workos 0.13.4 → 0.14.0

package/dist/lib/credential-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-proxy.js","sourceRoot":"","sources":["../../src/lib/credential-proxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAoB,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAiCrE,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH,iDAAiD;AACjD,SAAS,aAAa,CAAC,OAAsD;IAC3E,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CAAC,MAA0B,EAAE,QAAa;IAClE,MAAM,WAAW,GAAG,MAAM,IAAI,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7D,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC5C,OAAO,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,sCAAsC;AACtC,IAAI,cAAc,GAAyB,IAAI,CAAC;AAChD,IAAI,aAAa,GAAyB,IAAI,CAAC;AAC/C,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAC5B,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC;;;GAGG;AACH,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,gDAAgD,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAExD,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7D,qCAAqC;QACrC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAExE,mBAAmB,GAAG,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,OAAO,CACL,yCAAyC,UAAU,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9G,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAC3C,MAAM,EAAE,iBAAiB;YACzB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;SACrC,CAAC,CAAC;QAEH,gBAAgB,EAAE,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB,EAAE,CAAC;IAEtB,QAAQ,CAAC,sCAAsC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE/D,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;QACzC,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe;QAC9C,oBAAoB,EAAE,mBAAmB;KAC1C,CAAC,CAAC;IAEH,2BAA2B;IAC3B,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,IAAI,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;QAC5F,QAAQ,CAAC,+DAA+D,CAAC,CAAC;QAC1E,gBAAgB,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAErD,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,wCAAwC;QACxC,OAAO,CAAC,0DAA0D,CAAC,CAAC;QAEpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,MAAM,cAAc,CAAC;QACrB,OAAO,cAAc,EAAE,CAAC,CAAC,2BAA2B;IACtD,CAAC;IAED,IAAI,eAAe,GAAG,WAAW,EAAE,CAAC;QAClC,0EAA0E;QAC1E,OAAO,CAAC,uCAAuC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE1G,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,iEAAiE;IACnE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA+B;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,kBAAkB,IAAI,MAAM,CAAC;IAElE,wCAAwC;IACxC,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IACxC,mBAAmB,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;oBACxD,QAAQ,EAAE,CAAC;oBACX,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,iCAAiC,GAAG,mBAAmB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,uDAAuD,WAAW,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,4BAA4B;IAC5B,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE;QACnC,MAAM,EAAE,OAAO;QACf,IAAI;QACJ,eAAe,EAAE,CAAC,CAAC,aAAa;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,sBAAsB;YACtB,aAAa,GAAG,IAAI,CAAC;YACrB,cAAc,GAAG,IAAI,CAAC;YACtB,mBAAmB,GAAG,CAAC,CAAC;YACxB,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAyB,EACzB,GAAwB,EACxB,QAAa,EACb,QAAiB,EACjB,WAAmB;IAEnB,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,6CAA6C,CAAC,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,4BAA4B,mBAAmB,CAAC,YAAY,CAAC,WAAW;SAClF,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEvD,MAAM,cAAc,GAAwB;QAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO;QACP,OAAO,EAAE,OAAO,EAAE,mBAAmB;KACtC,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC9D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,QAAQ,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,IAAK,GAA6B,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,sBAAsB;oBAC7B,OAAO,EAAE,sCAAsC;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,IAAK,GAA6B,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,2BAA2B;iBACrC,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,2BAA2B;aACrC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAI1C;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QACrD,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEvD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAChC;YACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO;YACP,OAAO,EAAE,OAAO;SACjB,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;QAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,QAAQ,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,kCAAkC,GAAG,mBAAmB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvF,OAAO;QACL,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,sCAAsC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,CAAC,gDAAgD,CAAC,CAAC;YAC1D,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,4BAA4B,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Lightweight HTTP proxy that injects credentials into upstream requests.\n * Includes lazy token refresh - refreshes proactively when token is expiring soon.\n */\n\nimport http from 'node:http';\nimport https from 'node:https';\nimport { URL } from 'node:url';\nimport { logInfo, logError, logWarn } from '../utils/debug.js';\nimport { getCredentials, updateTokens, type Credentials } from './credentials.js';\nimport { analytics } from '../utils/analytics.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nexport interface RefreshConfig {\n  /** AuthKit domain for refresh endpoint */\n  authkitDomain: string;\n  /** OAuth client ID */\n  clientId: string;\n  /** Threshold in ms - refresh when token expires within this window (default: 60000 = 1 min) */\n  refreshThresholdMs?: number;\n  /** Callback when refresh succeeds */\n  onRefreshSuccess?: () => void;\n  /** Callback when refresh fails permanently (token expired, invalid_grant) */\n  onRefreshExpired?: () => void;\n}\n\nexport interface CredentialProxyOptions {\n  /** Upstream URL to forward requests to */\n  upstreamUrl: string;\n  /** Optional: specific port to bind (default: random) */\n  port?: number;\n  /** Optional: refresh configuration for lazy token refresh */\n  refresh?: RefreshConfig;\n}\n\nexport interface CredentialProxyHandle {\n  /** Port the proxy is listening on */\n  port: number;\n  /** Full URL for the proxy (e.g., http://localhost:54321) */\n  url: string;\n  /** Stop the proxy server */\n  stop: () => Promise<void>;\n}\n\n// Hop-by-hop headers that must not be forwarded by proxies (RFC 7230 §6.1)\nconst HOP_BY_HOP_HEADERS = new Set([\n  'connection',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailer',\n  'transfer-encoding',\n  'upgrade',\n]);\n\n/** Copy headers, excluding hop-by-hop headers */\nfunction filterHeaders(headers: Record<string, string | string[] | undefined>): http.OutgoingHttpHeaders {\n  const out: http.OutgoingHttpHeaders = {};\n  for (const [key, value] of Object.entries(headers)) {\n    if (!HOP_BY_HOP_HEADERS.has(key.toLowerCase()) && value !== undefined) {\n      out[key] = value;\n    }\n  }\n  return out;\n}\n\n/** Build the upstream path, stripping the `beta` query param (unsupported by WorkOS LLM gateway) */\nfunction buildUpstreamPath(reqUrl: string | undefined, upstream: URL): string {\n  const requestPath = reqUrl || '/';\n  const basePath = upstream.pathname.replace(/\\/$/, '');\n  const fullPath = basePath + requestPath;\n  const upstreamUrl = new URL(fullPath, upstream.origin);\n  const searchParams = new URLSearchParams(upstreamUrl.search);\n  searchParams.delete('beta');\n  const queryString = searchParams.toString();\n  return upstreamUrl.pathname + (queryString ? `?${queryString}` : '');\n}\n\n// Module-level state for lazy refresh\nlet refreshPromise: Promise<void> | null = null;\nlet refreshConfig: RefreshConfig | null = null;\nlet consecutiveFailures = 0;\nconst MAX_CONSECUTIVE_FAILURES = 3;\n\n/**\n * Perform token refresh, updating credentials file.\n * Returns true if refresh succeeded.