convex 1.34.0 → 1.35.0

package/dist/esm/cli/lib/versionApi.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/cli/lib/versionApi.ts"],
-  "sourcesContent": ["import * as Sentry from \"@sentry/node\";\nimport { version } from \"../version.js\";\n\nconst VERSION_ENDPOINT = \"https://version.convex.dev/v1/version\";\nconst GUIDELINES_ENDPOINT = \"https://version.convex.dev/v1/guidelines\";\n\nconst HEADERS: Record<string, string> = {\n  \"Convex-Client\": `npm-cli-${version}`,\n  // Useful telemetry proxy for \"human at a terminal\" vs automated/background execution.\n  \"Convex-Interactive\": process.stdin.isTTY === true ? \"true\" : \"false\",\n};\nif (process.env.CONVEX_AGENT_MODE) {\n  HEADERS[\"Convex-Agent-Mode\"] = process.env.CONVEX_AGENT_MODE;\n}\n\nexport type VersionResult = {\n  message: string | null;\n  guidelinesHash: string | null;\n  agentSkillsSha: string | null;\n  disableSkillsCli: boolean;\n};\n\nexport async function getVersion(): Promise<VersionResult | null> {\n  try {\n    const req = await fetch(VERSION_ENDPOINT, {\n      headers: HEADERS,\n    });\n\n    if (!req.ok) {\n      Sentry.captureException(\n        new Error(`Failed to fetch version: status = ${req.status}`),\n      );\n      return null;\n    }\n\n    const json = await req.json();\n    return validateVersionResult(json);\n  } catch (error) {\n    Sentry.captureException(error);\n    return null;\n  }\n}\n\nexport function validateVersionResult(json: any): VersionResult | null {\n  if (typeof json !== \"object\" || json === null) {\n    Sentry.captureMessage(\"Invalid version result\", \"error\");\n    return null;\n  }\n\n  if (typeof json.message !== \"string\" && json.message !== null) {\n    Sentry.captureMessage(\"Invalid version.message result\", \"error\");\n    return null;\n  }\n\n  // Treat missing optional hashes as null.\n  const agentSkillsSha =\n    typeof json.agentSkillsSha === \"string\" ? json.agentSkillsSha : null;\n\n  const guidelinesHash =\n    typeof json.guidelinesHash === \"string\" ? json.guidelinesHash : null;\n  const disableSkillsCli = json.disableSkillsCli === true;\n\n  return {\n    message: json.message,\n    guidelinesHash,\n    agentSkillsSha,\n    disableSkillsCli,\n  };\n}\n\n/** Fetch the latest agent skills SHA from version.convex.dev. */\nexport async function fetchAgentSkillsSha(): Promise<string | null> {\n  const versionData = await getVersion();\n  return versionData?.agentSkillsSha ?? null;\n}\n\nexport async function downloadGuidelines(): Promise<string | null> {\n  try {\n    const req = await fetch(GUIDELINES_ENDPOINT, { headers: HEADERS });\n\n    if (!req.ok) {\n      Sentry.captureMessage(\n        `Failed to fetch Convex guidelines: status = ${req.status}`,\n      );\n      return null;\n    }\n\n    const text = await req.text();\n    return text;\n  } catch (error) {\n    Sentry.captureException(error);\n    return null;\n  }\n}\n"],
-  "mappings": ";AAAA,YAAY,YAAY;AACxB,SAAS,eAAe;AAExB,MAAM,mBAAmB;AACzB,MAAM,sBAAsB;AAE5B,MAAM,UAAkC;AAAA,EACtC,iBAAiB,WAAW,OAAO;AAAA;AAAA,EAEnC,sBAAsB,QAAQ,MAAM,UAAU,OAAO,SAAS;AAChE;AACA,IAAI,QAAQ,IAAI,mBAAmB;AACjC,UAAQ,mBAAmB,IAAI,QAAQ,IAAI;AAC7C;AASA,sBAAsB,aAA4C;AAChE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,kBAAkB;AAAA,MACxC,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,aAAO;AAAA,QACL,IAAI,MAAM,qCAAqC,IAAI,MAAM,EAAE;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,sBAAsB,IAAI;AAAA,EACnC,SAAS,OAAO;AACd,WAAO,iBAAiB,KAAK;AAC7B,WAAO;AAAA,EACT;AACF;AAEO,gBAAS,sBAAsB,MAAiC;AACrE,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,WAAO,eAAe,0BAA0B,OAAO;AACvD,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,KAAK,YAAY,YAAY,KAAK,YAAY,MAAM;AAC7D,WAAO,eAAe,kCAAkC,OAAO;AAC/D,WAAO;AAAA,EACT;AAGA,QAAM,iBACJ,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB;AAElE,QAAM,iBACJ,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB;AAClE,QAAM,mBAAmB,KAAK,qBAAqB;AAEnD,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAGA,sBAAsB,sBAA8C;AAClE,QAAM,cAAc,MAAM,WAAW;AACrC,SAAO,aAAa,kBAAkB;AACxC;AAEA,sBAAsB,qBAA6C;AACjE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,qBAAqB,EAAE,SAAS,QAAQ,CAAC;AAEjE,QAAI,CAAC,IAAI,IAAI;AACX,aAAO;AAAA,QACL,+CAA+C,IAAI,MAAM;AAAA,MAC3D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,iBAAiB,KAAK;AAC7B,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import * as Sentry from \"@sentry/node\";\nimport { version } from \"../version.js\";\n\nconst VERSION_ENDPOINT = \"https://version.convex.dev/v1/version\";\nconst GUIDELINES_ENDPOINT = \"https://version.convex.dev/v1/guidelines\";\n\nconst HEADERS: Record<string, string> = {\n  \"Convex-Client\": `npm-cli-${version}`,\n  // Useful telemetry proxy for \"human at a terminal\" vs automated/background execution.\n  \"Convex-Interactive\": process.stdin.isTTY === true ? \"true\" : \"false\",\n};\nif (process.env.CONVEX_AGENT_MODE) {\n  HEADERS[\"Convex-Agent-Mode\"] = process.env.CONVEX_AGENT_MODE;\n}\n\nexport type VersionResult = {\n  message: string | null;\n  guidelinesHash: string | null;\n  agentSkillsSha: string | null;\n  disableSkillsCli: boolean;\n};\n\nexport type VersionFetchResult =\n  | { kind: \"ok\"; data: VersionResult }\n  | { kind: \"error\" };\n\nexport async function getVersion(): Promise<VersionFetchResult> {\n  try {\n    const req = await fetch(VERSION_ENDPOINT, {\n      headers: HEADERS,\n    });\n\n    if (!req.ok) {\n      Sentry.captureException(\n        new Error(`Failed to fetch version: status = ${req.status}`),\n      );\n      return { kind: \"error\" };\n    }\n\n    const json = await req.json();\n    const result = validateVersionResult(json);\n\n    if (result === null) return { kind: \"error\" };\n    return { kind: \"ok\", data: result };\n  } catch (error) {\n    Sentry.captureException(error);\n    return { kind: \"error\" };\n  }\n}\n\nexport function validateVersionResult(json: any): VersionResult | null {\n  if (typeof json !== \"object\" || json === null) {\n    Sentry.captureMessage(\"Invalid version result\", \"error\");\n    return null;\n  }\n\n  if (typeof json.message !== \"string\" && json.message !== null) {\n    Sentry.captureMessage(\"Invalid version.message result\", \"error\");\n    return null;\n  }\n\n  // Treat missing optional hashes as null.\n  const agentSkillsSha =\n    typeof json.agentSkillsSha === \"string\" ? json.agentSkillsSha : null;\n\n  const guidelinesHash =\n    typeof json.guidelinesHash === \"string\" ? json.guidelinesHash : null;\n  const disableSkillsCli = json.disableSkillsCli === true;\n\n  return {\n    message: json.message,\n    guidelinesHash,\n    agentSkillsSha,\n    disableSkillsCli,\n  };\n}\n\n/** Fetch the latest agent skills SHA from version.convex.dev. */\nexport async function fetchAgentSkillsSha(): Promise<string | null> {\n  const versionData = await getVersion();\n  if (versionData.kind === \"error\") return null;\n  return versionData.data.agentSkillsSha;\n}\n\nexport async function downloadGuidelines(): Promise<string | null> {\n  try {\n    const req = await fetch(GUIDELINES_ENDPOINT, { headers: HEADERS });\n\n    if (!req.ok) {\n      Sentry.captureMessage(\n        `Failed to fetch Convex guidelines: status = ${req.status}`,\n      );\n      return null;\n    }\n\n    const text = await req.text();\n    return text;\n  } catch (error) {\n    Sentry.captureException(error);\n    return null;\n  }\n}\n"],
+  "mappings": ";AAAA,YAAY,YAAY;AACxB,SAAS,eAAe;AAExB,MAAM,mBAAmB;AACzB,MAAM,sBAAsB;AAE5B,MAAM,UAAkC;AAAA,EACtC,iBAAiB,WAAW,OAAO;AAAA;AAAA,EAEnC,sBAAsB,QAAQ,MAAM,UAAU,OAAO,SAAS;AAChE;AACA,IAAI,QAAQ,IAAI,mBAAmB;AACjC,UAAQ,mBAAmB,IAAI,QAAQ,IAAI;AAC7C;AAaA,sBAAsB,aAA0C;AAC9D,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,kBAAkB;AAAA,MACxC,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,aAAO;AAAA,QACL,IAAI,MAAM,qCAAqC,IAAI,MAAM,EAAE;AAAA,MAC7D;AACA,aAAO,EAAE,MAAM,QAAQ;AAAA,IACzB;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAS,sBAAsB,IAAI;AAEzC,QAAI,WAAW,KAAM,QAAO,EAAE,MAAM,QAAQ;AAC5C,WAAO,EAAE,MAAM,MAAM,MAAM,OAAO;AAAA,EACpC,SAAS,OAAO;AACd,WAAO,iBAAiB,KAAK;AAC7B,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACF;AAEO,gBAAS,sBAAsB,MAAiC;AACrE,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,WAAO,eAAe,0BAA0B,OAAO;AACvD,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,KAAK,YAAY,YAAY,KAAK,YAAY,MAAM;AAC7D,WAAO,eAAe,kCAAkC,OAAO;AAC/D,WAAO;AAAA,EACT;AAGA,QAAM,iBACJ,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB;AAElE,QAAM,iBACJ,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB;AAClE,QAAM,mBAAmB,KAAK,qBAAqB;AAEnD,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAGA,sBAAsB,sBAA8C;AAClE,QAAM,cAAc,MAAM,WAAW;AACrC,MAAI,YAAY,SAAS,QAAS,QAAO;AACzC,SAAO,YAAY,KAAK;AAC1B;AAEA,sBAAsB,qBAA6C;AACjE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,qBAAqB,EAAE,SAAS,QAAQ,CAAC;AAEjE,QAAI,CAAC,IAAI,IAAI;AACX,aAAO;AAAA,QACL,+CAA+C,IAAI,MAAM;AAAA,MAC3D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,iBAAiB,KAAK;AAC7B,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/esm/cli/lib/workos/workos.js

@@ -408,13 +408,11 @@ export async function tryToCreateAssociatedWorkosTeam(ctx, deploymentName, teamI
     deploymentType
   );
   if (!result.success) {
-    const dashboardUrl = deploymentDashboardUrlPage(
-      deploymentName,
-      `/settings/environment-variables?var=WORKOS_CLIENT_ID`
-    );
     logMessage(
-      `To provide your own WorkOS environment credentials instead, set environment variables manually on the dashboard:
-  ${dashboardUrl}`
+      `To provide your own WorkOS environment credentials instead, set environment variables manually:
+
+npx convex env set WORKOS_CLIENT_ID $YOUR_CLIENT_ID_HERE
+npx convex env set WORKOS_API_KEY $YOUR_API_KEY_HERE`
     );
     return "choseNotToAssociatedTeam";
   }

package/dist/esm/cli/lib/workos/workos.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/cli/lib/workos/workos.ts"],
-  "sourcesContent": ["/**\n * Programatic provisioning of WorkOS environments and configuration of these environments.\n *\n * This WorkOS integration is subject to change while in development and may require upgrading the CLI\n * to use in the future.\n */\nimport crypto from \"crypto\";\nimport * as dotenv from \"dotenv\";\nimport { Context } from \"../../../bundler/context.js\";\nimport {\n  changeSpinner,\n  logFinishedStep,\n  logMessage,\n  logOutput,\n  logVerbose,\n  logWarning,\n  showSpinner,\n  stopSpinner,\n} from \"../../../bundler/log.js\";\nimport { getTeamAndProjectSlugForDeployment } from \"../api.js\";\nimport { callUpdateEnvironmentVariables, envGetInDeployment } from \"../env.js\";\nimport { deploymentDashboardUrlPage } from \"../dashboard.js\";\nimport { changedEnvVarFile, suggestedEnvVarNames } from \"../envvars.js\";\nimport { promptOptions, promptYesNo } from \"../utils/prompts.js\";\nimport {\n  createCORSOrigin,\n  createRedirectURI,\n  updateAppHomepageUrl,\n} from \"./environmentApi.js\";\nimport {\n  createAssociatedWorkosTeam,\n  createEnvironmentAndAPIKey,\n  getCandidateEmailsForWorkIntegration,\n  getDeploymentCanProvisionWorkOSEnvironments,\n} from \"./platformApi.js\";\nimport type {\n  AuthKitConfig,\n  AuthKitEnvironmentConfig,\n  AuthKitConfigureSettings,\n  ProjectConfig,\n} from \"../config.js\";\nimport { getAuthKitConfig, readProjectConfig } from \"../config.js\";\n\n// Helper function to query WorkOS environment variables from deployment\nasync function getWorkOSEnvVarsFromDeployment(\n  ctx: Context,\n  deployment: { deploymentUrl: string; adminKey: string },\n): Promise<{\n  clientId: string | null;\n  apiKey: string | null;\n  environmentId: string | null;\n}> {\n  const [clientId, apiKey, environmentId] = await Promise.all([\n    envGetInDeployment(ctx, deployment, \"WORKOS_CLIENT_ID\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_API_KEY\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_ENVIRONMENT_ID\"),\n  ]);\n  return { clientId, apiKey, environmentId };\n}\n\n// Helper to resolve WorkOS credentials from all available sources\nasync function resolveWorkOSCredentials(\n  ctx: Context,\n  deployment: { deploymentUrl: string; adminKey: string },\n  deploymentName: string,\n  authKitConfig: AuthKitConfig,\n  workosDeploymentType: \"dev\" | \"preview\" | \"prod\",\n): Promise<{\n  clientId: string | null;\n  apiKey: string | null;\n  environmentId: string | null;\n  deploymentEnvVars: {\n    clientId: string | null;\n    apiKey: string | null;\n    environmentId: string | null;\n  };\n}> {\n  const deploymentEnvVars = await getWorkOSEnvVarsFromDeployment(\n    ctx,\n    deployment,\n  );\n\n  let clientId: string | null;\n  let apiKey: string | null;\n  let environmentId: string | null;\n\n  if (workosDeploymentType === \"dev\") {\n    // For dev: build environment (.env.local) takes precedence so mismatches\n    // with the deployment are caught by ensureDeploymentHasWorkOSCredentials.\n    clientId =\n      process.env.WORKOS_CLIENT_ID || deploymentEnvVars.clientId || null;\n    apiKey = deploymentEnvVars.apiKey || null;\n    environmentId =\n      process.env.WORKOS_ENVIRONMENT_ID ||\n      deploymentEnvVars.environmentId ||\n      null;\n  } else {\n    // For prod/preview: deployment credentials are authoritative. This avoids\n    // .env.local dev values overriding prod credentials and triggering a\n    // spurious mismatch error during `npx convex deploy`.\n    clientId =\n      deploymentEnvVars.clientId || process.env.WORKOS_CLIENT_ID || null;\n    apiKey = deploymentEnvVars.apiKey || null;\n    environmentId =\n      deploymentEnvVars.environmentId ||\n      process.env.WORKOS_ENVIRONMENT_ID ||\n      null;\n  }\n\n  // 3. If still no credentials, try provisioning (if we have appropriate auth)\n  if (!clientId || !apiKey) {\n    const auth = ctx.bigBrainAuth();\n    const isUsingDeploymentKey = auth?.kind === \"deploymentKey\";\n\n    if (isUsingDeploymentKey) {\n      await ctx.crash({\n        exitCode: 1,\n        errorType: \"fatal\",\n        printedMessage: buildDeploymentKeyError(\n          deploymentName,\n          workosDeploymentType,\n        ),\n      });\n    }\n\n    // We have user auth or project key, try to provision\n    showSpinner(\"Provisioning AuthKit environment...\");\n\n    try {\n      const result = await ensureWorkosEnvironmentProvisioned(\n        ctx,\n        deploymentName,\n        { ...deployment, deploymentNotice: \"\" },\n        authKitConfig,\n        workosDeploymentType,\n      );\n\n      if (result !