workos 0.0.23 → 0.1.0

package/.claude-plugin/plugin.json

@@ -0,0 +1,13 @@
+{
+  "name": "workos-authkit-wizard",
+  "version": "1.0.0",
+  "description": "WorkOS AuthKit integration skills for multiple frameworks",
+  "author": {
+    "name": "WorkOS",
+    "url": "https://workos.com"
+  },
+  "homepage": "https://workos.com/docs/user-management/authkit",
+  "repository": "https://github.com/workos/authkit-wizard",
+  "license": "MIT",
+  "keywords": ["workos", "authkit", "authentication", "wizard"]
+}

package/LICENSE

@@ -0,0 +1,47 @@
+MIT License
+
+Copyright (c) 2026 WorkOS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+--------------------------------------------------------------------------------
+
+Portions of this software are derived from Sentry’s codebase located at https://github.com/getsentry/sentry-wizard and are used under the terms of the MIT License provided below:
+
+The MIT License (MIT)
+
+Copyright (c) 2017 Sentry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1 +1,154 @@
-# WorkOS CLI
+# workos
+
+AI-powered CLI that automatically integrates WorkOS AuthKit into web applications.
+
+## Installation
+
+```bash
+# Run directly with npx (recommended)
+npx workos
+
+# Or install globally
+npm install -g workos
+workos
+```
+
+## Features
+
+- **5 Framework Support:** Next.js, React Router, TanStack Start, React SPA, Vanilla JS
+- **AI-Powered:** Uses Claude to intelligently adapt to your project structure
+- **Security-First:** Masks API keys, redacts from logs, saves to .env.local
+- **Smart Detection:** Auto-detects framework, package manager, router type
+- **Live Documentation:** Fetches latest SDK docs from WorkOS and GitHub
+- **Full Integration:** Creates routes, middleware, environment vars, and UI
+
+## What It Creates
+
+Depending on your framework, the wizard creates:
+
+- ✅ Authentication routes (callback, sign-in, sign-out)
+- ✅ Middleware for route protection
+- ✅ Environment variable configuration
+- ✅ SDK installation with correct package manager
+- ✅ UI components showing login status
+- ✅ User info display (name, email)
+
+## Credentials
+
+Get your credentials from [dashboard.workos.com](https://dashboard.workos.com):
+
+- **API Key** (sk_test_xxx or sk_live_xxx) - For server-side frameworks only
+- **Client ID** (client_xxx) - Required for all frameworks
+
+**Security:** API keys are masked during input and redacted in logs.
+
+## CLI Options
+
+```bash
+workos [options] [command]
+
+Commands:
+  dashboard              Run with visual TUI dashboard (experimental)
+  login                  Authenticate with WorkOS via Connect OAuth device flow
+  logout                 Remove stored credentials
+  install-skill          Install AuthKit skills to coding agents (Claude Code, Codex, etc.)
+    --list, -l           List available skills without installing
+    --skill, -s          Install specific skill(s)
+    --agent, -a          Target agent(s): claude-code, codex, cursor, goose
+
+Options:
+  --integration <name>    Framework: nextjs, react, react-router, tanstack-start, vanilla-js
+  --redirect-uri <uri>    Custom redirect URI (defaults to framework convention)
+  --homepage-url <url>    Custom homepage URL (defaults to http://localhost:{port})
+  --install-dir <path>    Installation directory
+  --no-validate           Skip post-installation validation (includes build check)
+  --force-install         Force install packages even if peer dependency checks fail
+  --debug                 Enable verbose logging
+
+Environment Variables:
+  WORKOS_TELEMETRY=false  Disable telemetry collection
+```
+
+## Examples
+
+```bash
+# Interactive (recommended)
+npx workos
+
+# Specify framework
+npx workos --integration react-router
+
+# With visual dashboard (experimental)
+npx workos dashboard
+```
+
+## Authentication
+
+The CLI uses WorkOS Connect OAuth device flow for authentication:
+
+```bash
+# Login (opens browser for authentication)
+workos login
+
+# Logout (clears stored credentials)
+workos logout
+```
+
+Credentials are stored in `~/.workos/credentials.json`. Access tokens are not persisted long-term for security - users re-authenticate when tokens expire.
