@clivly/auth-workos 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clivly
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,21 @@
+# @clivly/auth-workos
+
+[WorkOS](https://workos.com) implementation of Clivly's `ClivlyAuthAdapter`. Unseals the host app's AuthKit session cookie to resolve a CRM end-user's identity.
+
+`@workos-inc/node` is a peer dependency.
+
+```ts
+import { createWorkOSAuthAdapter } from "@clivly/auth-workos";
+
+const authAdapter = createWorkOSAuthAdapter({
+  apiKey: process.env.WORKOS_API_KEY!,
+  clientId: process.env.WORKOS_CLIENT_ID!,
+  cookiePassword: process.env.WORKOS_COOKIE_PASSWORD!,
+});
+
+const user = await authAdapter.getUser(request); // { id, email, name } | null
+```
+
+## License
+
+MIT

package/dist/index.d.mts

@@ -0,0 +1,30 @@
+import { ClivlyAuthAdapter, ClivlyUser } from "@clivly/core";
+
+//#region src/map.d.ts
+interface WorkOSLikeUser {
+  email: string;
+  firstName?: string | null;
+  id: string;
+  lastName?: string | null;
+}
+declare function workosUserToClivlyUser(user: WorkOSLikeUser): ClivlyUser | null;
+//#endregion
+//#region src/index.d.ts
+interface WorkOSAuthAdapterOptions {
+  /** WorkOS API key (sk_…). */
+  apiKey: string;
+  /** WorkOS client ID (client_…). */
+  clientId: string;
+  /** Session cookie name. Defaults to `wos-session`. */
+  cookieName?: string;
+  /** Password used to unseal the AuthKit session cookie. */
+  cookiePassword: string;
+}
+/**
+ * WorkOS → ClivlyAuthAdapter. Unseals the host app's AuthKit session cookie and
+ * resolves the CRM end-user's identity. Answers "who is this person?" only —
+ * CRM authorization lives in the separate `crm_members` layer.
+ */
+declare function createWorkOSAuthAdapter(options: WorkOSAuthAdapterOptions): ClivlyAuthAdapter;
+//#endregion
+export { WorkOSAuthAdapterOptions, type WorkOSLikeUser, createWorkOSAuthAdapter, workosUserToClivlyUser };

package/dist/index.mjs

@@ -0,0 +1,45 @@
+import { WorkOS } from "@workos-inc/node";
+//#region src/map.ts
+function workosUserToClivlyUser(user) {
+	if (!user.email) return null;
+	const name = [user.firstName, user.lastName].filter(Boolean).join(" ") || void 0;
+	return {
+		id: user.id,
+		email: user.email,
+		name
+	};
+}
+function readCookie(req, name) {
+	const header = req.headers.get("cookie");
+	if (!header) return null;
+	for (const part of header.split(";")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		if (part.slice(0, eq).trim() === name) return decodeURIComponent(part.slice(eq + 1).trim());
+	}
+	return null;
+}
+//#endregion
+//#region src/index.ts
+const DEFAULT_COOKIE_NAME = "wos-session";
+/**
+* WorkOS → ClivlyAuthAdapter. Unseals the host app's AuthKit session cookie and
+* resolves the CRM end-user's identity. Answers "who is this person?" only —
+* CRM authorization lives in the separate `crm_members` layer.
+*/
+function createWorkOSAuthAdapter(options) {
+	const workos = new WorkOS(options.apiKey, { clientId: options.clientId });
+	const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
+	return { async getUser(req) {
+		const sessionData = readCookie(req, cookieName);
+		if (!sessionData) return null;
+		const result = await workos.userManagement.loadSealedSession({
+			sessionData,
+			cookiePassword: options.cookiePassword
+		}).authenticate();
+		if (!result.authenticated) return null;
+		return workosUserToClivlyUser(result.user);
+	} };
+}
+//#endregion
+export { createWorkOSAuthAdapter, workosUserToClivlyUser };

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@clivly/auth-workos",
+  "version": "0.1.0",
+  "private": false,
+  "type": "module",
+  "description": "WorkOS implementation of Clivly's ClivlyAuthAdapter.",
+  "license": "MIT",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@clivly/core": "0.1.0"
+  },
+  "peerDependencies": {
+    "@workos-inc/node": ">=7"
+  },
+  "devDependencies": {
+    "@workos-inc/node": "^7.75.0",
+    "tsdown": "^0.21.9",
+    "typescript": "^6",
+    "@clivly.com/config": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "check-types": "tsc --noEmit"
+  },
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts"
+}