== \"ready\") {\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: \"Failed to provision WorkOS environment\",\n        });\n      }\n\n      // After provisioning, re-fetch the credentials\n      const provisionedEnvVars = await getWorkOSEnvVarsFromDeployment(\n        ctx,\n        deployment,\n      );\n      clientId = provisionedEnvVars.clientId;\n      apiKey = provisionedEnvVars.apiKey;\n      environmentId = provisionedEnvVars.environmentId;\n\n      if (!clientId || !apiKey) {\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage:\n            \"Failed to retrieve WorkOS credentials after provisioning\",\n        });\n      }\n    } catch (error: any) {\n      if (\n        error.message?.includes(\"permission\") ||\n        error.message?.includes(\"deploy key\") ||\n        error.message?.includes(\"UnexpectedAuthHeaderFormat\")\n      ) {\n        await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage:\n            `Cannot provision WorkOS environment with current authentication.\\n` +\n            `You need to manually set WORKOS_CLIENT_ID and WORKOS_API_KEY\\n` +\n            `environment variables in your build environment or deployment settings.`,\n        });\n      }\n      return await ctx.crash({\n        exitCode: 1,\n        errorType: \"fatal\",\n        printedMessage: `Error provisioning WorkOS environment: ${error.message}`,\n      });\n    }\n  }\n\n  return { clientId, apiKey, environmentId, deploymentEnvVars };\n}\n\n// Helper function to build error message for deployment key restrictions\nfunction buildDeploymentKeyError(\n  deploymentName: string,\n  deploymentType: string,\n): string {\n  const integrationsUrl = deploymentDashboardUrlPage(\n    deploymentName,\n    \"/settings/integrations\",\n  );\n  return (\n    `AuthKit configuration in convex.json requires WorkOS credentials.\\n\\n` +\n    `Checked for credentials in:\\n` +\n    `  1. Build environment variables (WORKOS_CLIENT_ID, WORKOS_API_KEY)\\n` +\n    `  2. Deployment environment variables, see WorkOS integration at ${integrationsUrl}\\n\\n` +\n    `When using a deployment-specific key, you cannot automatically provision WorkOS environments.\\n` +\n    `You must provide these credentials in your build platform (e.g., Vercel, Netlify)\\n` +\n    `or set them in your deployment settings.\\n\\n` +\n    `Alternatively, remove the 'authKit.${deploymentType}' section from convex.json to skip\\n` +\n    `AuthKit configuration.`\n  );\n}\n\n// Helper function to ensure deployment has the correct WorkOS credentials\nasync function ensureDeploymentHasWorkOSCredentials(\n  ctx: Context,\n  deployment: { deploymentUrl: string; adminKey: string },\n  credentials: {\n    clientId: string;\n    apiKey: string;\n    environmentId: string | null;\n  },\n  deploymentEnvVars: {\n    clientId: string | null;\n    apiKey: string | null;\n    environmentId: string | null;\n  },\n): Promise<void> {\n  const mismatches: string[] = [];\n  if (\n    deploymentEnvVars.clientId &&\n    deploymentEnvVars.clientId !== credentials.clientId\n  ) {\n    mismatches.push(\n      `  WORKOS_CLIENT_ID: deployment has '${deploymentEnvVars.clientId}' but we need '${credentials.clientId}'`,\n    );\n  }\n  if (\n    deploymentEnvVars.apiKey &&\n    deploymentEnvVars.apiKey !== credentials.apiKey\n  ) {\n    mismatches.push(\n      `  WORKOS_API_KEY: deployment has different value than what we need`,\n    );\n  }\n  if (\n    deploymentEnvVars.environmentId &&\n    credentials.environmentId &&\n    deploymentEnvVars.environmentId !== credentials.environmentId\n  ) {\n    mismatches.push(\n      `  WORKOS_ENVIRONMENT_ID: deployment has '${deploymentEnvVars.environmentId}' but we need '${credentials.environmentId}'`,\n    );\n  }\n\n  if (mismatches.length > 0) {\n    await ctx.crash({\n      exitCode: 1,\n      errorType: \"fatal\",\n      printedMessage:\n        `WorkOS environment variable mismatch detected!\\n\\n` +\n        `The following environment variables in your Convex deployment don't match what's needed:\\n` +\n        mismatches.join(\"\\n\") +\n        \"\\n\\n\" +\n        `This would cause your auth configuration to use different credentials at runtime than during build.\\n\\n` +\n        `To fix this, remove the conflicting environment variables from your deployment:\\n` +\n        `  npx convex env remove WORKOS_CLIENT_ID\\n` +\n        `  npx convex env remove WORKOS_API_KEY\\n` +\n        `  npx convex env remove WORKOS_ENVIRONMENT_ID\\n\\n` +\n        `Or remove them from the Convex dashboard deployment settings.\\n\\n` +\n        `Then run your deployment command again.`,\n    });\n  }\n  const updates: Array<{ name: string; value: string }> = [];\n  if (!deploymentEnvVars.clientId && credentials.clientId) {\n    updates.push({ name: \"WORKOS_CLIENT_ID\", value: credentials.clientId });\n  }\n  if (!deploymentEnvVars.apiKey && credentials.apiKey) {\n    updates.push({ name: \"WORKOS_API_KEY\", value: credentials.apiKey });\n  }\n  if (!deploymentEnvVars.environmentId && credentials.environmentId) {\n    updates.push({\n      name: \"WORKOS_ENVIRONMENT_ID\",\n      value: credentials.environmentId,\n    });\n  }\n\n  if (updates.length > 0) {\n    changeSpinner(\"Setting WorkOS credentials in deployment...\");\n    await callUpdateEnvironmentVariables(\n      ctx,\n      { ...deployment, deploymentNotice: \"\" },\n      updates,\n    );\n    logVerbose(\n      `WorkOS credentials propagated to deployment: ${updates.map((u) => u.name).join(\", \")}`,\n    );\n  }\n}\n\n/**\n * Ensure the current deployment has the three expected WorkOS environment\n * variables defined with values corresponding to a valid WorkOS deployment.\n *\n * This may involve provisioning a WorkOS deployment or even (in interactive\n * terminals only) prompting to provision a new WorkOS team to be associated\n * with this Convex team.\n */\nexport async function ensureWorkosEnvironmentProvisioned(\n  ctx: Context,\n  deploymentName: string,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n    deploymentNotice: string;\n  },\n  authKitConfig: AuthKitConfig | undefined,\n  deploymentType: \"dev\" | \"preview\" | \"prod\",\n): Promise<\"ready\" | \"choseNotToAssociatedTeam\"> {\n  const envConfig: AuthKitEnvironmentConfig | undefined =\n    authKitConfig?.[deploymentType];\n\n  // If no config, nothing to do\n  if (!envConfig) {\n    return \"choseNotToAssociatedTeam\";\n  }\n\n  showSpinner(\"Checking for associated AuthKit environment...\");\n  const existingEnvVars = await getExistingWorkosEnvVars(ctx, deployment);\n  if (\n    existingEnvVars.clientId &&\n    existingEnvVars.environmentId &&\n    existingEnvVars.apiKey\n  ) {\n    logOutput(\n      \"Deployment already has environment variables for a WorkOS environment configured for AuthKit.\",\n    );\n\n    if (\n      envConfig.localEnvVars !== undefined &&\n      envConfig.localEnvVars !== false\n    ) {\n      await updateEnvLocal(\n        ctx,\n        existingEnvVars.clientId,\n        existingEnvVars.apiKey,\n        existingEnvVars.environmentId,\n        envConfig.localEnvVars,\n      );\n    }\n\n    // Configure WorkOS environment if configured\n    if (envConfig.configure !== undefined && envConfig.configure !== false) {\n      if (!existingEnvVars.apiKey) {\n        // API key missing - warn and skip configuration\n        logWarning(\n          `Skipping WorkOS AuthKit environment configuration: WORKOS_API_KEY is not set.\\n` +\n            `To configure redirect URIs and CORS origins, you need to set this environment variable.\\n` +\n            `You can set it at: ${deployment.deploymentUrl.replace(/\\/$/, \"\")}/settings/environment-variables`,\n        );\n      } else {\n        await updateWorkosEnvironment(\n          ctx,\n          existingEnvVars.apiKey,\n          envConfig.configure,\n          {\n            clientId: existingEnvVars.clientId,\n            apiKey: existingEnvVars.apiKey,\n            environmentId: existingEnvVars.environmentId,\n          },\n        );\n      }\n    }\n\n    logFinishedStep(\"WorkOS AuthKit environment ready\");\n    return \"ready\";\n  }\n\n  // We need to provision an environment via Big Brain\n  const response = await getDeploymentCanProvisionWorkOSEnvironments(\n    ctx,\n    deploymentName,\n  );\n  const { hasAssociatedWorkosTeam, teamId } = response;\n\n  // In case this this becomes a legacy flow that no longer works.\n  if ((response as any).disabled) {\n    return \"choseNotToAssociatedTeam\";\n  }\n\n  if (!hasAssociatedWorkosTeam) {\n    // A WorkOS workspace needs to be created for provisioning to work\n    // We'll offer to create it interactively, or fail in non-interactive mode\n    const result = await tryToCreateAssociatedWorkosTeam(\n      ctx,\n      deploymentName,\n      teamId,\n      deploymentType,\n    );\n    if (result === \"choseNotToAssociatedTeam\") {\n      return \"choseNotToAssociatedTeam\";\n    }\n    result satisfies \"ready\";\n  }\n\n  // Determine WorkOS environment type\n  // Map config's \"development\"/\"staging\"/\"production\" to API's \"production\"/\"nonproduction\"\n  // Default: dev/preview -> nonproduction, prod -> production\n  // Override: use environmentType from config (only allowed in prod)\n  let workosEnvironmentType: \"production\" | \"nonproduction\" | undefined;\n  if (envConfig.environmentType) {\n    // User explicitly set it (only allowed in prod)\n    // Map: \"production\" -> \"production\", everything else -> \"nonproduction\"\n    workosEnvironmentType =\n      envConfig.environmentType === \"production\"\n        ? \"production\"\n        : \"nonproduction\";\n  } else {\n    // Default based on Convex deployment type\n    workosEnvironmentType =\n      deploymentType === \"prod\" ? \"production\" : \"nonproduction\";\n  }\n\n  const environmentResult = await createEnvironmentAndAPIKey(\n    ctx,\n    deploymentName,\n    workosEnvironmentType,\n  );\n\n  if (!environmentResult.success) {\n    if (\n      \"error\" in environmentResult &&\n      environmentResult.error === \"team_not_provisioned\"\n    ) {\n      return await ctx.crash({\n        exitCode: 1,\n        errorType: \"fatal\",\n        printedMessage: `Team unexpectedly has no provisioned WorkOS team: ${environmentResult.message}`,\n      });\n    }\n    // For other error cases\n    const errorMessage =\n      \"message\" in environmentResult\n        ? environmentResult.message\n        : \"Failed to provision WorkOS environment\";\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"fatal\",\n      printedMessage: errorMessage,\n    });\n  }\n\n  const data = environmentResult.data;\n  if (data.newlyProvisioned) {\n    logMessage(\"New AuthKit environment provisioned\");\n  } else {\n    logMessage(\n      \"Using credentials from existing AuthKit environment already created for this deployment\",\n    );\n  }\n\n  changeSpinner(\"Setting WORKOS_* deployment environment variables...\");\n  await setConvexEnvVars(\n    ctx,\n    deployment,\n    data.clientId,\n    data.environmentId,\n    data.apiKey,\n  );\n\n  if (\n    envConfig.localEnvVars !== undefined &&\n    envConfig.localEnvVars !== false\n  ) {\n    showSpinner(\"Updating .env.local with WorkOS configuration\");\n    await updateEnvLocal(\n      ctx,\n      data.clientId,\n      data.apiKey,\n      data.environmentId,\n      envConfig.localEnvVars,\n    );\n  }\n\n  // Configure WorkOS environment if configured\n  if (envConfig.configure !== undefined && envConfig.configure !== false) {\n    await updateWorkosEnvironment(ctx, data.apiKey, envConfig.configure, {\n      clientId: data.clientId,\n      apiKey: data.apiKey,\n      environmentId: data.environmentId,\n    });\n  }\n  logFinishedStep(\"WorkOS AuthKit environment ready\");\n\n  return \"ready\";\n}\n\n/**\n * Interactive flow to provision a WorkOS team for a Convex team.\n * Handles ToS agreement, email selection, and retry logic.\n */\nexport async function provisionWorkosTeamInteractive(\n  ctx: Context,\n  deploymentName: string,\n  teamId: number,\n  deploymentType: \"dev\" | \"preview\" | \"prod\",\n  options: {\n    promptPrefix?: string;\n    promptMessage?: string;\n  } = {},\n): Promise<\n  | { success: true; workosTeamId: string; workosTeamName: string }\n  | { success: false; reason: \"cancelled\" }\n> {\n  const teamInfo = await getTeamAndProjectSlugForDeployment(ctx, {\n    deploymentName,\n  });\n  if (teamInfo === null) {\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"fatal\",\n      printedMessage: `Can't find Convex Cloud team for deployment ${deploymentName}`,\n    });\n  }\n  stopSpinner();\n\n  const defaultPrefix = `A WorkOS team needs to be created for your Convex team \"${teamInfo.teamSlug}\" in order to use AuthKit.\n\nYou and other members of this team will be able to create WorkOS environments for each Convex dev deployment for projects in this team.\n\nBy creating this account you agree to the WorkOS Terms of Service (https://workos.com/legal/terms-of-service) and Privacy Policy (https://workos.com/legal/privacy).\nAlternately, choose no and set WORKOS_CLIENT_ID for an existing WorkOS environment.\n\\n`;\n\n  const defaultMessage = `Create a WorkOS team and enable automatic AuthKit environment provisioning for team \"${teamInfo.teamSlug}\"?`;\n\n  const agree = await promptYesNo(ctx, {\n    prefix: options.promptPrefix ?? defaultPrefix,\n    message: options.promptMessage ?? defaultMessage,\n    nonInteractiveError: `Cannot provision WorkOS AuthKit in non-interactive mode.\n\nA WorkOS workspace needs to be associated with your Convex team to enable automatic environment provisioning.\n\nTo fix this, either:\n1. Run this command in an interactive terminal to set up WorkOS provisioning\n2. Remove the authKit.${deploymentType} section from convex.json and provide your own WorkOS credentials via the dashboard\n3. Set WORKOS_CLIENT_ID and WORKOS_API_KEY environment variables before deploying`,\n  });\n  if (!agree) {\n    logMessage(\"\\nGot it. We won't create your WorkOS account.\");\n    return { success: false, reason: \"cancelled\" };\n  }\n\n  const alreadyTried = new Map<string, string>();\n\n  let email;\n  while (true) {\n    let choice = \"refresh\";\n    while (choice === \"refresh\") {\n      const { availableEmails } =\n        await getCandidateEmailsForWorkIntegration(ctx);\n      choice = await promptOptions<string>(ctx, {\n        message:\n          availableEmails.length === 1\n            ? \"Create a new WorkOS team with this email address?\"\n            : \"Create a new WorkOS team with which email address?\",\n        suffix:\n          availableEmails.length === 0\n            ? \"\\nVisit https://dashboard.convex.dev/profile to add a verified email to use to provision a WorkOS account\"\n            : availableEmails.length === 1\n              ? \"\\nCreate a new WorkOS team with this email address?