clivly 0.2.0 → 0.2.2

package/README.md

@@ -1,16 +1,49 @@
 # clivly
 
-Scaffold [Clivly](https://clivly.com) — the CRM that lives inside your app.
+Configure and integrate [Clivly](https://clivly.com) — the CRM that lives inside
+your app.
+
+For the full integration path, including when to use `start()` versus
+`runScheduled()` / `createClivlyHandler()`, see the
+[connecting to Clivly Cloud guide](https://github.com/amani-joseph/clivly.com/blob/master/docs/guides/connecting-to-clivly-cloud.md).
 
 ## Usage
 
 ```bash
-npx clivly init          # detect your stack and print the scaffold plan
+npm install clivly
+
+npx clivly init          # detect your Drizzle schema and print the config plan
 npx clivly init --write  # write clivly.config.ts
 npx clivly ping          # verify CLIVLY_API_KEY + reachability
+npx clivly doctor        # verify clivly.config.ts end-to-end
 ```
 
-`clivly init` detects your framework (Next.js, TanStack Start, SvelteKit, Remix, Nuxt) and ORM (Drizzle, Prisma, Kysely) from `package.json`, then reports the routes and schema fragment it will scaffold.
+## Imports
+
+`clivly` is the consolidated public package. The CLI remains available as
+`npx clivly`, while application code imports from typed subpaths:
+
+```ts
+import { defineClivlyConfig } from "clivly/core";
+import { createClivlySDK } from "clivly/sdk";
+import { fromDrizzle } from "clivly/drizzle";
+import { clivlyVite } from "clivly/vite";
+import { createClerkAuthAdapter } from "clivly/auth/clerk";
+import { createWorkOSAuthAdapter } from "clivly/auth/workos";
+import { createBetterAuthAdapter } from "clivly/auth/better-auth";
+```
+
+Provider and framework integrations use optional peer dependencies. Install only
+what your app actually uses, such as `drizzle-orm`, `vite`, `@clerk/backend`, or
+`@workos-inc/node`.
+
+`clivly init` detects your framework from `package.json`, locates your Drizzle
+schema, and generates a `clivly.config.ts` that maps likely contact and company
+tables. The init command currently generates config for Drizzle only; Prisma and
+Kysely projects should use a hand-written `fetchPage` source for now.
+
+Use `--schema <path>` when your Drizzle schema is not in a common location or in
+`drizzle.config.ts`. Re-run with `--force` to overwrite an existing config.
 
 `clivly ping` reads `CLIVLY_API_KEY` from the environment, sends one heartbeat, and prints a clear ✅/❌ with the resolved org or the failure reason — so you can confirm a connection from the terminal without writing any code. Point it at a non-default backend with `--api-url <url>` (or `CLIVLY_API_URL`).
 
@@ -22,6 +55,24 @@ CLIVLY_API_KEY=sk_live_… npx clivly ping
 #      Org: Acme (org_1)
 ```
 
+`clivly doctor` loads your config and runs the same read-only checks as
+`await clivly.doctor()`: API key, entity config, sources, Drizzle cursor/id
+columns, sample fetch, and heartbeat.
+
+```bash
+npx clivly doctor
+npx clivly doctor --config ./apps/web/clivly.config.ts
+```
+
+## More docs
+
+- Onboarding guide:
+  [connecting to Clivly Cloud](https://github.com/amani-joseph/clivly.com/blob/master/docs/guides/connecting-to-clivly-cloud.md)
+- SDK docs:
+  [`@clivly/sdk` README](https://github.com/amani-joseph/clivly.com/blob/master/packages/sdk/README.md)
+- Release notes:
+  [CHANGELOG](https://github.com/amani-joseph/clivly.com/blob/master/CHANGELOG.md)
+
 ## License
 
 MIT

package/adapter-Cd6D_3JD.d.mts

@@ -0,0 +1,46 @@
+import { C as UpdateDealInput, S as UpdateContactInput, _ as Task, a as ContactFilters, c as CreateCompanyInput, d as CreateTaskInput, g as RecordSource, i as Contact, l as CreateContactInput, p as Deal, r as Company, s as CreateActivityInput, t as Activity, u as CreateDealInput, w as UpdateTaskInput, y as TaskFilters } from "./types-_qbJXMt_.mjs";
+
+//#region ../core/src/adapter.d.ts
+/**
+ * The contract every ORM implementation fulfils. `packages/drizzle` is the first
+ * implementation; Prisma/Kysely/TypeORM can follow without changes to consumers.