+
+## How It Works
+
+1. **Detects** your framework and project structure
+2. **Prompts** for WorkOS credentials (API key masked)
+3. **Auto-configures** WorkOS dashboard (redirect URI, CORS, homepage URL)
+4. **Fetches** latest SDK documentation from workos.com
+5. **Uses AI** (Claude) to generate integration code
+6. **Installs** SDK with detected package manager
+7. **Creates** auth routes, middleware, and UI
+8. **Configures** environment variables securely
+
+## Telemetry
+
+The wizard collects anonymous usage telemetry to help improve the product:
+
+- Session outcome (success/error/cancelled)
+- Framework detected
+- Duration and step timing
+- Token usage (for capacity planning)
+
+No code, credentials, or personal data is collected. Disable with:
+
+```bash
+WORKOS_TELEMETRY=false npx workos
+```
+
+## Logs
+
+Detailed logs (with redacted credentials) are saved to:
+
+```
+~/.workos/logs/workos-{timestamp}.log
+```
+
+Up to 10 session log files are retained. Use `--debug` flag for verbose terminal output.
+
+## Development
+
+See [DEVELOPMENT.md](./DEVELOPMENT.md) for development setup.
+
+Build:
+
+```bash
+pnpm build
+```
+
+Run locally:
+
+```bash
+pnpm dev  # Watch mode
+./dist/bin.js --help
+```
+
+## License
+
+MIT © WorkOS

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+// Load .env.local for local development when --local flag is used
+if (process.argv.includes('--local') || process.env.WIZARD_DEV) {
+    const { config } = await import('dotenv');
+    // bin.ts compiles to dist/bin.js, so go up one level to find .env.local
+    config({ path: new URL('../.env.local', import.meta.url).pathname });
+}
+import { satisfies } from 'semver';
+import { red } from './src/utils/logging.js';
+import { getConfig } from './src/lib/settings.js';
+import yargs from 'yargs';
+import { hideBin } from 'yargs/helpers';
+const NODE_VERSION_RANGE = getConfig().nodeVersion;
+// Have to run this above the other imports because they are importing clack that
+// has the problematic imports.
+if (!satisfies(process.version, NODE_VERSION_RANGE)) {
+    red(`WorkOS AuthKit wizard requires Node.js ${NODE_VERSION_RANGE}. You are using Node.js ${process.version}. Please upgrade your Node.js version.`);
+    process.exit(1);
+}
+import { isNonInteractiveEnvironment } from './src/utils/environment.js';
+import clack from './src/utils/clack.js';
+// Shared options for wizard commands (default and dashboard)
+const wizardOptions = {
+    debug: {
+        default: false,
+        describe: 'Enable verbose logging',
+        type: 'boolean',
+    },
+    // Hidden dev/automation flags (use env vars)
+    local: {
+        default: false,
+        type: 'boolean',
+        hidden: true,
+    },
+    ci: {
+        default: false,
+        type: 'boolean',
+        hidden: true,
+    },
+    'skip-auth': {
+        default: false,
+        type: 'boolean',
+        hidden: true,
+    },
+    'api-key': {
+        type: 'string',
+        hidden: true,
+    },
+    'client-id': {
+        type: 'string',
+        hidden: true,
+    },
+    inspect: {
+        default: false,
+        type: 'boolean',
+        hidden: true,
+    },
+    // User-facing flags
+    'homepage-url': {
+        describe: 'App homepage URL for WorkOS (defaults to http://localhost:{port})',
+        type: 'string',
+    },
+    'redirect-uri': {
+        describe: 'Redirect URI for WorkOS callback (defaults to framework convention)',
+        type: 'string',
+    },
+    'no-validate': {
+        default: false,
+        describe: 'Skip post-installation validation (includes build check)',
+        type: 'boolean',
+    },
+    'install-dir': {
+        describe: 'Directory to install WorkOS AuthKit in',
+        type: 'string',
+    },
+    integration: {
+        describe: 'Integration to set up',
+        choices: ['nextjs', 'react', 'tanstack-start', 'react-router', 'vanilla-js'],
+        type: 'string',
+    },
+    'force-install': {
+        default: false,