\n */\nasync function doRefresh(): Promise<boolean> {\n  if (!refreshConfig) {\n    logError('[credential-proxy] No refresh config available');\n    return false;\n  }\n\n  const { authkitDomain, clientId, onRefreshSuccess, onRefreshExpired } = refreshConfig;\n  const startTime = Date.now();\n\n  logInfo('[credential-proxy] Starting token refresh...');\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_attempt',\n    trigger: 'lazy',\n  });\n\n  const result = await refreshAccessToken(authkitDomain, clientId);\n\n  if (result.success && result.accessToken && result.expiresAt) {\n    // Update credentials file atomically\n    updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n\n    consecutiveFailures = 0;\n    const durationMs = Date.now() - startTime;\n\n    logInfo(\n      `[credential-proxy] Token refreshed in ${durationMs}ms, expires: ${new Date(result.expiresAt).toISOString()}`,\n    );\n\n    analytics.capture('installer.token.refresh', {\n      action: 'refresh_success',\n      duration_ms: durationMs,\n      token_rotated: !!result.refreshToken,\n    });\n\n    onRefreshSuccess?.();\n    return true;\n  }\n\n  consecutiveFailures++;\n\n  logError(`[credential-proxy] Refresh failed: ${result.error}`);\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_failure',\n    error_type: result.errorType || 'unknown',\n    error_message: result.error || 'Unknown error',\n    consecutive_failures: consecutiveFailures,\n  });\n\n  // Handle permanent failure\n  if (result.errorType === 'invalid_grant' || consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {\n    logError('[credential-proxy] Refresh token expired or too many failures');\n    onRefreshExpired?.();\n  }\n\n  return false;\n}\n\n/**\n * Ensure we have valid credentials, refreshing if needed.\n * Uses a promise-based lock to prevent concurrent refreshes.\n *\n * @returns Credentials to use for request, or null if unavailable\n */\nasync function ensureValidCredentials(thresholdMs: number): Promise<Credentials | null> {\n  const creds = getCredentials();\n\n  if (!creds?.accessToken) {\n    return null;\n  }\n\n  // No refresh token = can't refresh, just use what we have\n  if (!creds.refreshToken || !refreshConfig) {\n    return creds;\n  }\n\n  const timeUntilExpiry = creds.expiresAt - Date.now();\n\n  if (timeUntilExpiry <= 0) {\n    // Token expired - must wait for refresh\n    logWarn('[credential-proxy] Token expired, waiting for refresh...');\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n\n    await refreshPromise;\n    return getCredentials(); // Return fresh credentials\n  }\n\n  if (timeUntilExpiry < thresholdMs) {\n    // Token expiring soon - trigger background refresh, but use current token\n    logInfo(`[credential-proxy] Token expires in ${Math.round(timeUntilExpiry / 1000)}s, triggering refresh`);\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n    // Don't await - fire and forget, use current (still valid) token\n  }\n\n  return creds;\n}\n\n/**\n * Start the credential injector proxy with optional lazy refresh.\n */\nexport async function startCredentialProxy(options: CredentialProxyOptions): Promise<CredentialProxyHandle> {\n  const upstream = new URL(options.upstreamUrl);\n  const useHttps = upstream.protocol === 'https:';\n  const thresholdMs = options.refresh?.refreshThresholdMs ?? 60_000;\n\n  // Store refresh config for lazy refresh\n  refreshConfig = options.refresh ?? null;\n  consecutiveFailures = 0;\n\n  const server = http.createServer(async (req, res) => {\n    await handleRequest(req, res, upstream, useHttps, thresholdMs);\n  });\n\n  // Find available port\n  const port = await new Promise<number>((resolve, reject) => {\n    const tryPort = options.port ?? 0; // 0 = random available port\n    let attempts = 0;\n    const maxAttempts = 10;\n\n    const tryListen = (p: number) => {\n      server.once('error', (err: NodeJS.ErrnoException) => {\n        if (err.code === 'EADDRINUSE' && attempts < maxAttempts) {\n          attempts++;\n          tryListen(0); // Try random port\n        } else {\n          reject(err);\n        }\n      });\n\n      server.listen(p, '127.0.0.1', () => {\n        const addr = server.address();\n        if (addr && typeof addr === 'object') {\n          resolve(addr.port);\n        } else {\n          reject(new Error('Failed to get server address'));\n        }\n      });\n    };\n\n    tryListen(tryPort);\n  });\n\n  const url = `http://127.0.0.1:${port}`;\n  logInfo(`[credential-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);\n  if (refreshConfig) {\n    logInfo(`[credential-proxy] Lazy