+ *
+ * Every method is scoped to a single organization (`orgId`) — the adapter is the
+ * one place tenant isolation is enforced for CRM data. Implementations only ever
+ * read/write Clivly-owned `crm_*` tables; they never mutate host business tables.
+ */
+interface CRMAdapter {
+  archiveTask(orgId: string, id: string): Promise<Task>;
+  completeTask(orgId: string, id: string): Promise<Task>;
+  createActivity(orgId: string, data: CreateActivityInput): Promise<Activity>;
+  createCompany(orgId: string, data: CreateCompanyInput): Promise<Company>;
+  createContact(orgId: string, data: CreateContactInput): Promise<Contact>;
+  createDeal(orgId: string, data: CreateDealInput): Promise<Deal>;
+  createTask(orgId: string, data: CreateTaskInput): Promise<Task>;
+  deleteDeal(orgId: string, id: string): Promise<Deal | null>;
+  getActivities(orgId: string, contactId: string): Promise<Activity[]>;
+  getCompanies(orgId: string, filters?: {
+    source?: RecordSource;
+  }): Promise<Company[]>;
+  getContact(orgId: string, id: string): Promise<Contact | null>;
+  getContacts(orgId: string, filters?: ContactFilters): Promise<Contact[]>;
+  getDeal(orgId: string, id: string): Promise<Deal | null>;
+  getDeals(orgId: string, filters?: {
+    source?: RecordSource;
+  }): Promise<Deal[]>;
+  getTasks(orgId: string, filters?: TaskFilters): Promise<Task[]>;
+  reopenTask(orgId: string, id: string): Promise<Task>;
+  updateContact(orgId: string, id: string, data: UpdateContactInput): Promise<Contact>;
+  /**
+   * Move a deal to `stage` and reorder it directly after `afterId` (null = top
+   * of the column). The adapter computes the fractional `position` from the
+   * target column's current order; callers never pass a numeric position.
+   */
+  moveDeal(orgId: string, id: string, stage: Deal["stage"], afterId: string | null): Promise<Deal>;
+  updateDeal(orgId: string, id: string, data: UpdateDealInput): Promise<Deal>;
+  updateDealStage(orgId: string, id: string, stage: Deal["stage"]): Promise<Deal>;
+  updateTask(orgId: string, id: string, data: UpdateTaskInput): Promise<Task>;
+  updateTaskStatus(orgId: string, id: string, status: Task["status"]): Promise<Task>;
+}
+//#endregion
+export { CRMAdapter as t };

package/adapter-Cy4q2CLs.d.cts

@@ -0,0 +1,46 @@
+import { C as UpdateDealInput, S as UpdateContactInput, _ as Task, a as ContactFilters, c as CreateCompanyInput, d as CreateTaskInput, g as RecordSource, i as Contact, l as CreateContactInput, p as Deal, r as Company, s as CreateActivityInput, t as Activity, u as CreateDealInput, w as UpdateTaskInput, y as TaskFilters } from "./types-BpsKVccL.cjs";
+
+//#region ../core/src/adapter.d.ts
+/**
+ * The contract every ORM implementation fulfils. `packages/drizzle` is the first
+ * implementation; Prisma/Kysely/TypeORM can follow without changes to consumers.
+ *
+ * Every method is scoped to a single organization (`orgId`) — the adapter is the
+ * one place tenant isolation is enforced for CRM data. Implementations only ever
+ * read/write Clivly-owned `crm_*` tables; they never mutate host business tables.