+        describe: 'Force install packages even if peer dependency checks fail',
+        type: 'boolean',
+    },
+    dashboard: {
+        alias: 'd',
+        default: false,
+        describe: 'Run with visual dashboard mode',
+        type: 'boolean',
+    },
+};
+yargs(hideBin(process.argv))
+    .env('WORKOS_WIZARD')
+    .command('login', 'Authenticate with WorkOS', {}, async () => {
+    const { runLogin } = await import('./src/commands/login.js');
+    await runLogin();
+    process.exit(0);
+})
+    .command('logout', 'Remove stored credentials', {}, async () => {
+    const { runLogout } = await import('./src/commands/logout.js');
+    await runLogout();
+})
+    .command('install-skill', 'Install bundled AuthKit skills to coding agents', (yargs) => {
+    return yargs
+        .option('list', {
+        alias: 'l',
+        type: 'boolean',
+        description: 'List available skills without installing',
+    })
+        .option('skill', {
+        alias: 's',
+        type: 'array',
+        string: true,
+        description: 'Install specific skill(s)',
+    })
+        .option('agent', {
+        alias: 'a',
+        type: 'array',
+        string: true,
+        description: 'Target specific agent(s): claude-code, codex, cursor, goose',
+    });
+}, async (argv) => {
+    const { runInstallSkill } = await import('./src/commands/install-skill.js');
+    await runInstallSkill({
+        list: argv.list,
+        skill: argv.skill,
+        agent: argv.agent,
+    });
+})
+    .command('install', 'Install WorkOS AuthKit into your project', (yargs) => yargs.options(wizardOptions), async (argv) => {
+    const { handleInstall } = await import('./src/commands/install.js');
+    await handleInstall(argv);
+})
+    .command('dashboard', false, // hidden from help
+(yargs) => yargs.options(wizardOptions), async (argv) => {
+    const { handleInstall } = await import('./src/commands/install.js');
+    await handleInstall({ ...argv, dashboard: true });
+})
+    .command(['$0'], 'WorkOS AuthKit CLI', (yargs) => yargs, async () => {
+    // Non-TTY: show help
+    if (isNonInteractiveEnvironment()) {
+        yargs(hideBin(process.argv)).showHelp();
+        return;
+    }
+    // TTY: ask if user wants to run installer
+    const shouldInstall = await clack.confirm({
+        message: 'Run the AuthKit installer?',
+    });
+    if (clack.isCancel(shouldInstall) || !shouldInstall) {
+        process.exit(0);
+    }
+    const { handleInstall } = await import('./src/commands/install.js');
+    await handleInstall({ dashboard: false });
+    process.exit(0);
+})
+    .strict()
+    .help()
+    .alias('help', 'h')
+    .version()
+    .alias('version', 'v')
+    .wrap(process.stdout.isTTY && process.stdout.columns ? process.stdout.columns : 80).argv;
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../bin.ts"],"names":[],"mappings":";AAEA,kEAAkE;AAClE,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,wEAAwE;IACxE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,MAAM,kBAAkB,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;AAEnD,iFAAiF;AACjF,+BAA+B;AAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC;IACpD,GAAG,CACD,0CAA0C,kBAAkB,2BAA2B,OAAO,CAAC,OAAO,wCAAwC,CAC/I,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,MAAM,sBAAsB,CAAC;AAEzC,6DAA6D;AAC7D,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,wBAAwB;QAClC,IAAI,EAAE,SAAkB;KACzB;IACD,6CAA6C;IAC7C,KAAK,EAAE;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,EAAE,EAAE;QACF,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,WAAW,EAAE;QACX,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,SAAS,EAAE;QACT,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,IAAI;KACb;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,IAAI;KACb;IACD,OAAO,EAAE;QACP,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,oBAAoB;IACpB,cAAc,EAAE;QACd,QAAQ,EAAE,mEAAmE;QAC7E,IAAI,EAAE,QAAiB;KACxB;IACD,cAAc,EAAE;QACd,QAAQ,EAAE,qEAAqE;QAC/E,IAAI,EAAE,