\"\n              : \"\\nTo use another email address visit https://dashboard.convex.dev/profile to add and verify, then choose 'refresh'\",\n        choices: [\n          ...availableEmails.map((email: string) => ({\n            name: `${email}${alreadyTried.has(email) ? ` (can't create, a WorkOS team already exists with this email)` : \"\"}`,\n            value: email,\n          })),\n          {\n            name: \"refresh (add an email at https://dashboard.convex.dev/profile)\",\n            value: \"refresh\",\n          } as const,\n          {\n            name: \"cancel (do not create a WorkOS account)\",\n            value: \"cancel\",\n          } as const,\n        ],\n      });\n    }\n    if (choice === \"cancel\") {\n      return { success: false, reason: \"cancelled\" };\n    }\n    email = choice;\n\n    const teamResult = await createAssociatedWorkosTeam(ctx, teamId, email);\n\n    if (teamResult.result === \"emailAlreadyUsed\") {\n      logMessage(teamResult.message);\n      alreadyTried.set(email, teamResult.message);\n      continue;\n    }\n    // Success!\n    return {\n      success: true,\n      workosTeamId: teamResult.workosTeamId,\n      workosTeamName: teamResult.workosTeamName,\n    };\n  }\n}\n\nexport async function tryToCreateAssociatedWorkosTeam(\n  ctx: Context,\n  deploymentName: string,\n  teamId: number,\n  deploymentType: \"dev\" | \"preview\" | \"prod\",\n): Promise<\"ready\" | \"choseNotToAssociatedTeam\"> {\n  const result = await provisionWorkosTeamInteractive(\n    ctx,\n    deploymentName,\n    teamId,\n    deploymentType,\n  );\n\n  if (!result.success) {\n    const dashboardUrl = deploymentDashboardUrlPage(\n      deploymentName,\n      `/settings/environment-variables?var=WORKOS_CLIENT_ID`,\n    );\n    logMessage(\n      `To provide your own WorkOS environment credentials instead, set environment variables manually on the dashboard:\\n  ${dashboardUrl}`,\n    );\n    return \"choseNotToAssociatedTeam\";\n  }\n\n  logFinishedStep(\"WorkOS team created successfully\");\n  return \"ready\";\n}\n\n/**\n * Pre-flight check for AuthKit provisioning.\n * Called before building the client bundle to ensure .env.local has correct values.\n * This is the main provisioning path - the error path is kept for backwards compatibility.\n */\n/**\n * Ensures WorkOS AuthKit environment is ready before building.\n *\n * Flow:\n * 1. Get authKit configuration for the deployment type\n * 2. Resolve credentials (build env \u2192 deployment env \u2192 provision via Big Brain)\n * 3. Ensure deployment has the correct credentials\n * 4. Update local .env.local if configured (interactive only)\n * 5. Configure WorkOS environment settings if needed\n */\nexport async function ensureAuthKitProvisionedBeforeBuild(\n  ctx: Context,\n  deploymentName: string,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n  },\n  deploymentType?: \"dev\" | \"preview\" | \"prod\",\n): Promise<void> {\n  // 1. Get configuration\n  const { projectConfig } = await readProjectConfig(ctx);\n  const authKitConfig = await getAuthKitConfig(ctx, projectConfig);\n  if (!authKitConfig) {\n    return;\n  }\n\n  const workosDeploymentType = deploymentType || \"dev\";\n  const envConfig = authKitConfig[workosDeploymentType];\n  if (!envConfig) {\n    return;\n  }\n\n  // 2. Resolve credentials from all sources\n  const { clientId, apiKey, environmentId, deploymentEnvVars } =\n    await resolveWorkOSCredentials(\n      ctx,\n      deployment,\n      deploymentName,\n      authKitConfig,\n      workosDeploymentType,\n    );\n\n  // 3. Ensure deployment has the correct credentials\n  if (clientId && apiKey) {\n    await ensureDeploymentHasWorkOSCredentials(\n      ctx,\n      deployment,\n      { clientId, apiKey, environmentId },\n      deploymentEnvVars,\n    );\n  }\n\n  // 4. Update local environment variables if configured (interactive mode only)\n  if (envConfig.localEnvVars && process.stdin.isTTY && clientId && apiKey) {\n    await updateEnvLocal(\n      ctx,\n      clientId,\n      apiKey,\n      environmentId || \"\",\n      envConfig.localEnvVars,\n    );\n  }\n\n  // 5. Configure WorkOS environment if needed\n  if (envConfig.configure && apiKey) {\n    const configValues: {\n      clientId?: string;\n      apiKey?: string;\n      environmentId?: string;\n    } = {\n      apiKey,\n    };\n    if (clientId) {\n      configValues.clientId = clientId;\n    }\n    if (environmentId) {\n      configValues.environmentId = environmentId;\n    }\n    await updateWorkosEnvironment(\n      ctx,\n      apiKey,\n      envConfig.configure,\n      configValues,\n    );\n  }\n}\n/**\n * Syncs WorkOS configuration and local env vars after a successful push.\n * This is called on every push in dev mode to keep WorkOS settings in sync\n * with changes to convex.json.\n *\n * @returns true if any updates were made, false if config unchanged\n */\nexport async function syncAuthKitConfigAfterPush(\n  ctx: Context,\n  projectConfig: ProjectConfig,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n  },\n): Promise<boolean> {\n  // Get the authKit config (may include generated defaults for templates)\n  const authKitConfig = await getAuthKitConfig(ctx, projectConfig);\n  if (!authKitConfig) {\n    // No authKit config, nothing to sync\n    return false;\n  }\n\n  // We only sync the \"dev\" environment settings during dev mode\n  const devConfig = authKitConfig.dev;\n  if (!devConfig) {\n    return false;\n  }\n\n  // Get existing credentials from deployment\n  const [clientId, apiKey, environmentId] = await Promise.all([\n    envGetInDeployment(ctx, deployment, \"WORKOS_CLIENT_ID\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_API_KEY\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_ENVIRONMENT_ID\"),\n  ]);\n\n  // We need the API key to make WorkOS API calls\n  if (!apiKey) {\n    // Can't update WorkOS without an API key\n    return false;\n  }\n\n  // Update WorkOS environment configuration if specified\n  if (devConfig.configure !== undefined && devConfig.configure !== false) {\n    const provisionedValues: {\n      clientId?: string;\n      apiKey?: string;\n      environmentId?: string;\n    } = {\n      apiKey,\n    };\n    if (clientId) {\n      provisionedValues.clientId = clientId;\n    }\n    if (environmentId) {\n      provisionedValues.environmentId = environmentId;\n    }\n    await updateWorkosEnvironment(\n      ctx,\n      apiKey,\n      devConfig.configure,\n      provisionedValues,\n    );\n  }\n\n  // Note: We don't update .env.local during sync - that only happens during provisioning\n  // to ensure the client bundle build has the correct values\n\n  return true;\n}\n\n// Helpers\n\nasync function updateWorkosEnvironment(\n  ctx: Context,\n  workosApiKey: string,\n  configureSettings: AuthKitConfigureSettings,\n  provisioned?: { clientId?: string; apiKey?: string; environmentId?: string },\n): Promise<void> {\n  const isInteractive = process.stdin.isTTY;\n  const skippedConfigs: string[] = [];\n\n  // Log what we're about to configure\n  const configItems: string[] = [];\n  if (configureSettings.redirectUris?.length) {\n    configItems.push(\n      `${configureSettings.redirectUris.length} redirect URI(s)`,\n    );\n  }\n  if (configureSettings.appHomepageUrl) {\n    configItems.push(`app homepage URL`);\n  }\n  if (configureSettings.corsOrigins?.length) {\n    configItems.push(`${configureSettings.corsOrigins.length} CORS origin(s)`);\n  }\n\n  if (configItems.length > 0) {\n    logVerbose(\n      `Starting WorkOS AuthKit configuration: ${configItems.join(\", \")}`,\n    );\n  } else {\n    logVerbose(`No WorkOS AuthKit configuration settings to apply`);\n    return;\n  }\n\n  // Apply each redirect URI\n  if (configureSettings.redirectUris) {\n    for (const redirectUri of configureSettings.redirectUris) {\n      try {\n        // Resolve template with both env vars and provisioned values\n        const resolvedRedirectUri = resolveTemplate(redirectUri, provisioned);\n        const { modified: redirectUriAdded } = await createRedirectURI(\n          ctx,\n          workosApiKey,\n          resolvedRedirectUri,\n        );\n        if (redirectUriAdded) {\n          changeSpinner(\"Configuring AuthKit redirect URI...\");\n          logMessage(`AuthKit redirect URI added: ${resolvedRedirectUri}`);\n        } else {\n          logVerbose(\n            `AuthKit redirect URI already configured: ${resolvedRedirectUri}`,\n          );\n        }\n      } catch (error: any) {\n        if (\n          isInteractive &&\n          error.message?.includes(\"Cannot resolve template\")\n        ) {\n          // In interactive mode, log warning and continue\n          skippedConfigs.push(\n            `Redirect URI: ${redirectUri} - ${error.message}`,\n          );\n        } else {\n          // In non-interactive mode or for other errors, crash\n          return await ctx.crash({\n            exitCode: 1,\n            errorType: \"fatal\",\n            printedMessage: `Error configuring redirect URI: ${error.message}`,\n          });\n        }\n      }\n    }\n  }\n\n  // Apply app homepage URL (where users are redirected after logout)\n  if (configureSettings.appHomepageUrl) {\n    try {\n      // Resolve template with both env vars and provisioned values\n      const resolvedAppHomepageUrl = resolveTemplate(\n        configureSettings.appHomepageUrl,\n        provisioned,\n      );\n\n      const { modified: appHomepageUrlUpdated } = await updateAppHomepageUrl(\n        ctx,\n        workosApiKey,\n        resolvedAppHomepageUrl,\n      );\n\n      if (appHomepageUrlUpdated) {\n        changeSpinner(\"Configuring AuthKit app homepage URL...\");\n        logMessage(\n          `AuthKit app homepage URL updated: ${resolvedAppHomepageUrl}`,\n        );\n      } else {\n        logVerbose(\n          `AuthKit app homepage URL was not updated (may be invalid for WorkOS or already set)`,\n        );\n      }\n    } catch (error: any) {\n      if (isInteractive && error.message?.includes(\"Cannot resolve template\")) {\n        // In interactive mode, log warning and continue\n        skippedConfigs.push(\n          `App homepage URL: ${configureSettings.appHomepageUrl} - ${error.message}`,\n        );\n      } else {\n        // In non-interactive mode or for other errors, crash\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: `Error configuring app homepage URL: ${error.message}`,\n        });\n      }\n    }\n  } else {\n    logVerbose(`No app homepage URL configured`);\n  }\n\n  // Apply each CORS origin\n  if (configureSettings.corsOrigins) {\n    for (const corsOrigin of configureSettings.corsOrigins) {\n      try {\n        // Resolve template with both env vars and provisioned values\n        const resolvedCorsOrigin = resolveTemplate(corsOrigin, provisioned);\n        const { modified: corsAdded } = await createCORSOrigin(\n          ctx,\n          workosApiKey,\n          resolvedCorsOrigin,\n        );\n        if (corsAdded) {\n          changeSpinner(\"Configuring AuthKit CORS origin...\");\n          logMessage(`AuthKit CORS origin added: ${resolvedCorsOrigin}`);\n        } else {\n          logVerbose(\n            `AuthKit CORS origin already configured: ${resolvedCorsOrigin}`,\n          );\n        }\n      } catch (error: any) {\n        if (\n          isInteractive &&\n          error.message?.includes(\"Cannot resolve template\")\n        ) {\n          // In interactive mode, log warning and continue\n          skippedConfigs.push(`CORS origin: ${corsOrigin} - ${error.message}`);\n        } else {\n          // In non-interactive mode or for other errors, crash\n          return await ctx.crash({\n            exitCode: 1,\n            errorType: \"fatal\",\n            printedMessage: `Error configuring CORS origin: ${error.message}`,\n          });\n        }\n      }\n    }\n  }\n\n  // Log completion summary\n  logVerbose(`WorkOS AuthKit configuration completed`);\n\n  // If we skipped any configurations in interactive mode, let the user know\n  if (skippedConfigs.length > 0) {\n    stopSpinner();\n    logWarning(\n      `Skipped some AuthKit configurations due to missing environment variables:\\n` +\n        skippedConfigs.map((s) => `  - ${s}`).join(\"\\n\"),\n    );\n  }\n}\n\n// Helper to resolve template strings with unified syntax:\n// - ${buildEnv.ENV_VAR} for build-time environment variables\n// - ${authEnv.WORKOS_CLIENT_ID} for provisioned client ID\n// - ${authEnv.WORKOS_API_KEY} for provisioned API key\n// - ${authEnv.WORKOS_ENVIRONMENT_ID} for provisioned environment ID\n/* eslint-disable no-restricted-syntax */\nexport function resolveTemplate(\n  str: string,\n  provisioned?: { clientId?: string; apiKey?: string; environmentId?: string },\n): string {\n  return str.replace(/\\$\\{([^}]+)\\}/g, (match, expression) => {\n    // Handle auth environment values (provisioned WorkOS credentials)\n    if (expression === \"authEnv.WORKOS_CLIENT_ID\") {\n      if (!provisioned?.clientId) {\n        throw new Error(\n          `Cannot resolve template ${match}: WORKOS_CLIENT_ID not available. ` +\n            `Ensure WorkOS environment is provisioned.`,\n        );\n      }\n      return provisioned.clientId;\n    }\n    if (expression === \"authEnv.WORKOS_API_KEY\") {\n      if (!provisioned?.apiKey) {\n        throw new Error(\n          `Cannot resolve template ${match}: WORKOS_API_KEY not available. ` +\n            `Ensure WorkOS environment is provisioned.`,\n        );\n      }\n      return provisioned.apiKey;\n    }\n    if (expression === \"authEnv.WORKOS_ENVIRONMENT_ID\") {\n      if (!provisioned?.environmentId) {\n        throw new Error(\n          `Cannot resolve template ${match}: WORKOS_ENVIRONMENT_ID not available. ` +\n            `Ensure WorkOS environment is provisioned.`,\n        );\n      }\n      return provisioned.environmentId;\n    }\n\n    // Handle build environment variables\n    if (expression.startsWith(\"buildEnv.\")) {\n      const varName = expression.substring(\"buildEnv.\".length);\n      const value = process.env[varName];\n      if (!value) {\n        throw new Error(\n          `Cannot resolve template ${match}: Environment variable ${varName} is not set.`,\n        );\n      }\n      return value;\n    }\n\n    // Unknown template expression - fail loudly\n    throw new Error(\n      `Unknown template expression: ${match}. ` +\n        `Use \\${buildEnv.VAR_NAME} for environment variables or ` +\n        `\\${authEnv.WORKOS_CLIENT_ID/WORKOS_API_KEY} for provisioned values.