+ */
+interface CRMAdapter {
+  archiveTask(orgId: string, id: string): Promise<Task>;
+  completeTask(orgId: string, id: string): Promise<Task>;
+  createActivity(orgId: string, data: CreateActivityInput): Promise<Activity>;
+  createCompany(orgId: string, data: CreateCompanyInput): Promise<Company>;
+  createContact(orgId: string, data: CreateContactInput): Promise<Contact>;
+  createDeal(orgId: string, data: CreateDealInput): Promise<Deal>;
+  createTask(orgId: string, data: CreateTaskInput): Promise<Task>;
+  deleteDeal(orgId: string, id: string): Promise<Deal | null>;
+  getActivities(orgId: string, contactId: string): Promise<Activity[]>;
+  getCompanies(orgId: string, filters?: {
+    source?: RecordSource;
+  }): Promise<Company[]>;
+  getContact(orgId: string, id: string): Promise<Contact | null>;
+  getContacts(orgId: string, filters?: ContactFilters): Promise<Contact[]>;
+  getDeal(orgId: string, id: string): Promise<Deal | null>;
+  getDeals(orgId: string, filters?: {
+    source?: RecordSource;
+  }): Promise<Deal[]>;
+  getTasks(orgId: string, filters?: TaskFilters): Promise<Task[]>;
+  reopenTask(orgId: string, id: string): Promise<Task>;
+  updateContact(orgId: string, id: string, data: UpdateContactInput): Promise<Contact>;
+  /**
+   * Move a deal to `stage` and reorder it directly after `afterId` (null = top
+   * of the column). The adapter computes the fractional `position` from the
+   * target column's current order; callers never pass a numeric position.
+   */
+  moveDeal(orgId: string, id: string, stage: Deal["stage"], afterId: string | null): Promise<Deal>;
+  updateDeal(orgId: string, id: string, data: UpdateDealInput): Promise<Deal>;
+  updateDealStage(orgId: string, id: string, stage: Deal["stage"]): Promise<Deal>;
+  updateTask(orgId: string, id: string, data: UpdateTaskInput): Promise<Task>;
+  updateTaskStatus(orgId: string, id: string, status: Task["status"]): Promise<Task>;
+}
+//#endregion
+export { CRMAdapter as t };

package/auth-adapter-CBOKDhlc.cjs

@@ -0,0 +1,11 @@
+//#region ../core/src/auth-adapter.ts
+function authCustom(resolver) {
+	return { getUser: async (req) => await resolver(req) };
+}
+//#endregion
+Object.defineProperty(exports, "authCustom", {
+	enumerable: true,
+	get: function() {
+		return authCustom;
+	}
+});

package/auth-adapter-CRBW4elj.d.mts

@@ -0,0 +1,30 @@
+import { f as CrmRole } from "./types-_qbJXMt_.mjs";
+
+//#region ../core/src/auth-adapter.d.ts
+interface ClivlyUser {
+  email: string;
+  id: string;
+  name?: string;
+}
+/**
+ * Bridges any host auth system into Clivly. Ship adapters wrap a concrete SDK
+ * (`@clivly/auth-clerk`, `@clivly/auth-workos`), and `authCustom` wraps an
+ * arbitrary `(req) => user` resolver.
+ *
+ * This answers "who is this person?" only. Authorization ("what can they do in
+ * this org?") is the separate `crm_members` layer — see `MembershipResolver`.
+ */
+interface ClivlyAuthAdapter {
+  getUser(req: Request): Promise<ClivlyUser | null>;
+}
+declare function authCustom(resolver: (req: Request) => Promise<ClivlyUser | null> | ClivlyUser | null): ClivlyAuthAdapter;
+interface CrmMembership {
+  orgId: string;
+  role: CrmRole;
+  userId: string;
+}
+interface MembershipResolver {
+  getMembership(userId: string, orgId: string): Promise<CrmMembership | null>;
+}
+//#endregion
+export { authCustom as a, MembershipResolver as i, ClivlyUser as n, CrmMembership as r, ClivlyAuthAdapter as t };

package/auth-adapter-CdLODn2p.d.cts

@@ -0,0 +1,30 @@
+import { f as CrmRole } from "./types-BpsKVccL.cjs";
+
+//#region ../core/src/auth-adapter.d.ts
+interface ClivlyUser {
+  email: string;
+  id: string;
+  name?: string;
+}
+/**
+ * Bridges any host auth system into Clivly. Ship adapters wrap a concrete SDK
+ * (`@clivly/auth-clerk`, `@clivly/auth-workos`), and `authCustom` wraps an
+ * arbitrary `(req) => user` resolver.
+ *
+ * This answers "who is this person?" only. Authorization ("what can they do in
+ * this org?") is the separate `crm_members` layer — see `MembershipResolver`.
