentials } from './types.js';
+export declare const DEFAULT_ONE_ORIGIN = "https://one.vigilbase.com";
+export declare const UNCERTAIN_REFRESH = "A previous refresh has an uncertain result. Run `vigilbase login` again; its token cannot be retried safely.";
 type CredentialsConfig = Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'oneBaseUrl' | 'clientId' | 'identityBaseUrl' | 'timeoutMs' | 'userAgent'>>;
 export declare const OneCredentialsSchema: z.ZodObject<{
     issuer: z.ZodOptional<z.ZodString>;
@@ -23,13 +25,85 @@ export declare const OneCredentialsSchema: z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/** Version 1 One session credentials, shared with CLI 0.1.x. */
 export declare function credentialsPath(config: Pick<CliConfig, 'configDir'>): string;
-export declare function assertFile(info: Stats): void;
-/** Check every ancestor before traversing it; a writable non-sticky parent permits replacement. */
+/** Version 2 Identity credentials with the rotating refresh grant. */
+export declare function identityCredentialsPath(config: Pick<CliConfig, 'configDir'>): string;
+/** A credentials file that passed the safety checks but cannot be parsed or is incomplete. */
+export declare class InvalidCredentialsError extends Error {
+    constructor(message: string);
+}
+/** Credentials cannot be protected by modes and owners on Windows yet. */
+export declare class SignInUnsupportedError extends Error {
+    readonly code = "SIGN_IN_UNSUPPORTED";
+    constructor();
+}
+/**
+ * A credentials directory or file the CLI refuses to use. `reason` names the path that failed and `remedy`
+ * says how to fix it; `vigilbase login` can't, because it runs the same checks.
+ */
+export declare class CredentialsPathError extends Error {
+    readonly reason: string;
+    readonly remedy: string;
+    constructor(reason: string, remedy: string, options?: ErrorOptions);
+}
+export declare function assertFile(info: Stats, path: string): void;
+/**
+ * Check every ancestor before traversing it; a writable non-sticky parent permits replacement.
+ * Every credentials read or write starts here, so on Windows they fail before touching the filesystem.
+ */
 export declare function checkDirectory(configDir: string, isCreate?: boolean): Promise<boolean>;
-export declare function readCredentials(config: Pick<CliConfig, 'configDir'>): Promise<CredentialsFile>;
+/** Both files as saved. credentials.json is version 1, or version 2 when CLI 0.2.0 wrote it. */
+export type StoredCredentials = {
+    identity: CredentialsFile | null;
+    shared: CredentialsFile | null;
+};
+/**
+ * With `onInvalid`, a safe file that cannot be parsed reads as absent and is reported; unsafe files always throw.
+ * Without it, an unparseable credentials.json reads as absent when identity-credentials.json holds a sign-in, which wins anyway.
+ */
+export declare function readStoredCredentials(config: Pick<CliConfig, 'configDir'>, onInvalid?: (path: string) => void): Promise<StoredCredentials>;
+/** Identity credentials win. The first read moves a CLI 0.2.0 credentials.json aside under the lock. */
+export declare function readCredentials(config: Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'timeoutMs'>>): Promise<CredentialsFile>;
+/** readCredentials for callers that already hold credentials.json.lock. */
+export declare function readLockedCredentials(config: Pick<CliConfig, 'configDir'>): Promise<CredentialsFile>;
+/**
+ * The Identity grant that saving a new one replaces: identity-credentials.json's, or that of a CLI 0.2.0
+ * credentials.json which saving moves there. An unparseable file has no grant to revoke. Callers hold the lock.
+ */
+export declare function readReplacedIdentityGrant(config: Pick<CliConfig, 'configDir'>): Promise<OneCredentials | null>;
+/**
+ * Fail before a login starts, rather than after it was approved, when saving would fail: Windows, or an unsafe
+ * credentials directory or file. Unparseable files pass; login replaces them.
+ */
+export declare function checkCredentialsLocation(config: Pick<CliConfig, 'configDir'>): Promise<void>;
+/** CLI 0.2.0 can write credentials.json again after migration; that grant is ignored until logout revokes it. */
+export declare function hasIgnoredIdentityCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
 export declare function writeOneCredentials(config: CredentialsConfig, one: OneCredentials): Promise<void>;
+/** Remove every local credentials file without revoking anything. */
 export declare function clearOneCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
+/** Remove identity-credentials.json only; credentials.json stays for CLI 0.1.x. */
+export declare function clearIdentityCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
 export declare function getOneAccessToken(config: CredentialsConfig): Promise<string | null>;
+/** Saved sign-in for doctor, which reports problems instead of failing on them. */
+export type OptionalAccessToken = {
+    accessToken: string | null;
+    /** Why the saved sign-in could not be used: an unsafe credentials directory or file, unreadable credentials, a held lock, or a failed refresh. */
+    problem: string | null;
+};
+/**
+ * getOneAccessToken for doctor: any problem with the saved sign-in is returned, not thrown.
+ * Lock waits, discovery and refresh use the configured timeout. Windows skips the credential store entirely.
+ * With no saved sign-in there is no problem, even under a config path that fails the directory checks.
+ */
+export declare function getOptionalOneAccessToken(config: CredentialsConfig): Promise<OptionalAccessToken>;
+/**
+ * Whether list can show the saved sign-in as usable, judged from the files alone: no refresh, no network
+ * and no wait for the credentials lock. A legacy token must be unexpired; an Identity grant may hold an
+ * expired access token, which the next One command refreshes. Windows skips the credential store entirely.
+ * Any problem means signed out and one `warn` per process; an expired legacy token is not a problem.
+ * A credentials directory that fails the strict checks is never written to or opened, and is only warned
+ * about when a credentials file may exist there. Never throws.
+ */
+export declare function hasUsableSignIn(config: CliConfig, warn: (message: string) => void): Promise<boolean>;
 export {};
-//# sourceMappingURL=store.d.ts.map