`,\n    );\n  });\n}\n/* eslint-enable no-restricted-syntax */\n\n// Update .env.local based on configured localEnvVars\nasync function updateEnvLocal(\n  ctx: Context,\n  clientId: string,\n  apiKey: string,\n  environmentId: string,\n  localEnvVarsConfig: Record<string, string>,\n) {\n  const envPath = \".env.local\";\n\n  let existingFileContent = ctx.fs.exists(envPath)\n    ? ctx.fs.readUtf8File(envPath)\n    : null;\n\n  // Build the changes based on localEnvVarsConfig\n  let suggestedChanges: Record<\n    string,\n    {\n      value: string;\n      commentAfterValue?: string;\n      commentOnPreviousLine?: string;\n    }\n  > = {};\n\n  const { detectedFramework } = await suggestedEnvVarNames(ctx);\n\n  // Parse existing .env.local to check what's already there\n  const existingEnvVars = existingFileContent\n    ? dotenv.parse(existingFileContent)\n    : {};\n\n  for (const [envVarName, templateValue] of Object.entries(\n    localEnvVarsConfig,\n  )) {\n    // Check if already set in .env.local\n    if (existingEnvVars[envVarName]) {\n      logVerbose(`Skipping ${envVarName} update - already in .env.local`);\n      continue;\n    }\n\n    // Check if already set in environment (but not from .env.local)\n    if (process.env[envVarName]) {\n      logVerbose(\n        `Skipping ${envVarName} update in .env.local - already set in environment`,\n      );\n      continue;\n    }\n\n    // Use unified template resolution for both syntaxes\n    const resolvedValue = resolveTemplate(templateValue, {\n      clientId,\n      apiKey,\n      environmentId,\n    });\n\n    // Add comment for first WorkOS var if it's a provisioned value\n    if (\n      Object.keys(suggestedChanges).length === 0 &&\n      (templateValue.includes(\"authEnv.WORKOS_CLIENT_ID\") ||\n        templateValue === \"${authEnv.WORKOS_CLIENT_ID}\")\n    ) {\n      suggestedChanges[envVarName] = {\n        value: resolvedValue,\n        commentOnPreviousLine: `# See this environment at ${workosUrl(environmentId, \"/authentication\")}`,\n      };\n    } else {\n      suggestedChanges[envVarName] = { value: resolvedValue };\n    }\n  }\n\n  // Special handling for WORKOS_COOKIE_PASSWORD for Next.js/TanStackStart\n  if (\n    (detectedFramework === \"Next.js\" ||\n      detectedFramework === \"TanStackStart\") &&\n    !process.env[\"WORKOS_COOKIE_PASSWORD\"] && // Don't override environment\n    (!existingFileContent ||\n      !existingFileContent.includes(\"WORKOS_COOKIE_PASSWORD\"))\n  ) {\n    suggestedChanges[\"WORKOS_COOKIE_PASSWORD\"] = {\n      value: crypto.randomBytes(32).toString(\"base64url\"),\n    };\n  }\n\n  for (const [\n    envVarName,\n    { value: envVarValue, commentOnPreviousLine, commentAfterValue },\n  ] of Object.entries(suggestedChanges) as [\n    string,\n    {\n      value: string;\n      commentOnPreviousLine?: string;\n      commentAfterValue?: string;\n    },\n  ][]) {\n    existingFileContent =\n      changedEnvVarFile({\n        existingFileContent,\n        envVarName,\n        envVarValue,\n        commentAfterValue: commentAfterValue ?? null,\n        commentOnPreviousLine: commentOnPreviousLine ?? null,\n      }) || existingFileContent;\n  }\n\n  if (\n    existingFileContent !== null &&\n    Object.keys(suggestedChanges).length > 0\n  ) {\n    ctx.fs.writeUtf8File(envPath, existingFileContent);\n    logMessage(\n      `Updated .env.local with ${Object.keys(suggestedChanges).join(\", \")}`,\n    );\n  }\n}\n\nasync function getExistingWorkosEnvVars(\n  ctx: Context,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n  },\n): Promise<{\n  clientId: string | null;\n  environmentId: string | null;\n  apiKey: string | null;\n}> {\n  const [clientId, environmentId, apiKey] = await Promise.all([\n    envGetInDeployment(ctx, deployment, \"WORKOS_CLIENT_ID\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_ENVIRONMENT_ID\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_API_KEY\"),\n  ]);\n\n  return { clientId, environmentId, apiKey };\n}\n\nasync function setConvexEnvVars(\n  ctx: Context,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n    deploymentNotice: string;\n  },\n  workosClientId: string,\n  workosEnvironmentId: string,\n  workosEnvironmentApiKey: string,\n) {\n  await callUpdateEnvironmentVariables(ctx, deployment, [\n    { name: \"WORKOS_CLIENT_ID\", value: workosClientId },\n    { name: \"WORKOS_ENVIRONMENT_ID\", value: workosEnvironmentId },\n    { name: \"WORKOS_API_KEY\", value: workosEnvironmentApiKey },\n  ]);\n}\n\ntype Subpaths = \"/authentication\" | \"/sessions\" | \"/redirects\" | \"/users\";\nfunction workosUrl(environmentId: string, subpath: Subpaths) {\n  return `https://dashboard.workos.com/${environmentId}${subpath}`;\n}\n"],
-  "mappings": ";AAMA,OAAO,YAAY;AACnB,YAAY,YAAY;AAExB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,gCAAgC,0BAA0B;AACnE,SAAS,kCAAkC;AAC3C,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,eAAe,mBAAmB;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP,SAAS,kBAAkB,yBAAyB;AAGpD,eAAe,+BACb,KACA,YAKC;AACD,QAAM,CAAC,UAAU,QAAQ,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1D,mBAAmB,KAAK,YAAY,kBAAkB;AAAA,IACtD,mBAAmB,KAAK,YAAY,gBAAgB;AAAA,IACpD,mBAAmB,KAAK,YAAY,uBAAuB;AAAA,EAC7D,CAAC;AACD,SAAO,EAAE,UAAU,QAAQ,cAAc;AAC3C;AAGA,eAAe,yBACb,KACA,YACA,gBACA,eACA,sBAUC;AACD,QAAM,oBAAoB,MAAM;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI,yBAAyB,OAAO;AAGlC,eACE,QAAQ,IAAI,oBAAoB,kBAAkB,YAAY;AAChE,aAAS,kBAAkB,UAAU;AACrC,oBACE,QAAQ,IAAI,yBACZ,kBAAkB,iBAClB;AAAA,EACJ,OAAO;AAIL,eACE,kBAAkB,YAAY,QAAQ,IAAI,oBAAoB;AAChE,aAAS,kBAAkB,UAAU;AACrC,oBACE,kBAAkB,iBAClB,QAAQ,IAAI,yBACZ;AAAA,EACJ;AAGA,MAAI,CAAC,YAAY,CAAC,QAAQ;AACxB,UAAM,OAAO,IAAI,aAAa;AAC9B,UAAM,uBAAuB,MAAM,SAAS;AAE5C,QAAI,sBAAsB;AACxB,YAAM,IAAI,MAAM;AAAA,QACd,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB;AAAA,UACd;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAGA,gBAAY,qCAAqC;AAEjD,QAAI;AACF,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,EAAE,GAAG,YAAY,kBAAkB,GAAG;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAEA,UAAI,WAAW,SAAS;AACtB,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AAGA,YAAM,qBAAqB,MAAM;AAAA,QAC/B;AAAA,QACA;AAAA,MACF;AACA,iBAAW,mBAAmB;AAC9B,eAAS,mBAAmB;AAC5B,sBAAgB,mBAAmB;AAEnC,UAAI,CAAC,YAAY,CAAC,QAAQ;AACxB,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAY;AACnB,UACE,MAAM,SAAS,SAAS,YAAY,KACpC,MAAM,SAAS,SAAS,YAAY,KACpC,MAAM,SAAS,SAAS,4BAA4B,GACpD;AACA,cAAM,IAAI,MAAM;AAAA,UACd,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBACE;AAAA;AAAA;AAAA,QAGJ,CAAC;AAAA,MACH;AACA,aAAO,MAAM,IAAI,MAAM;AAAA,QACrB,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB,0CAA0C,MAAM,OAAO;AAAA,MACzE,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,QAAQ,eAAe,kBAAkB;AAC9D;AAGA,SAAS,wBACP,gBACA,gBACQ;AACR,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,SACE;AAAA;AAAA;AAAA;AAAA,mEAGoE,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAI7C,cAAc;AAAA;AAGxD;AAGA,eAAe,qCACb,KACA,YACA,aAKA,mBAKe;AACf,QAAM,aAAuB,CAAC;AAC9B,MACE,kBAAkB,YAClB,kBAAkB,aAAa,YAAY,UAC3C;AACA,eAAW;AAAA,MACT,uCAAuC,kBAAkB,QAAQ,kBAAkB,YAAY,QAAQ;AAAA,IACzG;AAAA,EACF;AACA,MACE,kBAAkB,UAClB,kBAAkB,WAAW,YAAY,QACzC;AACA,eAAW;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,MACE,kBAAkB,iBAClB,YAAY,iBACZ,kBAAkB,kBAAkB,YAAY,eAChD;AACA,eAAW;AAAA,MACT,4CAA4C,kBAAkB,aAAa,kBAAkB,YAAY,aAAa;AAAA,IACxH;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAI,MAAM;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBACE;AAAA;AAAA;AAAA,IAEA,WAAW,KAAK,IAAI,IACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQJ,CAAC;AAAA,EACH;AACA,QAAM,UAAkD,CAAC;AACzD,MAAI,CAAC,kBAAkB,YAAY,YAAY,UAAU;AACvD,YAAQ,KAAK,EAAE,MAAM,oBAAoB,OAAO,YAAY,SAAS,CAAC;AAAA,EACxE;AACA,MAAI,CAAC,kBAAkB,UAAU,YAAY,QAAQ;AACnD,YAAQ,KAAK,EAAE,MAAM,kBAAkB,OAAO,YAAY,OAAO,CAAC;AAAA,EACpE;AACA,MAAI,CAAC,kBAAkB,iBAAiB,YAAY,eAAe;AACjE,YAAQ,KAAK;AAAA,MACX,MAAM;AAAA,MACN,OAAO,YAAY;AAAA,IACrB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,SAAS,GAAG;AACtB,kBAAc,6CAA6C;AAC3D,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,GAAG,YAAY,kBAAkB,GAAG;AAAA,MACtC;AAAA,IACF;AACA;AAAA,MACE,gDAAgD,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,IACvF;AAAA,EACF;AACF;AAUA,sBAAsB,mCACpB,KACA,gBACA,YAKA,eACA,gBAC+C;AAC/C,QAAM,YACJ,gBAAgB,cAAc;AAGhC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,cAAY,gDAAgD;AAC5D,QAAM,kBAAkB,MAAM,yBAAyB,KAAK,UAAU;AACtE,MACE,gBAAgB,YAChB,gBAAgB,iBAChB,gBAAgB,QAChB;AACA;AAAA,MACE;AAAA,IACF;AAEA,QACE,UAAU,iBAAiB,UAC3B,UAAU,iBAAiB,OAC3B;AACA,YAAM;AAAA,QACJ;AAAA,QACA,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,UAAU;AAAA,MACZ;AAAA,IACF;AAGA,QAAI,UAAU,cAAc,UAAa,UAAU,cAAc,OAAO;AACtE,UAAI,CAAC,gBAAgB,QAAQ;AAE3B;AAAA,UACE;AAAA;AAAA,qBAEwB,WAAW,cAAc,QAAQ,OAAO,EAAE,CAAC;AAAA,QACrE;AAAA,MACF,OAAO;AACL,cAAM;AAAA,UACJ;AAAA,UACA,gBAAgB;AAAA,UAChB,UAAU;AAAA,UACV;AAAA,YACE,UAAU,gBAAgB;AAAA,YAC1B,QAAQ,gBAAgB;AAAA,YACxB,eAAe,gBAAgB;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,oBAAgB,kCAAkC;AAClD,WAAO;AAAA,EACT;AAGA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,EACF;AACA,QAAM,EAAE,yBAAyB,OAAO,IAAI;AAG5C,MAAK,SAAiB,UAAU;AAC9B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,yBAAyB;AAG5B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,WAAW,4BAA4B;AACzC,aAAO;AAAA,IACT;AACA;AAAA,EACF;AAMA,MAAI;AACJ,MAAI,UAAU,iBAAiB;AAG7B,4BACE,UAAU,oBAAoB,eAC1B,eACA;AAAA,EACR,OAAO;AAEL,4BACE,mBAAmB,SAAS,eAAe;AAAA,EAC/C;AAEA,QAAM,oBAAoB,MAAM;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,kBAAkB,SAAS;AAC9B,QACE,WAAW,qBACX,kBAAkB,UAAU,wBAC5B;AACA,aAAO,MAAM,IAAI,MAAM;AAAA,QACrB,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB,qDAAqD,kBAAkB,OAAO;AAAA,MAChG,CAAC;AAAA,IACH;AAEA,UAAM,eACJ,aAAa,oBACT,kBAAkB,UAClB;AACN,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,kBAAkB;AAC/B,MAAI,KAAK,kBAAkB;AACzB,eAAW,qCAAqC;AAAA,EAClD,OAAO;AACL;AAAA,MACE;AAAA,IACF;AAAA,EACF;AAEA,gBAAc,sDAAsD;AACpE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAEA,MACE,UAAU,iBAAiB,UAC3B,UAAU,iBAAiB,OAC3B;AACA,gBAAY,+CAA+C;AAC3D,UAAM;AAAA,MACJ;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,EACF;AAGA,MAAI,UAAU,cAAc,UAAa,UAAU,cAAc,OAAO;AACtE,UAAM,wBAAwB,KAAK,KAAK,QAAQ,UAAU,WAAW;AAAA,MACnE,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,MACb,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AACA,kBAAgB,kCAAkC;AAElD,SAAO;AACT;AAMA,sBAAsB,+BACpB,KACA,gBACA,QACA,gBACA,UAGI,CAAC,GAIL;AACA,QAAM,WAAW,MAAM,mCAAmC,KAAK;AAAA,IAC7D;AAAA,EACF,CAAC;AACD,MAAI,aAAa,MAAM;AACrB,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,+CAA+C,cAAc;AAAA,IAC/E,CAAC;AAAA,EACH;AACA,cAAY;AAEZ,QAAM,gBAAgB,2DAA2D,SAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQlG,QAAM,iBAAiB,wFAAwF,SAAS,QAAQ;AAEhI,QAAM,QAAQ,MAAM,YAAY,KAAK;AAAA,IACnC,QAAQ,QAAQ,gBAAgB;AAAA,IAChC,SAAS,QAAQ,iBAAiB;AAAA,IAClC,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAMD,cAAc;AAAA;AAAA,EAEpC,CAAC;AACD,MAAI,CAAC,OAAO;AACV,eAAW,gDAAgD;AAC3D,WAAO,EAAE,SAAS,OAAO,QAAQ,YAAY;AAAA,EAC/C;AAEA,QAAM,eAAe,oBAAI,IAAoB;AAE7C,MAAI;AACJ,SAAO,MAAM;AACX,QAAI,SAAS;AACb,WAAO,WAAW,WAAW;AAC3B,YAAM,EAAE,gBAAgB,IACtB,MAAM,qCAAqC,GAAG;AAChD,eAAS,MAAM,cAAsB,KAAK;AAAA,QACxC,SACE,gBAAgB,WAAW,IACvB,sDACA;AAAA,QACN,QACE,gBAAgB,WAAW,IACvB,8GACA,gBAAgB,WAAW,IACzB,wDACA;AAAA,QACR,SAAS;AAAA,UACP,GAAG,gBAAgB,IAAI,CAACA,YAAmB;AAAA,YACzC,MAAM,GAAGA,MAAK,GAAG,aAAa,IAAIA,MAAK,IAAI,kEAAkE,EAAE;AAAA,YAC/G,OAAOA;AAAA,UACT,EAAE;AAAA,UACF;AAAA,YACE,MAAM;AAAA,YACN,OAAO;AAAA,UACT;AAAA,UACA;AAAA,YACE,MAAM;AAAA,YACN,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,WAAW,UAAU;AACvB,aAAO,EAAE,SAAS,OAAO,QAAQ,YAAY;AAAA,IAC/C;AACA,YAAQ;AAER,UAAM,aAAa,MAAM,2BAA2B,KAAK,QAAQ,KAAK;AAEtE,QAAI,WAAW,WAAW,oBAAoB;AAC5C,iBAAW,WAAW,OAAO;AAC7B,mBAAa,IAAI,OAAO,WAAW,OAAO;AAC1C;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,cAAc,WAAW;AAAA,MACzB,gBAAgB,WAAW;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,sBAAsB,gCACpB,KACA,gBACA,QACA,gBAC+C;AAC/C,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,eAAe;AAAA,MACnB;AAAA,MACA;AAAA,IACF;AACA;AAAA,MACE;AAAA,IAAuH,YAAY;AAAA,IACrI;AACA,WAAO;AAAA,EACT;AAEA,kBAAgB,kCAAkC;AAClD,SAAO;AACT;AAiBA,sBAAsB,oCACpB,KACA,gBACA,YAIA,gBACe;AAEf,QAAM,EAAE,cAAc,IAAI,MAAM,kBAAkB,GAAG;AACrD,QAAM,gBAAgB,MAAM,iBAAiB,KAAK,aAAa;AAC/D,MAAI,CAAC,eAAe;AAClB;AAAA,EACF;AAEA,QAAM,uBAAuB,kBAAkB;AAC/C,QAAM,YAAY,cAAc,oBAAoB;AACpD,MAAI,CAAC,WAAW;AACd;AAAA,EACF;AAGA,QAAM,EAAE,UAAU,QAAQ,eAAe,kBAAkB,IACzD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGF,MAAI,YAAY,QAAQ;AACtB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,EAAE,UAAU,QAAQ,cAAc;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAGA,MAAI,UAAU,gBAAgB,QAAQ,MAAM,SAAS,YAAY,QAAQ;AACvE,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB;AAAA,MACjB,UAAU;AAAA,IACZ;AAAA,EACF;AAGA,MAAI,UAAU,aAAa,QAAQ;AACjC,UAAM,eAIF;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAU;AACZ,mBAAa,WAAW;AAAA,IAC1B;AACA,QAAI,eAAe;AACjB,mBAAa,gBAAgB;AAAA,IAC/B;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAQA,sBAAsB,2BACpB,KACA,eACA,YAIkB;AAElB,QAAM,gBAAgB,MAAM,iBAAiB,KAAK,aAAa;AAC/D,MAAI,CAAC,eAAe;AAElB,WAAO;AAAA,EACT;AAGA,QAAM,YAAY,cAAc;AAChC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAGA,QAAM,CAAC,UAAU,QAAQ,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1D,mBAAmB,KAAK,YAAY,kBAAkB;AAAA,IACtD,mBAAmB,KAAK,YAAY,gBAAgB;AAAA,IACpD,mBAAmB,KAAK,YAAY,uBAAuB;AAAA,EAC7D,CAAC;AAGD,MAAI,CAAC,QAAQ;AAEX,WAAO;AAAA,EACT;AAGA,MAAI,UAAU,cAAc,UAAa,UAAU,cAAc,OAAO;AACtE,UAAM,oBAIF;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAU;AACZ,wBAAkB,WAAW;AAAA,IAC/B;AACA,QAAI,eAAe;AACjB,wBAAkB,gBAAgB;AAAA,IACpC;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAKA,SAAO;AACT;AAIA,eAAe,wBACb,KACA,cACA,mBACA,aACe;AACf,QAAM,gBAAgB,QAAQ,MAAM;AACpC,QAAM,iBAA2B,CAAC;AAGlC,QAAM,cAAwB,CAAC;AAC/B,MAAI,kBAAkB,cAAc,QAAQ;AAC1C,gBAAY;AAAA,MACV,GAAG,kBAAkB,aAAa,MAAM;AAAA,IAC1C;AAAA,EACF;AACA,MAAI,kBAAkB,gBAAgB;AACpC,gBAAY,KAAK,kBAAkB;AAAA,EACrC;AACA,MAAI,kBAAkB,aAAa,QAAQ;AACzC,gBAAY,KAAK,GAAG,kBAAkB,YAAY,MAAM,iBAAiB;AAAA,EAC3E;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B;AAAA,MACE,0CAA0C,YAAY,KAAK,IAAI,CAAC;AAAA,IAClE;AAAA,EACF,OAAO;AACL,eAAW,mDAAmD;AAC9D;AAAA,EACF;AAGA,MAAI,kBAAkB,cAAc;AAClC,eAAW,eAAe,kBAAkB,cAAc;AACxD,UAAI;AAEF,cAAM,sBAAsB,gBAAgB,aAAa,WAAW;AACpE,cAAM,EAAE,UAAU,iBAAiB,IAAI,MAAM;AAAA,UAC3C;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,kBAAkB;AACpB,wBAAc,qCAAqC;AACnD,qBAAW,+BAA+B,mBAAmB,EAAE;AAAA,QACjE,OAAO;AACL;AAAA,YACE,4CAA4C,mBAAmB;AAAA,UACjE;AAAA,QACF;AAAA,MACF,SAAS,OAAY;AACnB,YACE,iBACA,MAAM,SAAS,SAAS,yBAAyB,GACjD;AAEA,yBAAe;AAAA,YACb,iBAAiB,WAAW,MAAM,MAAM,OAAO;AAAA,UACjD;AAAA,QACF,OAAO;AAEL,iBAAO,MAAM,IAAI,MAAM;AAAA,YACrB,UAAU;AAAA,YACV,WAAW;AAAA,YACX,gBAAgB,mCAAmC,MAAM,OAAO;AAAA,UAClE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,kBAAkB,gBAAgB;AACpC,QAAI;AAEF,YAAM,yBAAyB;AAAA,QAC7B,kBAAkB;AAAA,QAClB;AAAA,MACF;AAEA,YAAM,EAAE,UAAU,sBAAsB,IAAI,MAAM;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,UAAI,uBAAuB;AACzB,sBAAc,yCAAyC;AACvD;AAAA,UACE,qCAAqC,sBAAsB;AAAA,QAC7D;AAAA,MACF,OAAO;AACL;AAAA,UACE;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAY;AACnB,UAAI,iBAAiB,MAAM,SAAS,SAAS,yBAAyB,GAAG;AAEvE,uBAAe;AAAA,UACb,qBAAqB,kBAAkB,cAAc,MAAM,MAAM,OAAO;AAAA,QAC1E;AAAA,MACF,OAAO;AAEL,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB,uCAAuC,MAAM,OAAO;AAAA,QACtE