+ */
+interface ClivlyAuthAdapter {
+  getUser(req: Request): Promise<ClivlyUser | null>;
+}
+declare function authCustom(resolver: (req: Request) => Promise<ClivlyUser | null> | ClivlyUser | null): ClivlyAuthAdapter;
+interface CrmMembership {
+  orgId: string;
+  role: CrmRole;
+  userId: string;
+}
+interface MembershipResolver {
+  getMembership(userId: string, orgId: string): Promise<CrmMembership | null>;
+}
+//#endregion
+export { authCustom as a, MembershipResolver as i, ClivlyUser as n, CrmMembership as r, ClivlyAuthAdapter as t };

package/auth-adapter-wqnnEjo3.mjs

@@ -0,0 +1,6 @@
+//#region ../core/src/auth-adapter.ts
+function authCustom(resolver) {
+	return { getUser: async (req) => await resolver(req) };
+}
+//#endregion
+export { authCustom as t };

package/auth-better-auth.cjs

@@ -0,0 +1,28 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region ../auth-better-auth/src/map.ts
+function betterAuthUserToClivlyUser(user) {
+	if (!user.email) return null;
+	return {
+		id: user.id,
+		email: user.email,
+		name: user.name ?? void 0
+	};
+}
+//#endregion
+//#region ../auth-better-auth/src/index.ts
+/**
+* better-auth → ClivlyAuthAdapter. Resolves the CRM end-user's identity from the
+* host app's better-auth session on each request, via `auth.api.getSession`.
+* Answers "who is this person?" only — CRM authorization lives in the separate
+* `crm_members` layer.
+*/
+function createBetterAuthAdapter(options) {
+	return { async getUser(req) {
+		const session = await options.auth.api.getSession({ headers: req.headers });
+		if (!session?.user) return null;
+		return betterAuthUserToClivlyUser(session.user);
+	} };
+}
+//#endregion
+exports.betterAuthUserToClivlyUser = betterAuthUserToClivlyUser;
+exports.createBetterAuthAdapter = createBetterAuthAdapter;

package/auth-better-auth.d.cts

@@ -0,0 +1,33 @@
+import { n as ClivlyUser, t as ClivlyAuthAdapter } from "./auth-adapter-CdLODn2p.cjs";
+
+//#region ../auth-better-auth/src/map.d.ts
+interface BetterAuthLikeUser {
+  email?: string | null;
+  id: string;
+  name?: string | null;
+}
+declare function betterAuthUserToClivlyUser(user: BetterAuthLikeUser): ClivlyUser | null;
+//#endregion
+//#region ../auth-better-auth/src/index.d.ts
+interface BetterAuthLike {
+  api: {
+    getSession(args: {
+      headers: Headers;
+    }): Promise<{
+      user: BetterAuthLikeUser;
+    } | null>;
+  };
+}
+interface BetterAuthAdapterOptions {
+  /** Your better-auth instance (the object returned by `betterAuth({...})`). */
+  auth: BetterAuthLike;
+}
+/**
+ * better-auth → ClivlyAuthAdapter. Resolves the CRM end-user's identity from the
+ * host app's better-auth session on each request, via `auth.api.getSession`.
+ * Answers "who is this person?" only — CRM authorization lives in the separate
+ * `crm_members` layer.
+ */
+declare function createBetterAuthAdapter(options: BetterAuthAdapterOptions): ClivlyAuthAdapter;
+//#endregion
+export { BetterAuthAdapterOptions, BetterAuthLike, type BetterAuthLikeUser, betterAuthUserToClivlyUser, createBetterAuthAdapter };

package/auth-better-auth.d.mts

@@ -0,0 +1,33 @@
+import { n as ClivlyUser, t as ClivlyAuthAdapter } from "./auth-adapter-CRBW4elj.mjs";
+
+//#region ../auth-better-auth/src/map.d.ts
+interface BetterAuthLikeUser {
+  email?: string | null;
+  id: string;
+  name?: string | null;
+}
+declare function betterAuthUserToClivlyUser(user: BetterAuthLikeUser): ClivlyUser | null;
+//#endregion
+//#region ../auth-better-auth/src/index.d.ts
+interface BetterAuthLike {
+  api: {
+    getSession(args: {
+      headers: Headers;
+    }): Promise<{
+      user: BetterAuthLikeUser;
+    } | null>;
+  };
+}
+interface BetterAuthAdapterOptions {
+  /** Your better-auth instance (the object returned by `betterAuth({...})`). */
+  auth: BetterAuthLike;
+}
+/**
+ * better-auth → ClivlyAuthAdapter. Resolves the CRM end-user's identity from the
+ * host app's better-auth session on each request, via `auth.api.getSession`.
