@vigilbase/cli/dist/auth/store.d.ts

Vigilbase CLI — security scanners, agent tools, and Vigilbase One from the terminal.

import { type Stats } from 'node:fs';
import { z } from 'zod';
import { type CliConfig } from '../lib/config.js';
import type { CredentialsFile, OneCredentials } from './types.js';
export declare const DEFAULT_ONE_ORIGIN = "https://one.vigilbase.com";
export declare const UNCERTAIN_REFRESH = "A previous refresh has an uncertain result. Run `vigilbase login` again; its token cannot be retried safely.";
type CredentialsConfig = Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'oneBaseUrl' | 'clientId' | 'identityBaseUrl' | 'timeoutMs' | 'userAgent'>>;
export declare const OneCredentialsSchema: z.ZodObject<{
    issuer: z.ZodOptional<z.ZodString>;
    clientId: z.ZodOptional<z.ZodString>;
    resource: z.ZodOptional<z.ZodString>;
    refreshToken: z.ZodOptional<z.ZodString>;
    refreshTokenExpiresAt: z.ZodOptional<z.ZodString>;
    refreshPending: z.ZodOptional<z.ZodBoolean>;
    orgId: z.ZodOptional<z.ZodString>;
    oneBaseUrl: z.ZodOptional<z.ZodString>;
    accessToken: z.ZodString;
    tokenType: z.ZodOptional<z.ZodString>;
    scope: z.ZodOptional<z.ZodString>;
    expiresAt: z.ZodOptional<z.ZodString>;
    obtainedAt: z.ZodString;
    user: z.ZodOptional<z.ZodObject<{
        id: z.ZodOptional<z.ZodString>;
        email: z.ZodOptional<z.ZodString>;
        name: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>>;
}, z.core.$strip>;
/** Version 1 One session credentials, shared with CLI 0.1.x. */
export declare function credentialsPath(config: Pick<CliConfig, 'configDir'>): string;
/** Version 2 Identity credentials with the rotating refresh grant. */
export declare function identityCredentialsPath(config: Pick<CliConfig, 'configDir'>): string;
/** A credentials file that passed the safety checks but cannot be parsed or is incomplete. */
export declare class InvalidCredentialsError extends Error {
    constructor(message: string);
}
/** Credentials cannot be protected by modes and owners on Windows yet. */
export declare class SignInUnsupportedError extends Error {
    readonly code = "SIGN_IN_UNSUPPORTED";
    constructor();
}
/**
 * A credentials directory or file the CLI refuses to use. `reason` names the path that failed and `remedy`
 * says how to fix it; `vigilbase login` can't, because it runs the same checks.
 */
export declare class CredentialsPathError extends Error {
    readonly reason: string;
    readonly remedy: string;
    constructor(reason: string, remedy: string, options?: ErrorOptions);
}
export declare function assertFile(info: Stats, path: string): void;
/**
 * Check every ancestor before traversing it; a writable non-sticky parent permits replacement.
 * Every credentials read or write starts here, so on Windows they fail before touching the filesystem.
 */
export declare function checkDirectory(configDir: string, isCreate?: boolean): Promise<boolean>;
/** Both files as saved. credentials.json is version 1, or version 2 when CLI 0.2.0 wrote it. */
export type StoredCredentials = {
    identity: CredentialsFile | null;
    shared: CredentialsFile | null;
};
/**
 * With `onInvalid`, a safe file that cannot be parsed reads as absent and is reported; unsafe files always throw.
 * Without it, an unparseable credentials.json reads as absent when identity-credentials.json holds a sign-in, which wins anyway.
 */
export declare function readStoredCredentials(config: Pick<CliConfig, 'configDir'>, onInvalid?: (path: string) => void): Promise<StoredCredentials>;
/** Identity credentials win. The first read moves a CLI 0.2.0 credentials.json aside under the lock. */
export declare function readCredentials(config: Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'timeoutMs'>>): Promise<CredentialsFile>;
/** readCredentials for callers that already hold credentials.json.lock. */
export declare function readLockedCredentials(config: Pick<CliConfig, 'configDir'>): Promise<CredentialsFile>;
/**
 * The Identity grant that saving a new one replaces: identity-credentials.json's, or that of a CLI 0.2.0
 * credentials.json which saving moves there. An unparseable file has no grant to revoke. Callers hold the lock.
 */
export declare function readReplacedIdentityGrant(config: Pick<CliConfig, 'configDir'>): Promise<OneCredentials | null>;
/**
 * Fail before a login starts, rather than after it was approved, when saving would fail: Windows, or an unsafe
 * credentials directory or file. Unparseable files pass; login replaces them.
 */
export declare function checkCredentialsLocation(config: Pick<CliConfig, 'configDir'>): Promise<void>;
/** CLI 0.2.0 can write credentials.json again after migration; that grant is ignored until logout revokes it. */
export declare function hasIgnoredIdentityCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
export declare function writeOneCredentials(config: CredentialsConfig, one: OneCredentials): Promise<void>;
/** Remove every local credentials file without revoking anything. */
export declare function clearOneCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
/** Remove identity-credentials.json only; credentials.json stays for CLI 0.1.x. */
export declare function clearIdentityCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
export declare function getOneAccessToken(config: CredentialsConfig): Promise<string | null>;
/** Saved sign-in for doctor, which reports problems instead of failing on them. */
export type OptionalAccessToken = {
    accessToken: string | null;
    /** Why the saved sign-in could not be used: an unsafe credentials directory or file, unreadable credentials, a held lock, or a failed refresh. */
    problem: string | null;
};
/**
 * getOneAccessToken for doctor: any problem with the saved sign-in is returned, not thrown.
 * Lock waits, discovery and refresh use the configured timeout. Windows skips the credential store entirely.
 * With no saved sign-in there is no problem, even under a config path that fails the directory checks.
 */
export declare function getOptionalOneAccessToken(config: CredentialsConfig): Promise<OptionalAccessToken>;
/**
 * Whether list can show the saved sign-in as usable, judged from the files alone: no refresh, no network
 * and no wait for the credentials lock. A legacy token must be unexpired; an Identity grant may hold an
 * expired access token, which the next One command refreshes. Windows skips the credential store entirely.
 * Any problem means signed out and one `warn` per process; an expired legacy token is not a problem.
 * A credentials directory that fails the strict checks is never written to or opened, and is only warned
 * about when a credentials file may exist there. Never throws.
 */
export declare function hasUsableSignIn(config: CliConfig, warn: (message: string) => void): Promise<boolean>;
export {};