,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,OAAO;AACL,eAAW,gCAAgC;AAAA,EAC7C;AAGA,MAAI,kBAAkB,aAAa;AACjC,eAAW,cAAc,kBAAkB,aAAa;AACtD,UAAI;AAEF,cAAM,qBAAqB,gBAAgB,YAAY,WAAW;AAClE,cAAM,EAAE,UAAU,UAAU,IAAI,MAAM;AAAA,UACpC;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,WAAW;AACb,wBAAc,oCAAoC;AAClD,qBAAW,8BAA8B,kBAAkB,EAAE;AAAA,QAC/D,OAAO;AACL;AAAA,YACE,2CAA2C,kBAAkB;AAAA,UAC/D;AAAA,QACF;AAAA,MACF,SAAS,OAAY;AACnB,YACE,iBACA,MAAM,SAAS,SAAS,yBAAyB,GACjD;AAEA,yBAAe,KAAK,gBAAgB,UAAU,MAAM,MAAM,OAAO,EAAE;AAAA,QACrE,OAAO;AAEL,iBAAO,MAAM,IAAI,MAAM;AAAA,YACrB,UAAU;AAAA,YACV,WAAW;AAAA,YACX,gBAAgB,kCAAkC,MAAM,OAAO;AAAA,UACjE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,aAAW,wCAAwC;AAGnD,MAAI,eAAe,SAAS,GAAG;AAC7B,gBAAY;AACZ;AAAA,MACE;AAAA,IACE,eAAe,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AAAA,IACnD;AAAA,EACF;AACF;AAQO,gBAAS,gBACd,KACA,aACQ;AACR,SAAO,IAAI,QAAQ,kBAAkB,CAAC,OAAO,eAAe;AAE1D,QAAI,eAAe,4BAA4B;AAC7C,UAAI,CAAC,aAAa,UAAU;AAC1B,cAAM,IAAI;AAAA,UACR,2BAA2B,KAAK;AAAA,QAElC;AAAA,MACF;AACA,aAAO,YAAY;AAAA,IACrB;AACA,QAAI,eAAe,0BAA0B;AAC3C,UAAI,CAAC,aAAa,QAAQ;AACxB,cAAM,IAAI;AAAA,UACR,2BAA2B,KAAK;AAAA,QAElC;AAAA,MACF;AACA,aAAO,YAAY;AAAA,IACrB;AACA,QAAI,eAAe,iCAAiC;AAClD,UAAI,CAAC,aAAa,eAAe;AAC/B,cAAM,IAAI;AAAA,UACR,2BAA2B,KAAK;AAAA,QAElC;AAAA,MACF;AACA,aAAO,YAAY;AAAA,IACrB;AAGA,QAAI,WAAW,WAAW,WAAW,GAAG;AACtC,YAAM,UAAU,WAAW,UAAU,YAAY,MAAM;AACvD,YAAM,QAAQ,QAAQ,IAAI,OAAO;AACjC,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,2BAA2B,KAAK,0BAA0B,OAAO;AAAA,QACnE;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAGA,UAAM,IAAI;AAAA,MACR,gCAAgC,KAAK;AAAA,IAGvC;AAAA,EACF,CAAC;AACH;AAIA,eAAe,eACb,KACA,UACA,QACA,eACA,oBACA;AACA,QAAM,UAAU;AAEhB,MAAI,sBAAsB,IAAI,GAAG,OAAO,OAAO,IAC3C,IAAI,GAAG,aAAa,OAAO,IAC3B;AAGJ,MAAI,mBAOA,CAAC;AAEL,QAAM,EAAE,kBAAkB,IAAI,MAAM,qBAAqB,GAAG;AAG5D,QAAM,kBAAkB,sBACpB,OAAO,MAAM,mBAAmB,IAChC,CAAC;AAEL,aAAW,CAAC,YAAY,aAAa,KAAK,OAAO;AAAA,IAC/C;AAAA,EACF,GAAG;AAED,QAAI,gBAAgB,UAAU,GAAG;AAC/B,iBAAW,YAAY,UAAU,iCAAiC;AAClE;AAAA,IACF;AAGA,QAAI,QAAQ,IAAI,UAAU,GAAG;AAC3B;AAAA,QACE,YAAY,UAAU;AAAA,MACxB;AACA;AAAA,IACF;AAGA,UAAM,gBAAgB,gBAAgB,eAAe;AAAA,MACnD;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAGD,QACE,OAAO,KAAK,gBAAgB,EAAE,WAAW,MACxC,cAAc,SAAS,0BAA0B,KAChD,kBAAkB,gCACpB;AACA,uBAAiB,UAAU,IAAI;AAAA,QAC7B,OAAO;AAAA,QACP,uBAAuB,6BAA6B,UAAU,eAAe,iBAAiB,CAAC;AAAA,MACjG;AAAA,IACF,OAAO;AACL,uBAAiB,UAAU,IAAI,EAAE,OAAO,cAAc;AAAA,IACxD;AAAA,EACF;AAGA,OACG,sBAAsB,aACrB,sBAAsB,oBACxB,CAAC,QAAQ,IAAI,wBAAwB;AAAA,GACpC,CAAC,uBACA,CAAC,oBAAoB,SAAS,wBAAwB,IACxD;AACA,qBAAiB,wBAAwB,IAAI;AAAA,MAC3C,OAAO,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,IACpD;AAAA,EACF;AAEA,aAAW;AAAA,IACT;AAAA,IACA,EAAE,OAAO,aAAa,uBAAuB,kBAAkB;AAAA,EACjE,KAAK,OAAO,QAAQ,gBAAgB,GAO/B;AACH,0BACE,kBAAkB;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB,qBAAqB;AAAA,MACxC,uBAAuB,yBAAyB;AAAA,IAClD,CAAC,KAAK;AAAA,EACV;AAEA,MACE,wBAAwB,QACxB,OAAO,KAAK,gBAAgB,EAAE,SAAS,GACvC;AACA,QAAI,GAAG,cAAc,SAAS,mBAAmB;AACjD;AAAA,MACE,2BAA2B,OAAO,KAAK,gBAAgB,EAAE,KAAK,IAAI,CAAC;AAAA,IACrE;AAAA,EACF;AACF;AAEA,eAAe,yBACb,KACA,YAQC;AACD,QAAM,CAAC,UAAU,eAAe,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1D,mBAAmB,KAAK,YAAY,kBAAkB;AAAA,IACtD,mBAAmB,KAAK,YAAY,uBAAuB;AAAA,IAC3D,mBAAmB,KAAK,YAAY,gBAAgB;AAAA,EACtD,CAAC;AAED,SAAO,EAAE,UAAU,eAAe,OAAO;AAC3C;AAEA,eAAe,iBACb,KACA,YAKA,gBACA,qBACA,yBACA;AACA,QAAM,+BAA+B,KAAK,YAAY;AAAA,IACpD,EAAE,MAAM,oBAAoB,OAAO,eAAe;AAAA,IAClD,EAAE,MAAM,yBAAyB,OAAO,oBAAoB;AAAA,IAC5D,EAAE,MAAM,kBAAkB,OAAO,wBAAwB;AAAA,EAC3D,CAAC;AACH;AAGA,SAAS,UAAU,eAAuB,SAAmB;AAC3D,SAAO,gCAAgC,aAAa,GAAG,OAAO;AAChE;",
+  "sourcesContent": ["/**\n * Programatic provisioning of WorkOS environments and configuration of these environments.\n *\n * This WorkOS integration is subject to change while in development and may require upgrading the CLI\n * to use in the future.\n */\nimport crypto from \"crypto\";\nimport * as dotenv from \"dotenv\";\nimport { Context } from \"../../../bundler/context.js\";\nimport {\n  changeSpinner,\n  logFinishedStep,\n  logMessage,\n  logOutput,\n  logVerbose,\n  logWarning,\n  showSpinner,\n  stopSpinner,\n} from \"../../../bundler/log.js\";\nimport { getTeamAndProjectSlugForDeployment } from \"../api.js\";\nimport { callUpdateEnvironmentVariables, envGetInDeployment } from \"../env.js\";\nimport { deploymentDashboardUrlPage } from \"../dashboard.js\";\nimport { changedEnvVarFile, suggestedEnvVarNames } from \"../envvars.js\";\nimport { promptOptions, promptYesNo } from \"../utils/prompts.js\";\nimport {\n  createCORSOrigin,\n  createRedirectURI,\n  updateAppHomepageUrl,\n} from \"./environmentApi.js\";\nimport {\n  createAssociatedWorkosTeam,\n  createEnvironmentAndAPIKey,\n  getCandidateEmailsForWorkIntegration,\n  getDeploymentCanProvisionWorkOSEnvironments,\n} from \"./platformApi.js\";\nimport type {\n  AuthKitConfig,\n  AuthKitEnvironmentConfig,\n  AuthKitConfigureSettings,\n  ProjectConfig,\n} from \"../config.js\";\nimport { getAuthKitConfig, readProjectConfig } from \"../config.js\";\n\n// Helper function to query WorkOS environment variables from deployment\nasync function getWorkOSEnvVarsFromDeployment(\n  ctx: Context,\n  deployment: { deploymentUrl: string; adminKey: string },\n): Promise<{\n  clientId: string | null;\n  apiKey: string | null;\n  environmentId: string | null;\n}> {\n  const [clientId, apiKey, environmentId] = await Promise.all([\n    envGetInDeployment(ctx, deployment, \"WORKOS_CLIENT_ID\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_API_KEY\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_ENVIRONMENT_ID\"),\n  ]);\n  return { clientId, apiKey, environmentId };\n}\n\n// Helper to resolve WorkOS credentials from all available sources\nasync function resolveWorkOSCredentials(\n  ctx: Context,\n  deployment: { deploymentUrl: string; adminKey: string },\n  deploymentName: string,\n  authKitConfig: AuthKitConfig,\n  workosDeploymentType: \"dev\" | \"preview\" | \"prod\",\n): Promise<{\n  clientId: string | null;\n  apiKey: string | null;\n  environmentId: string | null;\n  deploymentEnvVars: {\n    clientId: string | null;\n    apiKey: string | null;\n    environmentId: string | null;\n  };\n}> {\n  const deploymentEnvVars = await getWorkOSEnvVarsFromDeployment(\n    ctx,\n    deployment,\n  );\n\n  let clientId: string | null;\n  let apiKey: string | null;\n  let environmentId: string | null;\n\n  if (workosDeploymentType === \"dev\") {\n    // For dev: build environment (.env.local) takes precedence so mismatches\n    // with the deployment are caught by ensureDeploymentHasWorkOSCredentials.\n    clientId =\n      process.env.WORKOS_CLIENT_ID || deploymentEnvVars.clientId || null;\n    apiKey = deploymentEnvVars.apiKey || null;\n    environmentId =\n      process.env.WORKOS_ENVIRONMENT_ID ||\n      deploymentEnvVars.environmentId ||\n      null;\n  } else {\n    // For prod/preview: deployment credentials are authoritative. This avoids\n    // .env.local dev values overriding prod credentials and triggering a\n    // spurious mismatch error during `npx convex deploy`.\n    clientId =\n      deploymentEnvVars.clientId || process.env.WORKOS_CLIENT_ID || null;\n    apiKey = deploymentEnvVars.apiKey || null;\n    environmentId =\n      deploymentEnvVars.environmentId ||\n      process.env.WORKOS_ENVIRONMENT_ID ||\n      null;\n  }\n\n  // 3. If still no credentials, try provisioning (if we have appropriate auth)\n  if (!clientId || !apiKey) {\n    const auth = ctx.bigBrainAuth();\n    const isUsingDeploymentKey = auth?.kind === \"deploymentKey\";\n\n    if (isUsingDeploymentKey) {\n      await ctx.crash({\n        exitCode: 1,\n        errorType: \"fatal\",\n        printedMessage: buildDeploymentKeyError(\n          deploymentName,\n          workosDeploymentType,\n        ),\n      });\n    }\n\n    // We have user auth or project key, try to provision\n    showSpinner(\"Provisioning AuthKit environment...\");\n\n    try {\n      const result = await ensureWorkosEnvironmentProvisioned(\n        ctx,\n        deploymentName,\n        { ...deployment, deploymentNotice: \"\" },\n        authKitConfig,\n        workosDeploymentType,\n      );\n\n      if (result !== \"ready\") {\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: \"Failed to provision WorkOS environment\",\n        });\n      }\n\n      // After provisioning, re-fetch the credentials\n      const provisionedEnvVars = await getWorkOSEnvVarsFromDeployment(\n        ctx,\n        deployment,\n      );\n      clientId = provisionedEnvVars.clientId;\n      apiKey = provisionedEnvVars.apiKey;\n      environmentId = provisionedEnvVars.environmentId;\n\n      if (!clientId || !apiKey) {\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage:\n            \"Failed to retrieve WorkOS credentials after provisioning\",\n        });\n      }\n    } catch (error: any) {\n      if (\n        error.message?.includes(\"permission\") ||\n        error.message?.includes(\"deploy key\") ||\n        error.message?.includes(\"UnexpectedAuthHeaderFormat\")\n      ) {\n        await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage:\n            `Cannot provision WorkOS environment with current authentication.\\n` +\n            `You need to manually set WORKOS_CLIENT_ID and WORKOS_API_KEY\\n` +\n            `environment variables in your build environment or deployment settings.`,\n        });\n      }\n      return await ctx.crash({\n        exitCode: 1,\n        errorType: \"fatal\",\n        printedMessage: `Error provisioning WorkOS environment: ${error.message}`,\n      });\n    }\n  }\n\n  return { clientId, apiKey, environmentId, deploymentEnvVars };\n}\n\n// Helper function to build error message for deployment key restrictions\nfunction buildDeploymentKeyError(\n  deploymentName: string,\n  deploymentType: string,\n): string {\n  const integrationsUrl = deploymentDashboardUrlPage(\n    deploymentName,\n    \"/settings/integrations\",\n  );\n  return (\n    `AuthKit configuration in convex.json requires WorkOS credentials.\\n\\n` +\n    `Checked for credentials in:\\n` +\n    `  1. Build environment variables (WORKOS_CLIENT_ID, WORKOS_API_KEY)\\n` +\n    `  2. Deployment environment variables, see WorkOS integration at ${integrationsUrl}\\n\\n` +\n    `When using a deployment-specific key, you cannot automatically provision WorkOS environments.\\n` +\n    `You must provide these credentials in your build platform (e.g., Vercel, Netlify)\\n` +\n    `or set them in your deployment settings.\\n\\n` +\n    `Alternatively, remove the 'authKit.${deploymentType}' section from convex.json to skip\\n` +\n    `AuthKit configuration.`\n  );\n}\n\n// Helper function to ensure deployment has the correct WorkOS credentials\nasync function ensureDeploymentHasWorkOSCredentials(\n  ctx: Context,\n  deployment: { deploymentUrl: string; adminKey: string },\n  credentials: {\n    clientId: string;\n    apiKey: string;\n    environmentId: string | null;\n  },\n  deploymentEnvVars: {\n    clientId: string | null;\n    apiKey: string | null;\n    environmentId: string | null;\n  },\n): Promise<void> {\n  const mismatches: string[] = [];\n  if (\n    deploymentEnvVars.clientId &&\n    deploymentEnvVars.clientId !== credentials.clientId\n  ) {\n    mismatches.push(\n      `  WORKOS_CLIENT_ID: deployment has '${deploymentEnvVars.clientId}' but we need '${credentials.clientId}'`,\n    );\n  }\n  if (\n    deploymentEnvVars.apiKey &&\n    deploymentEnvVars.apiKey !== credentials.apiKey\n  ) {\n    mismatches.push(\n      `  WORKOS_API_KEY: deployment has different value than what we need`,\n    );\n  }\n  if (\n    deploymentEnvVars.environmentId &&\n    credentials.environmentId &&\n    deploymentEnvVars.environmentId !== credentials.environmentId\n  ) {\n    mismatches.push(\n      `  WORKOS_ENVIRONMENT_ID: deployment has '${deploymentEnvVars.environmentId}' but we need '${credentials.environmentId}'`,\n    );\n  }\n\n  if (mismatches.length > 0) {\n    await ctx.crash({\n      exitCode: 1,\n      errorType: \"fatal\",\n      printedMessage:\n        `WorkOS environment variable mismatch detected!\\n\\n` +\n        `The following environment variables in your Convex deployment don't match what's needed:\\n` +\n        mismatches.join(\"\\n\") +\n        \"\\n\\n\" +\n        `This would cause your auth configuration to use different credentials at runtime than during build.\\n\\n` +\n        `To fix this, remove the conflicting environment variables from your deployment:\\n` +\n        `  npx convex env remove WORKOS_CLIENT_ID\\n` +\n        `  npx convex env remove WORKOS_API_KEY\\n` +\n        `  npx convex env remove WORKOS_ENVIRONMENT_ID\\n\\n` +\n        `Or remove them from the Convex dashboard deployment settings.\\n\\n` +\n        `Then run your deployment command again.`,\n    });\n  }\n  const updates: Array<{ name: string; value: string }> = [];\n  if (!deploymentEnvVars.clientId && credentials.clientId) {\n    updates.push({ name: \"WORKOS_CLIENT_ID\", value: credentials.clientId });\n  }\n  if (!deploymentEnvVars.apiKey && credentials.apiKey) {\n    updates.push({ name: \"WORKOS_API_KEY\", value: credentials.apiKey });\n  }\n  if (!deploymentEnvVars.environmentId && credentials.environmentId) {\n    updates.push({\n      name: \"WORKOS_ENVIRONMENT_ID\",\n      value: credentials.environmentId,\n    });\n  }\n\n  if (updates.length > 0) {\n    changeSpinner(\"Setting WorkOS credentials in deployment...\");\n    await callUpdateEnvironmentVariables(\n      ctx,\n      { ...deployment, deploymentNotice: \"\" },\n      updates,\n    );\n    logVerbose(\n      `WorkOS credentials propagated to deployment: ${updates.map((u) => u.name).join(\", \")}`,\n    );\n  }\n}\n\n/**\n * Ensure the current deployment has the three expected WorkOS environment\n * variables defined with values corresponding to a valid WorkOS deployment.\n *\n * This may involve provisioning a WorkOS deployment or even (in interactive\n * terminals only) prompting to provision a new WorkOS team to be associated\n * with this Convex team.\n */\nexport async function ensureWorkosEnvironmentProvisioned(\n  ctx: Context,\n  deploymentName: string,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n    deploymentNotice: string;\n  },\n  authKitConfig: AuthKitConfig | undefined,\n  deploymentType: \"dev\" | \"preview\" | \"prod\",\n): Promise<\"ready\" | \"choseNotToAssociatedTeam\"> {\n  const envConfig: AuthKitEnvironmentConfig | undefined =\n    authKitConfig?.[deploymentType];\n\n  // If no config, nothing to do\n  if (!envConfig) {\n    return \"choseNotToAssociatedTeam\";\n  }\n\n  showSpinner(\"Checking for associated AuthKit environment...