+ * Answers "who is this person?" only — CRM authorization lives in the separate
+ * `crm_members` layer.
+ */
+declare function createBetterAuthAdapter(options: BetterAuthAdapterOptions): ClivlyAuthAdapter;
+//#endregion
+export { BetterAuthAdapterOptions, BetterAuthLike, type BetterAuthLikeUser, betterAuthUserToClivlyUser, createBetterAuthAdapter };

package/auth-better-auth.mjs

@@ -0,0 +1,26 @@
+//#region ../auth-better-auth/src/map.ts
+function betterAuthUserToClivlyUser(user) {
+	if (!user.email) return null;
+	return {
+		id: user.id,
+		email: user.email,
+		name: user.name ?? void 0
+	};
+}
+//#endregion
+//#region ../auth-better-auth/src/index.ts
+/**
+* better-auth → ClivlyAuthAdapter. Resolves the CRM end-user's identity from the
+* host app's better-auth session on each request, via `auth.api.getSession`.
+* Answers "who is this person?" only — CRM authorization lives in the separate
+* `crm_members` layer.
+*/
+function createBetterAuthAdapter(options) {
+	return { async getUser(req) {
+		const session = await options.auth.api.getSession({ headers: req.headers });
+		if (!session?.user) return null;
+		return betterAuthUserToClivlyUser(session.user);
+	} };
+}
+//#endregion
+export { betterAuthUserToClivlyUser, createBetterAuthAdapter };

package/auth-clerk.cjs

@@ -0,0 +1,34 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _clerk_backend = require("@clerk/backend");
+//#region ../auth-clerk/src/map.ts
+function clerkUserToClivlyUser(user) {
+	const email = (user.emailAddresses?.find((address) => address.id === user.primaryEmailAddressId))?.emailAddress ?? user.emailAddresses?.[0]?.emailAddress;
+	if (!email) return null;
+	const name = [user.firstName, user.lastName].filter(Boolean).join(" ") || void 0;
+	return {
+		id: user.id,
+		email,
+		name
+	};
+}
+//#endregion
+//#region ../auth-clerk/src/index.ts
+/**
+* Clerk → ClivlyAuthAdapter. Resolves the CRM end-user's identity from the host
+* app's Clerk session on each request. Answers "who is this person?" only —
+* CRM authorization lives in the separate `crm_members` layer.
+*/
+function createClerkAuthAdapter(options) {
+	const client = (0, _clerk_backend.createClerkClient)({
+		secretKey: options.secretKey,
+		publishableKey: options.publishableKey
+	});
+	return { async getUser(req) {
+		const auth = (await client.authenticateRequest(req, { authorizedParties: options.authorizedParties })).toAuth();
+		if (!auth?.userId) return null;
+		return clerkUserToClivlyUser(await client.users.getUser(auth.userId));
+	} };
+}
+//#endregion
+exports.clerkUserToClivlyUser = clerkUserToClivlyUser;
+exports.createClerkAuthAdapter = createClerkAuthAdapter;

package/auth-clerk.d.cts

@@ -0,0 +1,32 @@
+import { n as ClivlyUser, t as ClivlyAuthAdapter } from "./auth-adapter-CdLODn2p.cjs";
+
+//#region ../auth-clerk/src/map.d.ts
+interface ClerkLikeUser {
+  emailAddresses?: Array<{
+    id: string;
+    emailAddress: string;
+  }>;
+  firstName?: string | null;
+  id: string;
+  lastName?: string | null;
+  primaryEmailAddressId?: string | null;
+}
+declare function clerkUserToClivlyUser(user: ClerkLikeUser): ClivlyUser | null;
+//#endregion
+//#region ../auth-clerk/src/index.d.ts
+interface ClerkAuthAdapterOptions {
+  /** Origins allowed to make authenticated requests (CSRF protection). */
+  authorizedParties?: string[];
+  /** Clerk publishable key (pk_…) — improves handshake reliability. */
+  publishableKey?: string;
+  /** Clerk secret key (sk_…). */
+  secretKey: string;
+}
+/**
+ * Clerk → ClivlyAuthAdapter. Resolves the CRM end-user's identity from the host
+ * app's Clerk session on each request. Answers "who is this person?" only —
+ * CRM authorization lives in the separate `crm_members` layer.