QAAiB;KACxB;IACD,aAAa,EAAE;QACb,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,0DAA0D;QACpE,IAAI,EAAE,SAAkB;KACzB;IACD,aAAa,EAAE;QACb,QAAQ,EAAE,wCAAwC;QAClD,IAAI,EAAE,QAAiB;KACxB;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,CAAU;QACrF,IAAI,EAAE,QAAiB;KACxB;IACD,eAAe,EAAE;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,4DAA4D;QACtE,IAAI,EAAE,SAAkB;KACzB;IACD,SAAS,EAAE;QACT,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,gCAAgC;QAC1C,IAAI,EAAE,SAAkB;KACzB;CACF,CAAC;AAEF,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,GAAG,CAAC,eAAe,CAAC;KACpB,OAAO,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC7D,MAAM,QAAQ,EAAE,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;KACD,OAAO,CAAC,QAAQ,EAAE,2BAA2B,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC/D,MAAM,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;KACD,OAAO,CACN,eAAe,EACf,iDAAiD,EACjD,CAAC,KAAK,EAAE,EAAE;IACR,OAAO,KAAK;SACT,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,2BAA2B;KACzC,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,6DAA6D;KAC3E,CAAC,CAAC;AACP,CAAC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;IACb,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAC5E,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,IAA2B;QACtC,KAAK,EAAE,IAAI,CAAC,KAA6B;QACzC,KAAK,EAAE,IAAI,CAAC,KAA6B;KAC1C,CAAC,CAAC;AACL,CAAC,CACF;KACA,OAAO,CACN,SAAS,EACT,0CAA0C,EAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EACvC,KAAK,EAAE,IAAI,EAAE,EAAE;IACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACpE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CACF;KACA,OAAO,CACN,WAAW,EACX,KAAK,EAAE,mBAAmB;AAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EACvC,KAAK,EAAE,IAAI,EAAE,EAAE;IACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACpE,MAAM,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC,CACF;KACA,OAAO,CACN,CAAC,IAAI,CAAC,EACN,oBAAoB,EACpB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAChB,KAAK,IAAI,EAAE;IACT,qBAAqB;IACrB,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IAED,0CAA0C;IAC1C,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;QACxC,OAAO,EAAE,4BAA4B;KACtC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACpE,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAS,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF;KACA,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;KAClB,OAAO,EAAE;KACT,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;KACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC","sourcesContent":["#!/usr/bin/env node\n\n// Load .env.local for local development when --local flag is used\nif (process.argv.includes('--local') || process.env.WIZARD_DEV) {\n  const { config } = await import('dotenv');\n  // bin.ts compiles to dist/bin.js, so go up one level to find .env.local\n  config({ path: new URL('../.env.local', import.meta.url).pathname });\n}\n\nimport { satisfies } from 'semver';\nimport { red } from './src/utils/logging.js';\nimport { getConfig } from './src/lib/settings.js';\n\nimport yargs from 'yargs';\nimport { hideBin } from 'yargs/helpers';\nimport chalk from 'chalk';\n\nconst NODE_VERSION_RANGE = getConfig().nodeVersion;\n\n// Have to run this above the other imports because they are importing clack that\n// has the problematic imports.\nif (!satisfies(process.version, NODE_VERSION_RANGE)) {\n  red(\n    `WorkOS AuthKit wizard requires Node.js ${NODE_VERSION_RANGE}. You are using Node.js ${process.version}. Please upgrade your Node.js version.