\");\n  const existingEnvVars = await getExistingWorkosEnvVars(ctx, deployment);\n  if (\n    existingEnvVars.clientId &&\n    existingEnvVars.environmentId &&\n    existingEnvVars.apiKey\n  ) {\n    logOutput(\n      \"Deployment already has environment variables for a WorkOS environment configured for AuthKit.\",\n    );\n\n    if (\n      envConfig.localEnvVars !== undefined &&\n      envConfig.localEnvVars !== false\n    ) {\n      await updateEnvLocal(\n        ctx,\n        existingEnvVars.clientId,\n        existingEnvVars.apiKey,\n        existingEnvVars.environmentId,\n        envConfig.localEnvVars,\n      );\n    }\n\n    // Configure WorkOS environment if configured\n    if (envConfig.configure !== undefined && envConfig.configure !== false) {\n      if (!existingEnvVars.apiKey) {\n        // API key missing - warn and skip configuration\n        logWarning(\n          `Skipping WorkOS AuthKit environment configuration: WORKOS_API_KEY is not set.\\n` +\n            `To configure redirect URIs and CORS origins, you need to set this environment variable.\\n` +\n            `You can set it at: ${deployment.deploymentUrl.replace(/\\/$/, \"\")}/settings/environment-variables`,\n        );\n      } else {\n        await updateWorkosEnvironment(\n          ctx,\n          existingEnvVars.apiKey,\n          envConfig.configure,\n          {\n            clientId: existingEnvVars.clientId,\n            apiKey: existingEnvVars.apiKey,\n            environmentId: existingEnvVars.environmentId,\n          },\n        );\n      }\n    }\n\n    logFinishedStep(\"WorkOS AuthKit environment ready\");\n    return \"ready\";\n  }\n\n  // We need to provision an environment via Big Brain\n  const response = await getDeploymentCanProvisionWorkOSEnvironments(\n    ctx,\n    deploymentName,\n  );\n  const { hasAssociatedWorkosTeam, teamId } = response;\n\n  // In case this this becomes a legacy flow that no longer works.\n  if ((response as any).disabled) {\n    return \"choseNotToAssociatedTeam\";\n  }\n\n  if (!hasAssociatedWorkosTeam) {\n    // A WorkOS workspace needs to be created for provisioning to work\n    // We'll offer to create it interactively, or fail in non-interactive mode\n    const result = await tryToCreateAssociatedWorkosTeam(\n      ctx,\n      deploymentName,\n      teamId,\n      deploymentType,\n    );\n    if (result === \"choseNotToAssociatedTeam\") {\n      return \"choseNotToAssociatedTeam\";\n    }\n    result satisfies \"ready\";\n  }\n\n  // Determine WorkOS environment type\n  // Map config's \"development\"/\"staging\"/\"production\" to API's \"production\"/\"nonproduction\"\n  // Default: dev/preview -> nonproduction, prod -> production\n  // Override: use environmentType from config (only allowed in prod)\n  let workosEnvironmentType: \"production\" | \"nonproduction\" | undefined;\n  if (envConfig.environmentType) {\n    // User explicitly set it (only allowed in prod)\n    // Map: \"production\" -> \"production\", everything else -> \"nonproduction\"\n    workosEnvironmentType =\n      envConfig.environmentType === \"production\"\n        ? \"production\"\n        : \"nonproduction\";\n  } else {\n    // Default based on Convex deployment type\n    workosEnvironmentType =\n      deploymentType === \"prod\" ? \"production\" : \"nonproduction\";\n  }\n\n  const environmentResult = await createEnvironmentAndAPIKey(\n    ctx,\n    deploymentName,\n    workosEnvironmentType,\n  );\n\n  if (!environmentResult.success) {\n    if (\n      \"error\" in environmentResult &&\n      environmentResult.error === \"team_not_provisioned\"\n    ) {\n      return await ctx.crash({\n        exitCode: 1,\n        errorType: \"fatal\",\n        printedMessage: `Team unexpectedly has no provisioned WorkOS team: ${environmentResult.message}`,\n      });\n    }\n    // For other error cases\n    const errorMessage =\n      \"message\" in environmentResult\n        ? environmentResult.message\n        : \"Failed to provision WorkOS environment\";\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"fatal\",\n      printedMessage: errorMessage,\n    });\n  }\n\n  const data = environmentResult.data;\n  if (data.newlyProvisioned) {\n    logMessage(\"New AuthKit environment provisioned\");\n  } else {\n    logMessage(\n      \"Using credentials from existing AuthKit environment already created for this deployment\",\n    );\n  }\n\n  changeSpinner(\"Setting WORKOS_* deployment environment variables...\");\n  await setConvexEnvVars(\n    ctx,\n    deployment,\n    data.clientId,\n    data.environmentId,\n    data.apiKey,\n  );\n\n  if (\n    envConfig.localEnvVars !== undefined &&\n    envConfig.localEnvVars !== false\n  ) {\n    showSpinner(\"Updating .env.local with WorkOS configuration\");\n    await updateEnvLocal(\n      ctx,\n      data.clientId,\n      data.apiKey,\n      data.environmentId,\n      envConfig.localEnvVars,\n    );\n  }\n\n  // Configure WorkOS environment if configured\n  if (envConfig.configure !== undefined && envConfig.configure !== false) {\n    await updateWorkosEnvironment(ctx, data.apiKey, envConfig.configure, {\n      clientId: data.clientId,\n      apiKey: data.apiKey,\n      environmentId: data.environmentId,\n    });\n  }\n  logFinishedStep(\"WorkOS AuthKit environment ready\");\n\n  return \"ready\";\n}\n\n/**\n * Interactive flow to provision a WorkOS team for a Convex team.\n * Handles ToS agreement, email selection, and retry logic.\n */\nexport async function provisionWorkosTeamInteractive(\n  ctx: Context,\n  deploymentName: string,\n  teamId: number,\n  deploymentType: \"dev\" | \"preview\" | \"prod\",\n  options: {\n    promptPrefix?: string;\n    promptMessage?: string;\n  } = {},\n): Promise<\n  | { success: true; workosTeamId: string; workosTeamName: string }\n  | { success: false; reason: \"cancelled\" }\n> {\n  const teamInfo = await getTeamAndProjectSlugForDeployment(ctx, {\n    deploymentName,\n  });\n  if (teamInfo === null) {\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"fatal\",\n      printedMessage: `Can't find Convex Cloud team for deployment ${deploymentName}`,\n    });\n  }\n  stopSpinner();\n\n  const defaultPrefix = `A WorkOS team needs to be created for your Convex team \"${teamInfo.teamSlug}\" in order to use AuthKit.\n\nYou and other members of this team will be able to create WorkOS environments for each Convex dev deployment for projects in this team.\n\nBy creating this account you agree to the WorkOS Terms of Service (https://workos.com/legal/terms-of-service) and Privacy Policy (https://workos.com/legal/privacy).\nAlternately, choose no and set WORKOS_CLIENT_ID for an existing WorkOS environment.\n\\n`;\n\n  const defaultMessage = `Create a WorkOS team and enable automatic AuthKit environment provisioning for team \"${teamInfo.teamSlug}\"?`;\n\n  const agree = await promptYesNo(ctx, {\n    prefix: options.promptPrefix ?? defaultPrefix,\n    message: options.promptMessage ?? defaultMessage,\n    nonInteractiveError: `Cannot provision WorkOS AuthKit in non-interactive mode.\n\nA WorkOS workspace needs to be associated with your Convex team to enable automatic environment provisioning.\n\nTo fix this, either:\n1. Run this command in an interactive terminal to set up WorkOS provisioning\n2. Remove the authKit.${deploymentType} section from convex.json and provide your own WorkOS credentials via the dashboard\n3. Set WORKOS_CLIENT_ID and WORKOS_API_KEY environment variables before deploying`,\n  });\n  if (!agree) {\n    logMessage(\"\\nGot it. We won't create your WorkOS account.\");\n    return { success: false, reason: \"cancelled\" };\n  }\n\n  const alreadyTried = new Map<string, string>();\n\n  let email;\n  while (true) {\n    let choice = \"refresh\";\n    while (choice === \"refresh\") {\n      const { availableEmails } =\n        await getCandidateEmailsForWorkIntegration(ctx);\n      choice = await promptOptions<string>(ctx, {\n        message:\n          availableEmails.length === 1\n            ? \"Create a new WorkOS team with this email address?\"\n            : \"Create a new WorkOS team with which email address?\",\n        suffix:\n          availableEmails.length === 0\n            ? \"\\nVisit https://dashboard.convex.dev/profile to add a verified email to use to provision a WorkOS account\"\n            : availableEmails.length === 1\n              ? \"\\nCreate a new WorkOS team with this email address?\"\n              : \"\\nTo use another email address visit https://dashboard.convex.dev/profile to add and verify, then choose 'refresh'\",\n        choices: [\n          ...availableEmails.map((email: string) => ({\n            name: `${email}${alreadyTried.has(email) ? ` (can't create, a WorkOS team already exists with this email)` : \"\"}`,\n            value: email,\n          })),\n          {\n            name: \"refresh (add an email at https://dashboard.convex.dev/profile)\",\n            value: \"refresh\",\n          } as const,\n          {\n            name: \"cancel (do not create a WorkOS account)\",\n            value: \"cancel\",\n          } as const,\n        ],\n      });\n    }\n    if (choice === \"cancel\") {\n      return { success: false, reason: \"cancelled\" };\n    }\n    email = choice;\n\n    const teamResult = await createAssociatedWorkosTeam(ctx, teamId, email);\n\n    if (teamResult.result === \"emailAlreadyUsed\") {\n      logMessage(teamResult.message);\n      alreadyTried.set(email, teamResult.message);\n      continue;\n    }\n    // Success!\n    return {\n      success: true,\n      workosTeamId: teamResult.workosTeamId,\n      workosTeamName: teamResult.workosTeamName,\n    };\n  }\n}\n\nexport async function tryToCreateAssociatedWorkosTeam(\n  ctx: Context,\n  deploymentName: string,\n  teamId: number,\n  deploymentType: \"dev\" | \"preview\" | \"prod\",\n): Promise<\"ready\" | \"choseNotToAssociatedTeam\"> {\n  const result = await provisionWorkosTeamInteractive(\n    ctx,\n    deploymentName,\n    teamId,\n    deploymentType,\n  );\n\n  if (!result.success) {\n    logMessage(\n      `To provide your own WorkOS environment credentials instead, set environment variables manually:\n\nnpx convex env set WORKOS_CLIENT_ID $YOUR_CLIENT_ID_HERE\nnpx convex env set WORKOS_API_KEY $YOUR_API_KEY_HERE`,\n    );\n    return \"choseNotToAssociatedTeam\";\n  }\n\n  logFinishedStep(\"WorkOS team created successfully\");\n  return \"ready\";\n}\n\n/**\n * Pre-flight check for AuthKit provisioning.\n * Called before building the client bundle to ensure .env.local has correct values.\n * This is the main provisioning path - the error path is kept for backwards compatibility.\n */\n/**\n * Ensures WorkOS AuthKit environment is ready before building.\n *\n * Flow:\n * 1. Get authKit configuration for the deployment type\n * 2. Resolve credentials (build env \u2192 deployment env \u2192 provision via Big Brain)\n * 3. Ensure deployment has the correct credentials\n * 4. Update local .env.local if configured (interactive only)\n * 5. Configure WorkOS environment settings if needed\n */\nexport async function ensureAuthKitProvisionedBeforeBuild(\n  ctx: Context,\n  deploymentName: string,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n  },\n  deploymentType?: \"dev\" | \"preview\" | \"prod\",\n): Promise<void> {\n  // 1. Get configuration\n  const { projectConfig } = await readProjectConfig(ctx);\n  const authKitConfig = await getAuthKitConfig(ctx, projectConfig);\n  if (!authKitConfig) {\n    return;\n  }\n\n  const workosDeploymentType = deploymentType || \"dev\";\n  const envConfig = authKitConfig[workosDeploymentType];\n  if (!envConfig) {\n    return;\n  }\n\n  // 2. Resolve credentials from all sources\n  const { clientId, apiKey, environmentId, deploymentEnvVars } =\n    await resolveWorkOSCredentials(\n      ctx,\n      deployment,\n      deploymentName,\n      authKitConfig,\n      workosDeploymentType,\n    );\n\n  // 3. Ensure deployment has the correct credentials\n  if (clientId && apiKey) {\n    await ensureDeploymentHasWorkOSCredentials(\n      ctx,\n      deployment,\n      { clientId, apiKey, environmentId },\n      deploymentEnvVars,\n    );\n  }\n\n  // 4. Update local environment variables if configured (interactive mode only)\n  if (envConfig.localEnvVars && process.stdin.isTTY && clientId && apiKey) {\n    await updateEnvLocal(\n      ctx,\n      clientId,\n      apiKey,\n      environmentId || \"\",\n      envConfig.localEnvVars,\n    );\n  }\n\n  // 5. Configure WorkOS environment if needed\n  if (envConfig.configure && apiKey) {\n    const configValues: {\n      clientId?: string;\n      apiKey?: string;\n      environmentId?: string;\n    } = {\n      apiKey,\n    };\n    if (clientId) {\n      configValues.clientId = clientId;\n    }\n    if (environmentId) {\n      configValues.environmentId = environmentId;\n    }\n    await updateWorkosEnvironment(\n      ctx,\n      apiKey,\n      envConfig.configure,\n      configValues,\n    );\n  }\n}\n/**\n * Syncs WorkOS configuration and local env vars after a successful push.\n * This is called on every push in dev mode to keep WorkOS settings in sync\n * with changes to convex.json.\n *\n * @returns true if any updates were made, false if config unchanged\n */\nexport async function syncAuthKitConfigAfterPush(\n  ctx: Context,\n  projectConfig: ProjectConfig,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n  },\n): Promise<boolean> {\n  // Get the authKit config (may include generated defaults for templates)\n  const authKitConfig = await getAuthKitConfig(ctx, projectConfig);\n  if (!authKitConfig) {\n    // No authKit config, nothing to sync\n    return false;\n  }\n\n  // We only sync the \"dev\" environment settings during dev mode\n  const devConfig = authKitConfig.dev;\n  if (!devConfig) {\n    return false;\n  }\n\n  // Get existing credentials from deployment\n  const [clientId, apiKey, environmentId] = await Promise.all([\n    envGetInDeployment(ctx, deployment, \"WORKOS_CLIENT_ID\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_API_KEY\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_ENVIRONMENT_ID\"),\n  ]);\n\n  // We need the API key to make WorkOS API calls\n  if (!apiKey) {\n    // Can't update WorkOS without an API key\n    return false;\n  }\n\n  // Update WorkOS environment configuration if specified\n  if (devConfig.configure !== undefined && devConfig.configure !