+ */
+declare function createClerkAuthAdapter(options: ClerkAuthAdapterOptions): ClivlyAuthAdapter;
+//#endregion
+export { ClerkAuthAdapterOptions, type ClerkLikeUser, clerkUserToClivlyUser, createClerkAuthAdapter };

package/auth-clerk.d.mts

@@ -0,0 +1,32 @@
+import { n as ClivlyUser, t as ClivlyAuthAdapter } from "./auth-adapter-CRBW4elj.mjs";
+
+//#region ../auth-clerk/src/map.d.ts
+interface ClerkLikeUser {
+  emailAddresses?: Array<{
+    id: string;
+    emailAddress: string;
+  }>;
+  firstName?: string | null;
+  id: string;
+  lastName?: string | null;
+  primaryEmailAddressId?: string | null;
+}
+declare function clerkUserToClivlyUser(user: ClerkLikeUser): ClivlyUser | null;
+//#endregion
+//#region ../auth-clerk/src/index.d.ts
+interface ClerkAuthAdapterOptions {
+  /** Origins allowed to make authenticated requests (CSRF protection). */
+  authorizedParties?: string[];
+  /** Clerk publishable key (pk_…) — improves handshake reliability. */
+  publishableKey?: string;
+  /** Clerk secret key (sk_…). */
+  secretKey: string;
+}
+/**
+ * Clerk → ClivlyAuthAdapter. Resolves the CRM end-user's identity from the host
+ * app's Clerk session on each request. Answers "who is this person?" only —
+ * CRM authorization lives in the separate `crm_members` layer.
+ */
+declare function createClerkAuthAdapter(options: ClerkAuthAdapterOptions): ClivlyAuthAdapter;
+//#endregion
+export { ClerkAuthAdapterOptions, type ClerkLikeUser, clerkUserToClivlyUser, createClerkAuthAdapter };

package/auth-clerk.mjs

@@ -0,0 +1,32 @@
+import { createClerkClient } from "@clerk/backend";
+//#region ../auth-clerk/src/map.ts
+function clerkUserToClivlyUser(user) {
+	const email = (user.emailAddresses?.find((address) => address.id === user.primaryEmailAddressId))?.emailAddress ?? user.emailAddresses?.[0]?.emailAddress;
+	if (!email) return null;
+	const name = [user.firstName, user.lastName].filter(Boolean).join(" ") || void 0;
+	return {
+		id: user.id,
+		email,
+		name
+	};
+}
+//#endregion
+//#region ../auth-clerk/src/index.ts
+/**
+* Clerk → ClivlyAuthAdapter. Resolves the CRM end-user's identity from the host
+* app's Clerk session on each request. Answers "who is this person?" only —
+* CRM authorization lives in the separate `crm_members` layer.
+*/
+function createClerkAuthAdapter(options) {
+	const client = createClerkClient({
+		secretKey: options.secretKey,
+		publishableKey: options.publishableKey
+	});
+	return { async getUser(req) {
+		const auth = (await client.authenticateRequest(req, { authorizedParties: options.authorizedParties })).toAuth();
+		if (!auth?.userId) return null;
+		return clerkUserToClivlyUser(await client.users.getUser(auth.userId));
+	} };
+}
+//#endregion
+export { clerkUserToClivlyUser, createClerkAuthAdapter };

package/auth-workos.cjs

@@ -0,0 +1,47 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _workos_inc_node = require("@workos-inc/node");
+//#region ../auth-workos/src/map.ts
+function workosUserToClivlyUser(user) {
+	if (!user.email) return null;
+	const name = [user.firstName, user.lastName].filter(Boolean).join(" ") || void 0;
+	return {
+		id: user.id,
+		email: user.email,
+		name
+	};
+}
+function readCookie(req, name) {
+	const header = req.headers.get("cookie");
+	if (!header) return null;
+	for (const part of header.split(";")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		if (part.slice(0, eq).trim() === name) return decodeURIComponent(part.slice(eq + 1).trim());
+	}
+	return null;
+}
+//#endregion
+//#region ../auth-workos/src/index.ts
+const DEFAULT_COOKIE_NAME = "wos-session";
+/**
+* WorkOS → ClivlyAuthAdapter. Unseals the host app's AuthKit session cookie and
+* resolves the CRM end-user's identity. Answers "who is this person?" only —
+* CRM authorization lives in the separate `crm_members` layer.