`,\n  );\n  process.exit(1);\n}\n\nimport { isNonInteractiveEnvironment } from './src/utils/environment.js';\nimport clack from './src/utils/clack.js';\n\n// Shared options for wizard commands (default and dashboard)\nconst wizardOptions = {\n  debug: {\n    default: false,\n    describe: 'Enable verbose logging',\n    type: 'boolean' as const,\n  },\n  // Hidden dev/automation flags (use env vars)\n  local: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  ci: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  'skip-auth': {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  'api-key': {\n    type: 'string' as const,\n    hidden: true,\n  },\n  'client-id': {\n    type: 'string' as const,\n    hidden: true,\n  },\n  inspect: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  // User-facing flags\n  'homepage-url': {\n    describe: 'App homepage URL for WorkOS (defaults to http://localhost:{port})',\n    type: 'string' as const,\n  },\n  'redirect-uri': {\n    describe: 'Redirect URI for WorkOS callback (defaults to framework convention)',\n    type: 'string' as const,\n  },\n  'no-validate': {\n    default: false,\n    describe: 'Skip post-installation validation (includes build check)',\n    type: 'boolean' as const,\n  },\n  'install-dir': {\n    describe: 'Directory to install WorkOS AuthKit in',\n    type: 'string' as const,\n  },\n  integration: {\n    describe: 'Integration to set up',\n    choices: ['nextjs', 'react', 'tanstack-start', 'react-router', 'vanilla-js'] as const,\n    type: 'string' as const,\n  },\n  'force-install': {\n    default: false,\n    describe: 'Force install packages even if peer dependency checks fail',\n    type: 'boolean' as const,\n  },\n  dashboard: {\n    alias: 'd',\n    default: false,\n    describe: 'Run with visual dashboard mode',\n    type: 'boolean' as const,\n  },\n};\n\nyargs(hideBin(process.argv))\n  .env('WORKOS_WIZARD')\n  .command('login', 'Authenticate with WorkOS', {}, async () => {\n    const { runLogin } = await import('./src/commands/login.js');\n    await runLogin();\n    process.exit(0);\n  })\n  .command('logout', 'Remove stored credentials', {}, async () => {\n    const { runLogout } = await import('./src/commands/logout.js');\n    await runLogout();\n  })\n  .command(\n    'install-skill',\n    'Install bundled AuthKit skills to coding agents',\n    (yargs) => {\n      return yargs\n        .option('list', {\n          alias: 'l',\n          type: 'boolean',\n          description: 'List available skills without installing',\n        })\n        .option('skill', {\n          alias: 's',\n          type: 'array',\n          string: true,\n          description: 'Install specific skill(s)',\n        })\n        .option('agent', {\n          alias: 'a',\n          type: 'array',\n          string: true,\n          description: 'Target specific agent(s): claude-code, codex, cursor, goose',\n        });\n    },\n    async (argv) => {\n      const { runInstallSkill } = await import('./src/commands/install-skill.js');\n      await runInstallSkill({\n        list: argv.list as boolean | undefined,\n        skill: argv.skill as string[] | undefined,\n        agent: argv.agent as string[] | undefined,\n      });\n    },\n  )\n  .command(\n    'install',\n    'Install WorkOS AuthKit into your project',\n    (yargs) => yargs.options(wizardOptions),\n    async (argv) => {\n      const { handleInstall } = await import('./src/commands/install.js');\n      await handleInstall(argv);\n    },\n  )\n  .command(\n    'dashboard',\n    false, // hidden from help\n    (yargs) => yargs.options(wizardOptions),\n    async (argv) => {\n      const { handleInstall } = await import('./src/commands/install.js');\n      await handleInstall({ ...argv, dashboard: true });\n    },\n  )\n  .command(\n    ['$0'],\n    'WorkOS AuthKit CLI',\n    (yargs) => yargs,\n    async () => {\n      // Non-TTY: show help\n      if (isNonInteractiveEnvironment()) {\n        yargs(hideBin(process.argv)).showHelp();\n        return;\n      }\n\n      // TTY: ask if user wants to run installer\n      const shouldInstall = await clack.confirm({\n        message: 'Run the AuthKit installer?',\n      });\n\n      if (clack.isCancel(shouldInstall) || !shouldInstall) {\n        process.exit(0);\n      }\n\n      const { handleInstall } = await import('./src/commands/install.js');\n      await handleInstall({ dashboard: false } as any);\n      process.exit(0);\n    },\n  )\n  .strict()\n  .help()\n  .alias('help', 'h')\n  .version()\n  .alias('version', 'v')\n  .wrap(process.stdout.isTTY && process.stdout.columns ? process.stdout.columns : 80).argv;\n"]}