== false) {\n    const provisionedValues: {\n      clientId?: string;\n      apiKey?: string;\n      environmentId?: string;\n    } = {\n      apiKey,\n    };\n    if (clientId) {\n      provisionedValues.clientId = clientId;\n    }\n    if (environmentId) {\n      provisionedValues.environmentId = environmentId;\n    }\n    await updateWorkosEnvironment(\n      ctx,\n      apiKey,\n      devConfig.configure,\n      provisionedValues,\n    );\n  }\n\n  // Note: We don't update .env.local during sync - that only happens during provisioning\n  // to ensure the client bundle build has the correct values\n\n  return true;\n}\n\n// Helpers\n\nasync function updateWorkosEnvironment(\n  ctx: Context,\n  workosApiKey: string,\n  configureSettings: AuthKitConfigureSettings,\n  provisioned?: { clientId?: string; apiKey?: string; environmentId?: string },\n): Promise<void> {\n  const isInteractive = process.stdin.isTTY;\n  const skippedConfigs: string[] = [];\n\n  // Log what we're about to configure\n  const configItems: string[] = [];\n  if (configureSettings.redirectUris?.length) {\n    configItems.push(\n      `${configureSettings.redirectUris.length} redirect URI(s)`,\n    );\n  }\n  if (configureSettings.appHomepageUrl) {\n    configItems.push(`app homepage URL`);\n  }\n  if (configureSettings.corsOrigins?.length) {\n    configItems.push(`${configureSettings.corsOrigins.length} CORS origin(s)`);\n  }\n\n  if (configItems.length > 0) {\n    logVerbose(\n      `Starting WorkOS AuthKit configuration: ${configItems.join(\", \")}`,\n    );\n  } else {\n    logVerbose(`No WorkOS AuthKit configuration settings to apply`);\n    return;\n  }\n\n  // Apply each redirect URI\n  if (configureSettings.redirectUris) {\n    for (const redirectUri of configureSettings.redirectUris) {\n      try {\n        // Resolve template with both env vars and provisioned values\n        const resolvedRedirectUri = resolveTemplate(redirectUri, provisioned);\n        const { modified: redirectUriAdded } = await createRedirectURI(\n          ctx,\n          workosApiKey,\n          resolvedRedirectUri,\n        );\n        if (redirectUriAdded) {\n          changeSpinner(\"Configuring AuthKit redirect URI...\");\n          logMessage(`AuthKit redirect URI added: ${resolvedRedirectUri}`);\n        } else {\n          logVerbose(\n            `AuthKit redirect URI already configured: ${resolvedRedirectUri}`,\n          );\n        }\n      } catch (error: any) {\n        if (\n          isInteractive &&\n          error.message?.includes(\"Cannot resolve template\")\n        ) {\n          // In interactive mode, log warning and continue\n          skippedConfigs.push(\n            `Redirect URI: ${redirectUri} - ${error.message}`,\n          );\n        } else {\n          // In non-interactive mode or for other errors, crash\n          return await ctx.crash({\n            exitCode: 1,\n            errorType: \"fatal\",\n            printedMessage: `Error configuring redirect URI: ${error.message}`,\n          });\n        }\n      }\n    }\n  }\n\n  // Apply app homepage URL (where users are redirected after logout)\n  if (configureSettings.appHomepageUrl) {\n    try {\n      // Resolve template with both env vars and provisioned values\n      const resolvedAppHomepageUrl = resolveTemplate(\n        configureSettings.appHomepageUrl,\n        provisioned,\n      );\n\n      const { modified: appHomepageUrlUpdated } = await updateAppHomepageUrl(\n        ctx,\n        workosApiKey,\n        resolvedAppHomepageUrl,\n      );\n\n      if (appHomepageUrlUpdated) {\n        changeSpinner(\"Configuring AuthKit app homepage URL...\");\n        logMessage(\n          `AuthKit app homepage URL updated: ${resolvedAppHomepageUrl}`,\n        );\n      } else {\n        logVerbose(\n          `AuthKit app homepage URL was not updated (may be invalid for WorkOS or already set)`,\n        );\n      }\n    } catch (error: any) {\n      if (isInteractive && error.message?.includes(\"Cannot resolve template\")) {\n        // In interactive mode, log warning and continue\n        skippedConfigs.push(\n          `App homepage URL: ${configureSettings.appHomepageUrl} - ${error.message}`,\n        );\n      } else {\n        // In non-interactive mode or for other errors, crash\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: `Error configuring app homepage URL: ${error.message}`,\n        });\n      }\n    }\n  } else {\n    logVerbose(`No app homepage URL configured`);\n  }\n\n  // Apply each CORS origin\n  if (configureSettings.corsOrigins) {\n    for (const corsOrigin of configureSettings.corsOrigins) {\n      try {\n        // Resolve template with both env vars and provisioned values\n        const resolvedCorsOrigin = resolveTemplate(corsOrigin, provisioned);\n        const { modified: corsAdded } = await createCORSOrigin(\n          ctx,\n          workosApiKey,\n          resolvedCorsOrigin,\n        );\n        if (corsAdded) {\n          changeSpinner(\"Configuring AuthKit CORS origin...\");\n          logMessage(`AuthKit CORS origin added: ${resolvedCorsOrigin}`);\n        } else {\n          logVerbose(\n            `AuthKit CORS origin already configured: ${resolvedCorsOrigin}`,\n          );\n        }\n      } catch (error: any) {\n        if (\n          isInteractive &&\n          error.message?.includes(\"Cannot resolve template\")\n        ) {\n          // In interactive mode, log warning and continue\n          skippedConfigs.push(`CORS origin: ${corsOrigin} - ${error.message}`);\n        } else {\n          // In non-interactive mode or for other errors, crash\n          return await ctx.crash({\n            exitCode: 1,\n            errorType: \"fatal\",\n            printedMessage: `Error configuring CORS origin: ${error.message}`,\n          });\n        }\n      }\n    }\n  }\n\n  // Log completion summary\n  logVerbose(`WorkOS AuthKit configuration completed`);\n\n  // If we skipped any configurations in interactive mode, let the user know\n  if (skippedConfigs.length > 0) {\n    stopSpinner();\n    logWarning(\n      `Skipped some AuthKit configurations due to missing environment variables:\\n` +\n        skippedConfigs.map((s) => `  - ${s}`).join(\"\\n\"),\n    );\n  }\n}\n\n// Helper to resolve template strings with unified syntax:\n// - ${buildEnv.ENV_VAR} for build-time environment variables\n// - ${authEnv.WORKOS_CLIENT_ID} for provisioned client ID\n// - ${authEnv.WORKOS_API_KEY} for provisioned API key\n// - ${authEnv.WORKOS_ENVIRONMENT_ID} for provisioned environment ID\n/* eslint-disable no-restricted-syntax */\nexport function resolveTemplate(\n  str: string,\n  provisioned?: { clientId?: string; apiKey?: string; environmentId?: string },\n): string {\n  return str.replace(/\\$\\{([^}]+)\\}/g, (match, expression) => {\n    // Handle auth environment values (provisioned WorkOS credentials)\n    if (expression === \"authEnv.WORKOS_CLIENT_ID\") {\n      if (!provisioned?.clientId) {\n        throw new Error(\n          `Cannot resolve template ${match}: WORKOS_CLIENT_ID not available. ` +\n            `Ensure WorkOS environment is provisioned.`,\n        );\n      }\n      return provisioned.clientId;\n    }\n    if (expression === \"authEnv.WORKOS_API_KEY\") {\n      if (!provisioned?.apiKey) {\n        throw new Error(\n          `Cannot resolve template ${match}: WORKOS_API_KEY not available. ` +\n            `Ensure WorkOS environment is provisioned.`,\n        );\n      }\n      return provisioned.apiKey;\n    }\n    if (expression === \"authEnv.WORKOS_ENVIRONMENT_ID\") {\n      if (!provisioned?.environmentId) {\n        throw new Error(\n          `Cannot resolve template ${match}: WORKOS_ENVIRONMENT_ID not available. ` +\n            `Ensure WorkOS environment is provisioned.`,\n        );\n      }\n      return provisioned.environmentId;\n    }\n\n    // Handle build environment variables\n    if (expression.startsWith(\"buildEnv.\")) {\n      const varName = expression.substring(\"buildEnv.\".length);\n      const value = process.env[varName];\n      if (!value) {\n        throw new Error(\n          `Cannot resolve template ${match}: Environment variable ${varName} is not set.`,\n        );\n      }\n      return value;\n    }\n\n    // Unknown template expression - fail loudly\n    throw new Error(\n      `Unknown template expression: ${match}. ` +\n        `Use \\${buildEnv.VAR_NAME} for environment variables or ` +\n        `\\${authEnv.WORKOS_CLIENT_ID/WORKOS_API_KEY} for provisioned values.`,\n    );\n  });\n}\n/* eslint-enable no-restricted-syntax */\n\n// Update .env.local based on configured localEnvVars\nasync function updateEnvLocal(\n  ctx: Context,\n  clientId: string,\n  apiKey: string,\n  environmentId: string,\n  localEnvVarsConfig: Record<string, string>,\n) {\n  const envPath = \".env.local\";\n\n  let existingFileContent = ctx.fs.exists(envPath)\n    ? ctx.fs.readUtf8File(envPath)\n    : null;\n\n  // Build the changes based on localEnvVarsConfig\n  let suggestedChanges: Record<\n    string,\n    {\n      value: string;\n      commentAfterValue?: string;\n      commentOnPreviousLine?: string;\n    }\n  > = {};\n\n  const { detectedFramework } = await suggestedEnvVarNames(ctx);\n\n  // Parse existing .env.local to check what's already there\n  const existingEnvVars = existingFileContent\n    ? dotenv.parse(existingFileContent)\n    : {};\n\n  for (const [envVarName, templateValue] of Object.entries(\n    localEnvVarsConfig,\n  )) {\n    // Check if already set in .env.local\n    if (existingEnvVars[envVarName]) {\n      logVerbose(`Skipping ${envVarName} update - already in .env.local`);\n      continue;\n    }\n\n    // Check if already set in environment (but not from .env.local)\n    if (process.env[envVarName]) {\n      logVerbose(\n        `Skipping ${envVarName} update in .env.local - already set in environment`,\n      );\n      continue;\n    }\n\n    // Use unified template resolution for both syntaxes\n    const resolvedValue = resolveTemplate(templateValue, {\n      clientId,\n      apiKey,\n      environmentId,\n    });\n\n    // Add comment for first WorkOS var if it's a provisioned value\n    if (\n      Object.keys(suggestedChanges).length === 0 &&\n      (templateValue.includes(\"authEnv.WORKOS_CLIENT_ID\") ||\n        templateValue === \"${authEnv.WORKOS_CLIENT_ID}\")\n    ) {\n      suggestedChanges[envVarName] = {\n        value: resolvedValue,\n        commentOnPreviousLine: `# See this environment at ${workosUrl(environmentId, \"/authentication\")}`,\n      };\n    } else {\n      suggestedChanges[envVarName] = { value: resolvedValue };\n    }\n  }\n\n  // Special handling for WORKOS_COOKIE_PASSWORD for Next.js/TanStackStart\n  if (\n    (detectedFramework === \"Next.js\" ||\n      detectedFramework === \"TanStackStart\") &&\n    !process.env[\"WORKOS_COOKIE_PASSWORD\"] && // Don't override environment\n    (!existingFileContent ||\n      !existingFileContent.includes(\"WORKOS_COOKIE_PASSWORD\"))\n  ) {\n    suggestedChanges[\"WORKOS_COOKIE_PASSWORD\"] = {\n      value: crypto.randomBytes(32).toString(\"base64url\"),\n    };\n  }\n\n  for (const [\n    envVarName,\n    { value: envVarValue, commentOnPreviousLine, commentAfterValue },\n  ] of Object.entries(suggestedChanges) as [\n    string,\n    {\n      value: string;\n      commentOnPreviousLine?: string;\n      commentAfterValue?: string;\n    },\n  ][]) {\n    existingFileContent =\n      changedEnvVarFile({\n        existingFileContent,\n        envVarName,\n        envVarValue,\n        commentAfterValue: commentAfterValue ?? null,\n        commentOnPreviousLine: commentOnPreviousLine ?? null,\n      }) || existingFileContent;\n  }\n\n  if (\n    existingFileContent !== null &&\n    Object.keys(suggestedChanges).length > 0\n  ) {\n    ctx.fs.writeUtf8File(envPath, existingFileContent);\n    logMessage(\n      `Updated .env.local with ${Object.keys(suggestedChanges).join(\", \")}`,\n    );\n  }\n}\n\nasync function getExistingWorkosEnvVars(\n  ctx: Context,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n  },\n): Promise<{\n  clientId: string | null;\n  environmentId: string | null;\n  apiKey: string | null;\n}> {\n  const [clientId, environmentId, apiKey] = await Promise.all([\n    envGetInDeployment(ctx, deployment, \"WORKOS_CLIENT_ID\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_ENVIRONMENT_ID\"),\n    envGetInDeployment(ctx, deployment, \"WORKOS_API_KEY\"),\n  ]);\n\n  return { clientId, environmentId, apiKey };\n}\n\nasync function setConvexEnvVars(\n  ctx: Context,\n  deployment: {\n    deploymentUrl: string;\n    adminKey: string;\n    deploymentNotice: string;\n  },\n  workosClientId: string,\n  workosEnvironmentId: string,\n  workosEnvironmentApiKey: string,\n) {\n  await callUpdateEnvironmentVariables(ctx, deployment, [\n    { name: \"WORKOS_CLIENT_ID\", value: workosClientId },\n    { name: \"WORKOS_ENVIRONMENT_ID\", value: workosEnvironmentId },\n    { name: \"WORKOS_API_KEY\", value: workosEnvironmentApiKey },\n  ]);\n}\n\ntype Subpaths = \"/authentication\" | \"/sessions\" | \"/redirects\" | \"/users\";\nfunction workosUrl(environmentId: string, subpath: Subpaths) {\n  return `https://dashboard.workos.com/${environmentId}${subpath}`;\n}\n"],