refresh enabled, threshold: ${thresholdMs}ms`);\n  }\n\n  // Telemetry for proxy start\n  analytics.capture('installer.proxy', {\n    action: 'start',\n    port,\n    refresh_enabled: !!refreshConfig,\n  });\n\n  return {\n    port,\n    url,\n    stop: async () => {\n      // Clear refresh state\n      refreshConfig = null;\n      refreshPromise = null;\n      consecutiveFailures = 0;\n      await stopServer(server);\n    },\n  };\n}\n\nasync function handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  upstream: URL,\n  useHttps: boolean,\n  thresholdMs: number,\n): Promise<void> {\n  // Get valid credentials, potentially triggering refresh\n  const creds = await ensureValidCredentials(thresholdMs);\n\n  if (!creds?.accessToken) {\n    logError('[credential-proxy] No credentials available');\n    res.writeHead(401, { 'Content-Type': 'application/json' });\n    res.end(\n      JSON.stringify({\n        error: 'credentials_unavailable',\n        message: `Not authenticated. Run \\`${formatWorkOSCommand('auth login')}\\` first.`,\n      }),\n    );\n    return;\n  }\n\n  // Build upstream request\n  const headers = filterHeaders(req.headers);\n  headers['authorization'] = `Bearer ${creds.accessToken}`;\n  headers['host'] = upstream.host;\n  const finalPath = buildUpstreamPath(req.url, upstream);\n\n  const requestOptions: http.RequestOptions = {\n    hostname: upstream.hostname,\n    port: upstream.port || (useHttps ? 443 : 80),\n    path: finalPath,\n    method: req.method,\n    headers,\n    timeout: 120_000, // 2 minute timeout\n  };\n\n  const transport = useHttps ? https : http;\n\n  const proxyReq = transport.request(requestOptions, (proxyRes) => {\n    res.writeHead(proxyRes.statusCode || 500, filterHeaders(proxyRes.headers));\n    proxyRes.pipe(res);\n  });\n\n  proxyReq.on('error', (err) => {\n    logError('[credential-proxy] Upstream error:', err.message);\n\n    if (!res.headersSent) {\n      if ((err as NodeJS.ErrnoException).code === 'ECONNREFUSED') {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_unavailable',\n            message: 'Could not connect to upstream server',\n          }),\n        );\n      } else if ((err as NodeJS.ErrnoException).code === 'ETIMEDOUT') {\n        res.writeHead(504, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_timeout',\n            message: 'Upstream server timed out',\n          }),\n        );\n      } else {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'proxy_error',\n            message: err.message,\n          }),\n        );\n      }\n    }\n  });\n\n  proxyReq.on('timeout', () => {\n    proxyReq.destroy();\n    if (!res.headersSent) {\n      res.writeHead(504, { 'Content-Type': 'application/json' });\n      res.end(\n        JSON.stringify({\n          error: 'upstream_timeout',\n          message: 'Upstream server timed out',\n        }),\n      );\n    }\n  });\n\n  // Stream request body\n  req.pipe(proxyReq);\n}\n\n/**\n * Start a lightweight proxy that injects claim token headers for unclaimed environments.\n * No refresh logic — claim tokens are assumed valid for the duration of an install session.\n */\nexport async function startClaimTokenProxy(options: {\n  upstreamUrl: string;\n  claimToken: string;\n  clientId: string;\n}): Promise<CredentialProxyHandle> {\n  const upstream = new URL(options.upstreamUrl);\n  const useHttps = upstream.protocol === 'https:';\n\n  const server = http.createServer(async (req, res) => {\n    const headers = filterHeaders(req.headers);\n    headers['x-workos-claim-token'] = options.claimToken;\n    headers['x-workos-client-id'] = options.clientId;\n    headers['host'] = upstream.host;\n    const finalPath = buildUpstreamPath(req.url, upstream);\n\n    const transport = useHttps ? https : http;\n\n    const proxyReq = transport.request(\n      {\n        hostname: upstream.hostname,\n        port: upstream.port || (useHttps ? 