package/dist/cli.config.d.ts

@@ -0,0 +1,52 @@
+export declare const config: {
+    readonly model: "claude-opus-4-5-20251101";
+    readonly workos: {
+        readonly clientId: "client_01KFKHSZWK9ADVJV854PDFQCCR";
+        readonly authkitDomain: "https://signin.workos.com";
+        readonly llmGatewayUrl: "https://api.workos.com/llm-gateway";
+    };
+    readonly telemetry: {
+        readonly enabled: true;
+        readonly eventName: "wizard interaction";
+    };
+    readonly nodeVersion: ">=20.20";
+    readonly logging: {
+        readonly debugMode: false;
+    };
+    readonly documentation: {
+        readonly workosDocsUrl: "https://workos.com/docs/authkit";
+        readonly dashboardUrl: "https://dashboard.workos.com";
+        readonly issuesUrl: "https://github.com/workos/installer/issues";
+    };
+    readonly frameworks: {
+        readonly nextjs: {
+            readonly port: 3000;
+            readonly callbackPath: "/auth/callback";
+        };
+        readonly react: {
+            readonly port: 5173;
+            readonly callbackPath: "/callback";
+        };
+        readonly tanstackStart: {
+            readonly port: 3000;
+            readonly callbackPath: "/api/auth/callback";
+        };
+        readonly reactRouter: {
+            readonly port: 5173;
+            readonly callbackPath: "/callback";
+        };
+        readonly vanillaJs: {
+            readonly port: 5173;
+            readonly callbackPath: "/callback";
+        };
+    };
+    readonly legacy: {
+        readonly oauthPort: 8239;
+    };
+    readonly branding: {
+        readonly showAsciiArt: true;
+        readonly useCompact: false;
+        readonly compactAsciiArt: "⚡ WorkOS AuthKit Wizard";
+        readonly asciiArt: "░██       ░██                     ░██         ░██████     ░██████\n░██       ░██                     ░██        ░██   ░██   ░██   ░██\n░██  ░██  ░██  ░███████  ░██░████ ░██    ░██░██     ░██ ░██\n░██ ░████ ░██ ░██    ░██ ░███     ░██   ░██ ░██     ░██  ░████████\n░██░██ ░██░██ ░██    ░██ ░██      ░███████  ░██     ░██         ░██\n░████   ░████ ░██    ░██ ░██      ░██   ░██  ░██   ░██   ░██   ░██\n░███     ░███  ░███████  ░██      ░██    ░██  ░██████     ░██████\n\n\n\n   ░███                  ░██    ░██        ░██     ░██ ░██   ░██\n  ░██░██                 ░██    ░██        ░██    ░██        ░██\n ░██  ░██  ░██    ░██ ░████████ ░████████  ░██   ░██   ░██░████████\n░█████████ ░██    ░██    ░██    ░██    ░██ ░███████    ░██   ░██\n░██    ░██ ░██    ░██    ░██    ░██    ░██ ░██   ░██   ░██   ░██\n░██    ░██ ░██   ░███    ░██    ░██    ░██ ░██    ░██  ░██   ░██\n░██    ░██  ░█████░██     ░████ ░██    ░██ ░██     ░██ ░██    ░████    ";
+    };
+};

package/dist/cli.config.js

@@ -0,0 +1,70 @@
+export const config = {
+    model: 'claude-opus-4-5-20251101',
+    // Production defaults - override via env vars for local dev
+    workos: {
+        clientId: 'client_01KFKHSZWK9ADVJV854PDFQCCR',
+        authkitDomain: 'https://signin.workos.com',
+        llmGatewayUrl: 'https://api.workos.com/llm-gateway',
+    },
+    telemetry: {
+        enabled: true,
+        eventName: 'wizard interaction',
+    },
+    nodeVersion: '>=20.20',
+    logging: {
+        debugMode: false,
+    },
+    documentation: {
+        workosDocsUrl: 'https://workos.com/docs/authkit',
+        dashboardUrl: 'https://dashboard.workos.com',
+        issuesUrl: 'https://github.com/workos/installer/issues',
+    },
+    frameworks: {
+        nextjs: {
+            port: 3000,
+            callbackPath: '/auth/callback',
+        },
+        react: {
+            port: 5173,
+            callbackPath: '/callback',
+        },
+        tanstackStart: {
+            port: 3000,
+            callbackPath: '/api/auth/callback',
+        },
+        reactRouter: {