+  "mappings": ";AAMA,OAAO,YAAY;AACnB,YAAY,YAAY;AAExB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,gCAAgC,0BAA0B;AACnE,SAAS,kCAAkC;AAC3C,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,eAAe,mBAAmB;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP,SAAS,kBAAkB,yBAAyB;AAGpD,eAAe,+BACb,KACA,YAKC;AACD,QAAM,CAAC,UAAU,QAAQ,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1D,mBAAmB,KAAK,YAAY,kBAAkB;AAAA,IACtD,mBAAmB,KAAK,YAAY,gBAAgB;AAAA,IACpD,mBAAmB,KAAK,YAAY,uBAAuB;AAAA,EAC7D,CAAC;AACD,SAAO,EAAE,UAAU,QAAQ,cAAc;AAC3C;AAGA,eAAe,yBACb,KACA,YACA,gBACA,eACA,sBAUC;AACD,QAAM,oBAAoB,MAAM;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI,yBAAyB,OAAO;AAGlC,eACE,QAAQ,IAAI,oBAAoB,kBAAkB,YAAY;AAChE,aAAS,kBAAkB,UAAU;AACrC,oBACE,QAAQ,IAAI,yBACZ,kBAAkB,iBAClB;AAAA,EACJ,OAAO;AAIL,eACE,kBAAkB,YAAY,QAAQ,IAAI,oBAAoB;AAChE,aAAS,kBAAkB,UAAU;AACrC,oBACE,kBAAkB,iBAClB,QAAQ,IAAI,yBACZ;AAAA,EACJ;AAGA,MAAI,CAAC,YAAY,CAAC,QAAQ;AACxB,UAAM,OAAO,IAAI,aAAa;AAC9B,UAAM,uBAAuB,MAAM,SAAS;AAE5C,QAAI,sBAAsB;AACxB,YAAM,IAAI,MAAM;AAAA,QACd,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB;AAAA,UACd;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAGA,gBAAY,qCAAqC;AAEjD,QAAI;AACF,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,EAAE,GAAG,YAAY,kBAAkB,GAAG;AAAA,QACtC;AAAA,QACA;AAAA,MACF;AAEA,UAAI,WAAW,SAAS;AACtB,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AAGA,YAAM,qBAAqB,MAAM;AAAA,QAC/B;AAAA,QACA;AAAA,MACF;AACA,iBAAW,mBAAmB;AAC9B,eAAS,mBAAmB;AAC5B,sBAAgB,mBAAmB;AAEnC,UAAI,CAAC,YAAY,CAAC,QAAQ;AACxB,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAY;AACnB,UACE,MAAM,SAAS,SAAS,YAAY,KACpC,MAAM,SAAS,SAAS,YAAY,KACpC,MAAM,SAAS,SAAS,4BAA4B,GACpD;AACA,cAAM,IAAI,MAAM;AAAA,UACd,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBACE;AAAA;AAAA;AAAA,QAGJ,CAAC;AAAA,MACH;AACA,aAAO,MAAM,IAAI,MAAM;AAAA,QACrB,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB,0CAA0C,MAAM,OAAO;AAAA,MACzE,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,QAAQ,eAAe,kBAAkB;AAC9D;AAGA,SAAS,wBACP,gBACA,gBACQ;AACR,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,SACE;AAAA;AAAA;AAAA;AAAA,mEAGoE,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAI7C,cAAc;AAAA;AAGxD;AAGA,eAAe,qCACb,KACA,YACA,aAKA,mBAKe;AACf,QAAM,aAAuB,CAAC;AAC9B,MACE,kBAAkB,YAClB,kBAAkB,aAAa,YAAY,UAC3C;AACA,eAAW;AAAA,MACT,uCAAuC,kBAAkB,QAAQ,kBAAkB,YAAY,QAAQ;AAAA,IACzG;AAAA,EACF;AACA,MACE,kBAAkB,UAClB,kBAAkB,WAAW,YAAY,QACzC;AACA,eAAW;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,MACE,kBAAkB,iBAClB,YAAY,iBACZ,kBAAkB,kBAAkB,YAAY,eAChD;AACA,eAAW;AAAA,MACT,4CAA4C,kBAAkB,aAAa,kBAAkB,YAAY,aAAa;AAAA,IACxH;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAI,MAAM;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBACE;AAAA;AAAA;AAAA,IAEA,WAAW,KAAK,IAAI,IACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQJ,CAAC;AAAA,EACH;AACA,QAAM,UAAkD,CAAC;AACzD,MAAI,CAAC,kBAAkB,YAAY,YAAY,UAAU;AACvD,YAAQ,KAAK,EAAE,MAAM,oBAAoB,OAAO,YAAY,SAAS,CAAC;AAAA,EACxE;AACA,MAAI,CAAC,kBAAkB,UAAU,YAAY,QAAQ;AACnD,YAAQ,KAAK,EAAE,MAAM,kBAAkB,OAAO,YAAY,OAAO,CAAC;AAAA,EACpE;AACA,MAAI,CAAC,kBAAkB,iBAAiB,YAAY,eAAe;AACjE,YAAQ,KAAK;AAAA,MACX,MAAM;AAAA,MACN,OAAO,YAAY;AAAA,IACrB,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,SAAS,GAAG;AACtB,kBAAc,6CAA6C;AAC3D,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,GAAG,YAAY,kBAAkB,GAAG;AAAA,MACtC;AAAA,IACF;AACA;AAAA,MACE,gDAAgD,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,IACvF;AAAA,EACF;AACF;AAUA,sBAAsB,mCACpB,KACA,gBACA,YAKA,eACA,gBAC+C;AAC/C,QAAM,YACJ,gBAAgB,cAAc;AAGhC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,cAAY,gDAAgD;AAC5D,QAAM,kBAAkB,MAAM,yBAAyB,KAAK,UAAU;AACtE,MACE,gBAAgB,YAChB,gBAAgB,iBAChB,gBAAgB,QAChB;AACA;AAAA,MACE;AAAA,IACF;AAEA,QACE,UAAU,iBAAiB,UAC3B,UAAU,iBAAiB,OAC3B;AACA,YAAM;AAAA,QACJ;AAAA,QACA,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,UAAU;AAAA,MACZ;AAAA,IACF;AAGA,QAAI,UAAU,cAAc,UAAa,UAAU,cAAc,OAAO;AACtE,UAAI,CAAC,gBAAgB,QAAQ;AAE3B;AAAA,UACE;AAAA;AAAA,qBAEwB,WAAW,cAAc,QAAQ,OAAO,EAAE,CAAC;AAAA,QACrE;AAAA,MACF,OAAO;AACL,cAAM;AAAA,UACJ;AAAA,UACA,gBAAgB;AAAA,UAChB,UAAU;AAAA,UACV;AAAA,YACE,UAAU,gBAAgB;AAAA,YAC1B,QAAQ,gBAAgB;AAAA,YACxB,eAAe,gBAAgB;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,oBAAgB,kCAAkC;AAClD,WAAO;AAAA,EACT;AAGA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,EACF;AACA,QAAM,EAAE,yBAAyB,OAAO,IAAI;AAG5C,MAAK,SAAiB,UAAU;AAC9B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,yBAAyB;AAG5B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,WAAW,4BAA4B;AACzC,aAAO;AAAA,IACT;AACA;AAAA,EACF;AAMA,MAAI;AACJ,MAAI,UAAU,iBAAiB;AAG7B,4BACE,UAAU,oBAAoB,eAC1B,eACA;AAAA,EACR,OAAO;AAEL,4BACE,mBAAmB,SAAS,eAAe;AAAA,EAC/C;AAEA,QAAM,oBAAoB,MAAM;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,kBAAkB,SAAS;AAC9B,QACE,WAAW,qBACX,kBAAkB,UAAU,wBAC5B;AACA,aAAO,MAAM,IAAI,MAAM;AAAA,QACrB,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB,qDAAqD,kBAAkB,OAAO;AAAA,MAChG,CAAC;AAAA,IACH;AAEA,UAAM,eACJ,aAAa,oBACT,kBAAkB,UAClB;AACN,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,kBAAkB;AAC/B,MAAI,KAAK,kBAAkB;AACzB,eAAW,qCAAqC;AAAA,EAClD,OAAO;AACL;AAAA,MACE;AAAA,IACF;AAAA,EACF;AAEA,gBAAc,sDAAsD;AACpE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAEA,MACE,UAAU,iBAAiB,UAC3B,UAAU,iBAAiB,OAC3B;AACA,gBAAY,+CAA+C;AAC3D,UAAM;AAAA,MACJ;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAAA,EACF;AAGA,MAAI,UAAU,cAAc,UAAa,UAAU,cAAc,OAAO;AACtE,UAAM,wBAAwB,KAAK,KAAK,QAAQ,UAAU,WAAW;AAAA,MACnE,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,MACb,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AACA,kBAAgB,kCAAkC;AAElD,SAAO;AACT;AAMA,sBAAsB,+BACpB,KACA,gBACA,QACA,gBACA,UAGI,CAAC,GAIL;AACA,QAAM,WAAW,MAAM,mCAAmC,KAAK;AAAA,IAC7D;AAAA,EACF,CAAC;AACD,MAAI,aAAa,MAAM;AACrB,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,+CAA+C,cAAc;AAAA,IAC/E,CAAC;AAAA,EACH;AACA,cAAY;AAEZ,QAAM,gBAAgB,2DAA2D,SAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQlG,QAAM,iBAAiB,wFAAwF,SAAS,QAAQ;AAEhI,QAAM,QAAQ,MAAM,YAAY,KAAK;AAAA,IACnC,QAAQ,QAAQ,gBAAgB;AAAA,IAChC,SAAS,QAAQ,iBAAiB;AAAA,IAClC,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAMD,cAAc;AAAA;AAAA,EAEpC,CAAC;AACD,MAAI,CAAC,OAAO;AACV,eAAW,gDAAgD;AAC3D,WAAO,EAAE,SAAS,OAAO,QAAQ,YAAY;AAAA,EAC/C;AAEA,QAAM,eAAe,oBAAI,IAAoB;AAE7C,MAAI;AACJ,SAAO,MAAM;AACX,QAAI,SAAS;AACb,WAAO,WAAW,WAAW;AAC3B,YAAM,EAAE,gBAAgB,IACtB,MAAM,qCAAqC,GAAG;AAChD,eAAS,MAAM,cAAsB,KAAK;AAAA,QACxC,SACE,gBAAgB,WAAW,IACvB,sDACA;AAAA,QACN,QACE,gBAAgB,WAAW,IACvB,8GACA,gBAAgB,WAAW,IACzB,wDACA;AAAA,QACR,SAAS;AAAA,UACP,GAAG,gBAAgB,IAAI,CAACA,YAAmB;AAAA,YACzC,MAAM,GAAGA,MAAK,GAAG,aAAa,IAAIA,MAAK,IAAI,kEAAkE,EAAE;AAAA,YAC/G,OAAOA;AAAA,UACT,EAAE;AAAA,UACF;AAAA,YACE,MAAM;AAAA,YACN,OAAO;AAAA,UACT;AAAA,UACA;AAAA,YACE,MAAM;AAAA,YACN,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,WAAW,UAAU;AACvB,aAAO,EAAE,SAAS,OAAO,QAAQ,YAAY;AAAA,IAC/C;AACA,YAAQ;AAER,UAAM,aAAa,MAAM,2BAA2B,KAAK,QAAQ,KAAK;AAEtE,QAAI,WAAW,WAAW,oBAAoB;AAC5C,iBAAW,WAAW,OAAO;AAC7B,mBAAa,IAAI,OAAO,WAAW,OAAO;AAC1C;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,cAAc,WAAW;AAAA,MACzB,gBAAgB,WAAW;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,sBAAsB,gCACpB,KACA,gBACA,QACA,gBAC+C;AAC/C,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,SAAS;AACnB;AAAA,MACE;AAAA;AAAA;AAAA;AAAA,IAIF;AACA,WAAO;AAAA,EACT;AAEA,kBAAgB,kCAAkC;AAClD,SAAO;AACT;AAiBA,sBAAsB,oCACpB,KACA,gBACA,YAIA,gBACe;AAEf,QAAM,EAAE,cAAc,IAAI,MAAM,kBAAkB,GAAG;AACrD,QAAM,gBAAgB,MAAM,iBAAiB,KAAK,aAAa;AAC/D,MAAI,CAAC,eAAe;AAClB;AAAA,EACF;AAEA,QAAM,uBAAuB,kBAAkB;AAC/C,QAAM,YAAY,cAAc,oBAAoB;AACpD,MAAI,CAAC,WAAW;AACd;AAAA,EACF;AAGA,QAAM,EAAE,UAAU,QAAQ,eAAe,kBAAkB,IACzD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGF,MAAI,YAAY,QAAQ;AACtB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,EAAE,UAAU,QAAQ,cAAc;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAGA,MAAI,UAAU,gBAAgB,QAAQ,MAAM,SAAS,YAAY,QAAQ;AACvE,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB;AAAA,MACjB,UAAU;AAAA,IACZ;AAAA,EACF;AAGA,MAAI,UAAU,aAAa,QAAQ;AACjC,UAAM,eAIF;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAU;AACZ,mBAAa,WAAW;AAAA,IAC1B;AACA,QAAI,eAAe;AACjB,mBAAa,gBAAgB;AAAA,IAC/B;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAQA,sBAAsB,2BACpB,KACA,eACA,YAIkB;AAElB,QAAM,gBAAgB,MAAM,iBAAiB,KAAK,aAAa;AAC/D,MAAI,CAAC,eAAe;AAElB,WAAO;AAAA,EACT;AAGA,QAAM,YAAY,cAAc;AAChC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAGA,QAAM,CAAC,UAAU,QAAQ,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1D,mBAAmB,KAAK,YAAY,kBAAkB;AAAA,IACtD,mBAAmB,KAAK,YAAY,gBAAgB;AAAA,IACpD,mBAAmB,KAAK,YAAY,uBAAuB;AAAA,EAC7D,CAAC;AAGD,MAAI,CAAC,QAAQ;AAEX,WAAO;AAAA,EACT;AAGA,MAAI,UAAU,cAAc,UAAa,UAAU,cAAc,OAAO;AACtE,UAAM,oBAIF;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAU;AACZ,wBAAkB,WAAW;AAAA,IAC/B;AACA,QAAI,eAAe;AACjB,wBAAkB,gBAAgB;AAAA,IACpC;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAKA,SAAO;AACT;AAIA,eAAe,wBACb,KACA,cACA,mBACA,aACe;AACf,QAAM,gBAAgB,QAAQ,MAAM;AACpC,QAAM,iBAA2B,CAAC;AAGlC,QAAM,cAAwB,CAAC;AAC/B,MAAI,kBAAkB,cAAc,QAAQ;AAC1C,gBAAY;AAAA,MACV,GAAG,kBAAkB,aAAa,MAAM;AAAA,IAC1C;AAAA,EACF;AACA,MAAI,kBAAkB,gBAAgB;AACpC,gBAAY,KAAK,kBAAkB;AAAA,EACrC;AACA,MAAI,kBAAkB,aAAa,QAAQ;AACzC,gBAAY,KAAK,GAAG,kBAAkB,YAAY,MAAM,iBAAiB;AAAA,EAC3E;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B;AAAA,MACE,0CAA0C,YAAY,KAAK,IAAI,CAAC;AAAA,IAClE;AAAA,EACF,OAAO;AACL,eAAW,mDAAmD;AAC9D;AAAA,EACF;AAGA,MAAI,kBAAkB,cAAc;AAClC,eAAW,eAAe,kBAAkB,cAAc;AACxD,UAAI;AAEF,cAAM,sBAAsB,gBAAgB,aAAa,WAAW;AACpE,cAAM,EAAE,UAAU,iBAAiB,IAAI,MAAM;AAAA,UAC3C;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,kBAAkB;AACpB,wBAAc,qCAAqC;AACnD,qBAAW,+BAA+B,mBAAmB,EAAE;AAAA,QACjE,OAAO;AACL;AAAA,YACE,4CAA4C,mBAAmB;AAAA,UACjE;AAAA,QACF;AAAA,MACF,SAAS,OAAY;AACnB,YACE,iBACA,MAAM,SAAS,SAAS,yBAAyB,GACjD;AAEA,yBAAe;AAAA,YACb,iBAAiB,WAAW,MAAM,MAAM,OAAO;AAAA,UACjD;AAAA,QACF,OAAO;AAEL,iBAAO,MAAM,IAAI,MAAM;AAAA,YACrB,UAAU;AAAA,YACV,WAAW;AAAA,YACX,gBAAgB,mCAAmC,MAAM,OAAO;AAAA,UAClE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,kBAAkB,gBAAgB;AACpC,QAAI;AAEF,YAAM,yBAAyB;AAAA,QAC7B,kBAAkB;AAAA,QAClB;AAAA,MACF;AAEA,YAAM,EAAE,UAAU,sBAAsB,IAAI,MAAM;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,UAAI,uBAAuB;AACzB,sBAAc,yCAAyC;AACvD;AAAA,UACE,qCAAqC,sBAAsB;AAAA,QAC7D;AAAA,MACF,OAAO;AACL;AAAA,UACE;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAY;AACnB,UAAI,iBAAiB,MAAM,SAAS,SAAS,yBAAyB,GAAG;AAEvE,uBAAe;AAAA,UACb,qBAAqB,kBAAkB,cAAc,MAAM,MAAM,OAAO;AAAA,QAC1E;AAAA,MACF,OAAO;AAEL,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB,uCAAuC,MAAM,OAAO;AAAA,QACtE,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,OAAO;AACL,eAAW,gCAAgC;AAAA,EAC7C;AAGA,MAAI,kBAAkB,aAAa;AACjC,eAAW,cAAc,kBAAkB,aAAa;AACtD,UAAI;AAEF,cAAM,qBAAqB,gBAAgB,YAAY,WAAW;AAClE,cAAM,EAAE,UAAU,UAAU,IAAI,MAAM;AAAA,UACpC;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,WAAW;AACb,wBAAc,oCAAoC;AAClD,qBAAW,8BAA8B,kBAAkB,EAAE;AAAA,QAC/D,OAAO;AACL;AAAA,YACE,2CAA2C,kBAAkB;AAAA,UAC/D;AAAA,QACF;AAAA,MACF,SAAS,OAAY;AACnB,YACE,iBACA,MAAM,SAAS,SAAS,yBAAyB,GACjD;AAEA,yBAAe,KAAK,gBAAgB,UAAU,MAAM,MAAM,OAAO,EAAE;AAAA,QACrE,OAAO;AAEL,iBAAO,MAAM,IAAI,MAAM;AAAA,YACrB,UAAU;AAAA,YACV,WAAW;AAAA,YACX,gBAAgB,kCAAkC,MAAM,OAAO;AAAA,UACjE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,aAAW,wCAAwC;AAGnD,MAAI,eAAe,SAAS,GAAG;AAC7B,gBAAY;AACZ;AAAA,MACE;AAAA,IACE,eAAe,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AAAA,IACnD;AAAA,EACF;AACF;AAQO,gBAAS,gBACd,KACA,aACQ;AACR,SAAO,IAAI,QAAQ,kBAAkB,CAAC,OAAO,eAAe;AAE1D,QAAI,eAAe,4BAA4B;AAC7C,UAAI,CAAC,aAAa,UAAU;AAC1B,cAAM,IAAI;AAAA,UACR,2BAA2B,KAAK;AAAA,QAElC;AAAA,MACF;AACA,aAAO,YAAY;AAAA,IACrB;AACA,QAAI,eAAe,0BAA0B;AAC3C,UAAI,CAAC,aAAa,QAAQ;AACxB,cAAM,IAAI;AAAA,UACR,2BAA2B,KAAK;AAAA,QAElC;AAAA,MACF;AACA,aAAO,YAAY;AAAA,IACrB;AACA,QAAI,eAAe,iCAAiC;AAClD,UAAI,CAAC,aAAa,eAAe;AAC/B,cAAM,IAAI;AAAA,UACR,2BAA2B,KAAK;AAAA,QAElC;AAAA,MACF;AACA,aAAO,YAAY;AAAA,IACrB;AAGA,QAAI,WAAW,WAAW,WAAW,GAAG;AACtC,YAAM,UAAU,WAAW,UAAU,YAAY,MAAM;AACvD,YAAM,QAAQ,QAAQ,IAAI,OAAO;AACjC,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,2BAA2B,KAAK,0BAA0B,OAAO;AAAA,QACnE;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAGA,UAAM,IAAI;AAAA,MACR,gCAAgC,KAAK;AAAA,IAGvC;AAAA,EACF,CAAC;AACH;AAIA,eAAe,eACb,KACA,UACA,QACA,eACA,oBACA;AACA,QAAM,UAAU;AAEhB,MAAI,sBAAsB,IAAI,GAAG,OAAO,OAAO,IAC3C,IAAI,GAAG,aAAa,OAAO,IAC3B;AAGJ,MAAI,mBAOA,CAAC;AAEL,QAAM,EAAE,kBAAkB,IAAI,MAAM,qBAAqB,GAAG;AAG5D,QAAM,kBAAkB,sBACpB,OAAO,MAAM,mBAAmB,IAChC,CAAC;AAEL,aAAW,CAAC,YAAY,aAAa,KAAK,OAAO;AAAA,IAC/C;AAAA,EACF,GAAG;AAED,QAAI,gBAAgB,UAAU,GAAG;AAC/B,iBAAW,YAAY,UAAU,iCAAiC;AAClE;AAAA,IACF;AAGA,QAAI,QAAQ,IAAI,UAAU,GAAG;AAC3B;AAAA,QACE,YAAY,UAAU;AAAA,MACxB;AACA;AAAA,IACF;AAGA,UAAM,gBAAgB,gBAAgB,eAAe;AAAA,MACnD;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAGD,QACE,OAAO,KAAK,gBAAgB,EAAE,WAAW,MACxC,cAAc,SAAS,0BAA0B,KAChD,kBAAkB,gCACpB;AACA,uBAAiB,UAAU,IAAI;AAAA,QAC7B,OAAO;AAAA,QACP,uBAAuB,6BAA6B,UAAU,eAAe,iBAAiB,CAAC;AAAA,MACjG;AAAA,IACF,OAAO;AACL,uBAAiB,UAAU,IAAI,EAAE,OAAO,cAAc;AAAA,IACxD;AAAA,EACF;AAGA,OACG,sBAAsB,aACrB,sBAAsB,oBACxB,CAAC,QAAQ,IAAI,wBAAwB;AAAA,GACpC,CAAC,uBACA,CAAC,oBAAoB,SAAS,wBAAwB,IACxD;AACA,qBAAiB,wBAAwB,IAAI;AAAA,MAC3C,OAAO,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,IACpD;AAAA,EACF;AAEA,aAAW;AAAA,IACT;AAAA,IACA,EAAE,OAAO,aAAa,uBAAuB,kBAAkB;AAAA,EACjE,KAAK,OAAO,QAAQ,gBAAgB,GAO/B;AACH,0BACE,kBAAkB;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB,qBAAqB;AAAA,MACxC,uBAAuB,yBAAyB;AAAA,IAClD,CAAC,KAAK;AAAA,EACV;AAEA,MACE,wBAAwB,QACxB,OAAO,KAAK,gBAAgB,EAAE,SAAS,GACvC;AACA,QAAI,GAAG,cAAc,SAAS,mBAAmB;AACjD;AAAA,MACE,2BAA2B,OAAO,KAAK,gBAAgB,EAAE,KAAK,IAAI,CAAC;AAAA,IACrE;AAAA,EACF;AACF;AAEA,eAAe,yBACb,KACA,YAQC;AACD,QAAM,CAAC,UAAU,eAAe,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1D,mBAAmB,KAAK,YAAY,kBAAkB;AAAA,IACtD,mBAAmB,KAAK,YAAY,uBAAuB;AAAA,IAC3D,mBAAmB,KAAK,YAAY,gBAAgB;AAAA,EACtD,CAAC;AAED,SAAO,EAAE,UAAU,eAAe,OAAO;AAC3C;AAEA,eAAe,iBACb,KACA,YAKA,gBACA,qBACA,yBACA;AACA,QAAM,+BAA+B,KAAK,YAAY;AAAA,IACpD,EAAE,MAAM,oBAAoB,OAAO,eAAe;AAAA,IAClD,EAAE,MAAM,yBAAyB,OAAO,oBAAoB;AAAA,IAC5D,EAAE,MAAM,kBAAkB,OAAO,wBAAwB;AAAA,EAC3D,CAAC;AACH;AAGA,SAAS,UAAU,eAAuB,SAAmB;AAC3D,SAAO,gCAAgC,aAAa,GAAG,OAAO;AAChE;",
   "names": ["email"]
 }

package/dist/esm/index.js

@@ -1,3 +1,3 @@
 "use strict";
-export const version = "1.34.0";
+export const version = "1.35.0";
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/index.ts"],
-  "sourcesContent": ["export const version = \"1.34.0\";\n"],
+  "sourcesContent": ["export const version = \"1.35.0\";\n"],
   "mappings": ";AAAO,aAAM,UAAU;",
   "names": []
 }

package/dist/esm/react/client.js

@@ -445,13 +445,26 @@ export const ConvexProvider = ({ client, children }) => {
     children
   );
 };
-export function useQuery(query, ...args) {
-  const skip = args[0] === "skip";
-  const argsObject = args[0] === "skip" ? {} : parseArgs(args[0]);
-  const queryReference = typeof query === "string" ? makeFunctionReference(query) : query;
-  const queryName = getFunctionName(queryReference);
+export function useQuery(queryOrOptions, ...args) {
+  const isObjectOptions = typeof queryOrOptions === "object" && queryOrOptions !== null && "query" in queryOrOptions;
+  const throwOnError = isObjectOptions ? queryOrOptions.throwOnError ?? false : true;
+  let queryReference;
+  let argsObject = {};
+  if (isObjectOptions) {
+    const query = queryOrOptions.query;
+    queryReference = typeof query === "string" ? makeFunctionReference(query) : query;
+    if (queryOrOptions.args !== "skip") {
+      argsObject = parseArgs(queryOrOptions.args);
+    }
+  } else {
+    const query = queryOrOptions;
+    queryReference = typeof query === "string" ? makeFunctionReference(query) : query;
+    argsObject = args[0] === "skip" ? {} : parseArgs(args[0]);
+  }
+  const queryName = queryReference ? getFunctionName(queryReference) : void 0;
+  const skip = isObjectOptions && queryOrOptions.args === "skip" || !isObjectOptions && args[0] === "skip";
   const queries = useMemo(
-    () => skip ? {} : { query: { query: queryReference, args: argsObject } },
+    () => skip || !queryReference ? {} : { query: { query: queryReference, args: argsObject } },
     // Stringify args so args that are semantically the same don't trigger a
     // rerender. Saves developers from adding `useMemo` on every args usage.
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -459,6 +472,30 @@ export function useQuery(query, ...args) {
   );
   const results = useQueries(queries);
   const result = results["query"];
+  if (isObjectOptions) {
+    if (result instanceof Error) {
+      if (throwOnError) {
+        throw result;
+      }
+      return {
+        data: void 0,
+        error: result,
+        status: "error"
+      };
+    }
+    if (result === void 0) {
+      return {
+        data: void 0,
+        error: void 0,
+        status: "pending"
+      };
+    }
+    return {
+      data: result,
+      error: void 0,
+      status: "success"
+    };
+  }
   if (result instanceof Error) {
     throw result;
   }