443 : 80),\n        path: finalPath,\n        method: req.method,\n        headers,\n        timeout: 120_000,\n      },\n      (proxyRes) => {\n        res.writeHead(proxyRes.statusCode || 500, filterHeaders(proxyRes.headers));\n        proxyRes.pipe(res);\n      },\n    );\n\n    proxyReq.on('error', (err) => {\n      logError('[claim-token-proxy] Upstream error:', err.message);\n      if (!res.headersSent) {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'proxy_error', message: err.message }));\n      }\n    });\n\n    proxyReq.on('timeout', () => {\n      proxyReq.destroy();\n      if (!res.headersSent) {\n        res.writeHead(504, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'upstream_timeout', message: 'Upstream server timed out' }));\n      }\n    });\n\n    req.pipe(proxyReq);\n  });\n\n  const port = await new Promise<number>((resolve, reject) => {\n    server.once('error', (err) => reject(err));\n    server.listen(0, '127.0.0.1', () => {\n      const addr = server.address();\n      if (addr && typeof addr === 'object') resolve(addr.port);\n      else reject(new Error('Failed to get server address'));\n    });\n  });\n\n  const url = `http://127.0.0.1:${port}`;\n  logInfo(`[claim-token-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);\n\n  return {\n    port,\n    url,\n    stop: async () => stopServer(server),\n  };\n}\n\nfunction stopServer(server: http.Server): Promise<void> {\n  return new Promise((resolve, reject) => {\n    // Set a timeout for graceful shutdown\n    const timeout = setTimeout(() => {\n      logInfo('[credential-proxy] Force closing after timeout');\n      server.closeAllConnections?.();\n      resolve();\n    }, 5000);\n\n    server.close((err) => {\n      clearTimeout(timeout);\n      if (err) {\n        logError('[credential-proxy] Error stopping server:', err);\n        reject(err);\n      } else {\n        logInfo('[credential-proxy] Stopped');\n        resolve();\n      }\n    });\n  });\n}\n"]}
+{"version":3,"file":"credential-proxy.js","sourceRoot":"","sources":["../../src/lib/credential-proxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAoB,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAiCrD,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH,iDAAiD;AACjD,SAAS,aAAa,CAAC,OAAsD;IAC3E,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CAAC,MAA0B,EAAE,QAAa;IAClE,MAAM,WAAW,GAAG,MAAM,IAAI,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7D,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC5C,OAAO,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,sCAAsC;AACtC,IAAI,cAAc,GAAyB,IAAI,CAAC;AAChD,IAAI,aAAa,GAAyB,IAAI,CAAC;AAC/C,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAC5B,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC;;;GAGG;AACH,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,gDAAgD,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAExD,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7D,qCAAqC;QACrC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAExE,mBAAmB,GAAG,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,OAAO,CACL,yCAAyC,UAAU,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9G,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAC3C,MAAM,EAAE,iBAAiB;YACzB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;SACrC,CAAC,CAAC;QAEH,gBAAgB,EAAE,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB,EAAE,CAAC;IAEtB,QAAQ,CAAC,sCAAsC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE/D,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;QACzC,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe;QAC9C,oBAAoB,EAAE,mBAAmB;KAC1C,CAAC,CAAC;IAEH,2BAA2B;IAC3B,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,IAAI,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;QAC5F,QAAQ,CAAC,+DAA+D,CAAC,CAAC;QAC1E,gBAAgB,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAErD,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,wCAAwC;QACxC,OAAO,CAAC,0DAA0D,CAAC,CAAC;QAEpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,MAAM,cAAc,CAAC;QACrB,OAAO,cAAc,EAAE,CAAC,CAAC,2BAA2B;IACtD,CAAC;IAED,IAAI,eAAe,GAAG,WAAW,EAAE,CAAC;QAClC,0EAA0E;QAC1E,OAAO,CAAC,uCAAuC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE1G,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,iEAAiE;IACnE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA+B;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,kBAAkB,IAAI,MAAM,CAAC;IAElE,wCAAwC;IACxC,