+*/
+function createWorkOSAuthAdapter(options) {
+	const workos = new _workos_inc_node.WorkOS(options.apiKey, { clientId: options.clientId });
+	const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
+	return { async getUser(req) {
+		const sessionData = readCookie(req, cookieName);
+		if (!sessionData) return null;
+		const result = await workos.userManagement.loadSealedSession({
+			sessionData,
+			cookiePassword: options.cookiePassword
+		}).authenticate();
+		if (!result.authenticated) return null;
+		return workosUserToClivlyUser(result.user);
+	} };
+}
+//#endregion
+exports.createWorkOSAuthAdapter = createWorkOSAuthAdapter;
+exports.workosUserToClivlyUser = workosUserToClivlyUser;

package/auth-workos.d.cts

@@ -0,0 +1,30 @@
+import { n as ClivlyUser, t as ClivlyAuthAdapter } from "./auth-adapter-CdLODn2p.cjs";
+
+//#region ../auth-workos/src/map.d.ts
+interface WorkOSLikeUser {
+  email: string;
+  firstName?: string | null;
+  id: string;
+  lastName?: string | null;
+}
+declare function workosUserToClivlyUser(user: WorkOSLikeUser): ClivlyUser | null;
+//#endregion
+//#region ../auth-workos/src/index.d.ts
+interface WorkOSAuthAdapterOptions {
+  /** WorkOS API key (sk_…). */
+  apiKey: string;
+  /** WorkOS client ID (client_…). */
+  clientId: string;
+  /** Session cookie name. Defaults to `wos-session`. */
+  cookieName?: string;
+  /** Password used to unseal the AuthKit session cookie. */
+  cookiePassword: string;
+}
+/**
+ * WorkOS → ClivlyAuthAdapter. Unseals the host app's AuthKit session cookie and
+ * resolves the CRM end-user's identity. Answers "who is this person?" only —
+ * CRM authorization lives in the separate `crm_members` layer.
+ */
+declare function createWorkOSAuthAdapter(options: WorkOSAuthAdapterOptions): ClivlyAuthAdapter;
+//#endregion
+export { WorkOSAuthAdapterOptions, type WorkOSLikeUser, createWorkOSAuthAdapter, workosUserToClivlyUser };

package/auth-workos.d.mts

@@ -0,0 +1,30 @@
+import { n as ClivlyUser, t as ClivlyAuthAdapter } from "./auth-adapter-CRBW4elj.mjs";
+
+//#region ../auth-workos/src/map.d.ts
+interface WorkOSLikeUser {
+  email: string;
+  firstName?: string | null;
+  id: string;
+  lastName?: string | null;
+}
+declare function workosUserToClivlyUser(user: WorkOSLikeUser): ClivlyUser | null;
+//#endregion
+//#region ../auth-workos/src/index.d.ts
+interface WorkOSAuthAdapterOptions {
+  /** WorkOS API key (sk_…). */
+  apiKey: string;
+  /** WorkOS client ID (client_…). */
+  clientId: string;
+  /** Session cookie name. Defaults to `wos-session`. */
+  cookieName?: string;
+  /** Password used to unseal the AuthKit session cookie. */
+  cookiePassword: string;
+}
+/**
+ * WorkOS → ClivlyAuthAdapter. Unseals the host app's AuthKit session cookie and
+ * resolves the CRM end-user's identity. Answers "who is this person?" only —
+ * CRM authorization lives in the separate `crm_members` layer.
+ */
+declare function createWorkOSAuthAdapter(options: WorkOSAuthAdapterOptions): ClivlyAuthAdapter;
+//#endregion
+export { WorkOSAuthAdapterOptions, type WorkOSLikeUser, createWorkOSAuthAdapter, workosUserToClivlyUser };