+            port: 5173,
+            callbackPath: '/callback',
+        },
+        vanillaJs: {
+            port: 5173,
+            callbackPath: '/callback',
+        },
+    },
+    legacy: {
+        oauthPort: 8239,
+    },
+    branding: {
+        showAsciiArt: true,
+        useCompact: false,
+        compactAsciiArt: `⚡ WorkOS AuthKit Wizard`,
+        asciiArt: `░██       ░██                     ░██         ░██████     ░██████
+░██       ░██                     ░██        ░██   ░██   ░██   ░██
+░██  ░██  ░██  ░███████  ░██░████ ░██    ░██░██     ░██ ░██
+░██ ░████ ░██ ░██    ░██ ░███     ░██   ░██ ░██     ░██  ░████████
+░██░██ ░██░██ ░██    ░██ ░██      ░███████  ░██     ░██         ░██
+░████   ░████ ░██    ░██ ░██      ░██   ░██  ░██   ░██   ░██   ░██
+░███     ░███  ░███████  ░██      ░██    ░██  ░██████     ░██████
+
+
+
+   ░███                  ░██    ░██        ░██     ░██ ░██   ░██
+  ░██░██                 ░██    ░██        ░██    ░██        ░██
+ ░██  ░██  ░██    ░██ ░████████ ░████████  ░██   ░██   ░██░████████
+░█████████ ░██    ░██    ░██    ░██    ░██ ░███████    ░██   ░██
+░██    ░██ ░██    ░██    ░██    ░██    ░██ ░██   ░██   ░██   ░██
+░██    ░██ ░██   ░███    ░██    ░██    ░██ ░██    ░██  ░██   ░██
+░██    ░██  ░█████░██     ░████ ░██    ░██ ░██     ░██ ░██    ░████    `,
+    },
+};
+//# sourceMappingURL=cli.config.js.map

package/dist/cli.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.config.js","sourceRoot":"","sources":["../cli.config.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,0BAA0B;IAEjC,4DAA4D;IAC5D,MAAM,EAAE;QACN,QAAQ,EAAE,mCAAmC;QAC7C,aAAa,EAAE,2BAA2B;QAC1C,aAAa,EAAE,oCAAoC;KACpD;IAED,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,oBAAoB;KAChC;IAED,WAAW,EAAE,SAAS;IAEtB,OAAO,EAAE;QACP,SAAS,EAAE,KAAK;KACjB;IAED,aAAa,EAAE;QACb,aAAa,EAAE,iCAAiC;QAChD,YAAY,EAAE,8BAA8B;QAC5C,SAAS,EAAE,4CAA4C;KACxD;IAED,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;QACD,aAAa,EAAE;YACb,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,oBAAoB;SACnC;QACD,WAAW,EAAE;YACX,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;KACF;IAED,MAAM,EAAE;QACN,SAAS,EAAE,IAAI;KAChB;IAED,QAAQ,EAAE;QACR,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,yBAAyB;QAC1C,QAAQ,EAAE;;;;;;;;;;;;;;;;wEAgB0D;KACrE;CACiC,CAAC","sourcesContent":["import type { InstallerConfig } from './src/lib/settings.js';\n\nexport const config = {\n  model: 'claude-opus-4-5-20251101',\n\n  // Production defaults - override via env vars for local dev\n  workos: {\n    clientId: 'client_01KFKHSZWK9ADVJV854PDFQCCR',\n    authkitDomain: 'https://signin.workos.com',\n    llmGatewayUrl: 'https://api.workos.com/llm-gateway',\n  },\n\n  telemetry: {\n    enabled: true,\n    eventName: 'wizard interaction',\n  },\n\n  nodeVersion: '>=20.20',\n\n  logging: {\n    debugMode: false,\n  },\n\n  documentation: {\n    workosDocsUrl: 'https://workos.com/docs/authkit',\n    dashboardUrl: 'https://dashboard.workos.com',\n    issuesUrl: 'https://github.com/workos/installer/issues',\n  },\n\n  frameworks: {\n    nextjs: {\n      port: 3000,\n      callbackPath: '/auth/callback',\n    },\n    react: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n    tanstackStart: {\n      port: 3000,\n      callbackPath: '/api/auth/callback',\n    },\n    reactRouter: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n    vanillaJs: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n  },\n\n  legacy: {\n    oauthPort: 8239,\n  },\n\n  branding: {\n    showAsciiArt: true,\n    useCompact: false,\n    compactAsciiArt: `⚡ WorkOS AuthKit Wizard`,\n    asciiArt: `░██       ░██                     ░██         ░██████     ░██████\n░██       ░██                     ░██        ░██   ░██   ░██   ░██\n░██  ░██  ░██  ░███████  ░██░████ ░██    ░██░██     ░██ ░██\n░██ ░████ ░██ ░██    ░██ ░███     ░██   ░██ ░██     ░██  ░████████\n░██░██ ░██░██ ░██    ░██ ░██      ░███████  ░██     ░██         ░██\n░████   ░████ ░██    ░██ ░██      ░██   ░██  ░██   ░██   ░██   ░██\n░███     ░███  ░███████  ░██      ░██    ░██  ░██████     ░██████\n\n\n\n   ░███                  ░██    ░██        ░██     ░██ ░██   ░██\n  ░██░██                 ░██    ░██        ░██    ░██        ░██\n ░██  ░██  ░██    ░██ ░████████ ░████████  ░██   ░██   ░██░████████\n░█████████ ░██    ░██    ░██    ░██    ░██ ░███████    ░██   ░██\n░██    ░██ ░██    ░██    ░██    ░██    ░██ ░██   ░██   ░██   ░██\n░██    ░██ ░██   ░███    ░██    ░██    ░██ ░██    ░██  ░██   ░██\n░██    ░██  ░█████░██     ░████ ░██    ░██ ░██     ░██ ░██    ░████    `,\n  },\n} as const satisfies InstallerConfig;\n"]}

package/dist/package.json

@@ -0,0 +1,87 @@
+{
+    "name": "workos",
+    "version": "0.1.0",
+    "type": "module",
+    "description": "The Official Workos CLI",
+    "keywords": [
+        "workos",
+        "authkit",
+        "authentication",
+        "wizard",
+        "cli",
+        "setup",
+        "install",
+        "oauth",
+        "sso"
+    ],
+    "bin": {
+        "workos": "dist/bin.js"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "files": [
+        "dist/bin.*",
+        "dist/src",
+        "dist/cli.config.*",
+        ".claude-plugin",
+        "skills",
+        "package.json",
+        "README.md"
+    ],
+    "main": "dist/index.js",
+    "typings": "dist/index.d.ts",
+    "typescript": {
+        "definition": "dist/index.d.ts"
+    },
+    "dependencies": {
+        "@anthropic-ai/claude-agent-sdk": "~0.2.19",
+        "@clack/core": "^0.5.0",
+        "@clack/prompts": "0.11.0",
+        "chalk": "^5.6.2",
+        "diff": "^8.0.3",
+        "fast-glob": "^3.3.3",
+        "ink": "^6.6.0",
+        "opn": "^5.4.0",
+        "react": "^19.2.3",
+        "semver": "^7.7.3",
+        "uuid": "^13.0.0",
+        "xstate": "^5.25.1",
+        "yargs": "^18.0.0",
+        "zod": "^4.3.5"
+    },
+    "devDependencies": {
+        "@statelyai/inspect": "^0.4.0",
+        "@types/node": "~22.19.7",
+        "@types/opn": "5.1.0",
+        "@types/react": "^19.2.9",
+        "@types/semver": "^7.7.1",
+        "@types/yargs": "^17.0.35",
+        "@vitest/ui": "^4.0.17",
+        "dotenv": "^17.2.3",
+        "prettier": "^3.8.0",
+        "tsx": "^4.20.3",
+        "typescript": "^5.9.3",
+        "vitest": "^4.0.17"
+    },
+    "engines": {
+        "node": ">=20.20"
+    },
+    "packageManager": "pnpm@10.23.0+sha512.21c4e5698002ade97e4efe8b8b4a89a8de3c85a37919f957e7a0f30f38fbc5bbdd05980ffe29179b2fb6e6e691242e098d945d1601772cad0fef5fb6411e2a4b",
+    "scripts": {
+        "clean": "rm -rf ./dist",
+        "prebuild": "pnpm clean",
+        "build:watch": "pnpm tsc -w",
+        "build": "pnpm tsc",
+        "postbuild": "chmod +x ./dist/bin.js && cp -r scripts/** dist",
+        "lint": "prettier --check \"{lib,src,test}/**/*.ts\"",
+        "format": "prettier --write .",
+        "try": "tsx dev.ts",
+        "dev": "pnpm build && pnpm link --global && pnpm build:watch",
+        "test": "vitest run",
+        "test:watch": "vitest",
+        "typecheck": "tsc --noEmit"
+    },
+    "author": "WorkOS",
+    "license": "MIT"
+}

package/dist/src/commands/install-skill.d.ts

@@ -0,0 +1,20 @@
+export interface AgentConfig {
+    name: string;
+    displayName: string;
+    globalSkillsDir: string;
+    detect: () => boolean;
+}
+export declare function createAgents(home: string): Record<string, AgentConfig>;
+export interface InstallSkillOptions {
+    list?: boolean;
+    skill?: string[];
+    agent?: string[];
+}
+export declare function getSkillsDir(): string;
+export declare function discoverSkills(skillsDir: string): Promise<string[]>;
+export declare function detectAgents(agents: Record<string, AgentConfig>, filter?: string[]): AgentConfig[];
+export declare function installSkill(skillsDir: string, skillName: string, agent: AgentConfig): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+export declare function runInstallSkill(options: InstallSkillOptions): Promise<void>;