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IACxC,mBAAmB,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;oBACxD,QAAQ,EAAE,CAAC;oBACX,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;gBAClC,CAAC;qBAAM,CAAC;oBACN,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,EAAE;wBACxC,SAAS,EAAE,QAAQ;wBACnB,MAAM,EAAE,aAAa,CAAC,EAAE;wBACxB,KAAK,EAAE,kBAAkB;qBAC1B,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,iCAAiC,GAAG,mBAAmB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,uDAAuD,WAAW,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,4BAA4B;IAC5B,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE;QACnC,MAAM,EAAE,OAAO;QACf,IAAI;QACJ,eAAe,EAAE,CAAC,CAAC,aAAa;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,sBAAsB;YACtB,aAAa,GAAG,IAAI,CAAC;YACrB,cAAc,GAAG,IAAI,CAAC;YACtB,mBAAmB,GAAG,CAAC,CAAC;YACxB,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAyB,EACzB,GAAwB,EACxB,QAAa,EACb,QAAiB,EACjB,WAAmB;IAEnB,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,6CAA6C,CAAC,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,4BAA4B,mBAAmB,CAAC,YAAY,CAAC,WAAW;SAClF,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEvD,MAAM,cAAc,GAAwB;QAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO;QACP,OAAO,EAAE,OAAO,EAAE,mBAAmB;KACtC,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC9D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,QAAQ,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,IAAK,GAA6B,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,sBAAsB;oBAC7B,OAAO,EAAE,sCAAsC;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,IAAK,GAA6B,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,2BAA2B;iBACrC,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,2BAA2B;aACrC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAI1C;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QACrD,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEvD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAChC;YACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO;YACP,OAAO,EAAE,OAAO;SACjB,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;QAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,QAAQ,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,EAAE;gBACxC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,kCAAkC,GAAG,mBAAmB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvF,OAAO;QACL,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,sCAAsC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,CAAC,gDAAgD,CAAC,CAAC;YAC1D,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,4BAA4B,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Lightweight HTTP proxy that injects credentials into upstream requests.\n * Includes lazy token refresh - refreshes proactively when token is expiring soon.\n */\n\nimport http from 'node:http';\nimport https from 'node:https';\nimport { URL } from 'node:url';\nimport { logInfo, logError, logWarn } from '../utils/debug.js';\nimport { getCredentials, updateTokens, type Credentials } from './credentials.js';\nimport { analytics } from '../utils/analytics.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { observeHostFailure } from './host-probe.js';\n\nexport interface RefreshConfig {\n  /** AuthKit domain for refresh endpoint */\n  authkitDomain: string;\n  /** OAuth client ID */\n  clientId: string;\n  /** Threshold in ms - refresh when token expires within this window (default: 60000 = 1 min) */\n  refreshThresholdMs?: number;\n  /** Callback when refresh succeeds */\n  onRefreshSuccess?: () => void;\n  /** Callback when refresh fails permanently (token expired, invalid_grant) */\n  onRefreshExpired?: () => void;\n}\n\nexport interface CredentialProxyOptions {\n  /** Upstream URL to forward requests to */\n  upstreamUrl: string;\n  /** Optional: specific port to bind (default: random) */\n  port?: number;\n  /** Optional: refresh configuration for lazy token refresh */\n  refresh?: RefreshConfig;\n}\n\nexport interface CredentialProxyHandle {\n  /** Port the proxy is listening on */\n  port: number;\n  /** Full URL for the proxy (e.g., http://localhost:54321) */\n  url: string;\n  /** Stop the proxy server */\n  stop: () => Promise<void>;\n}\n\n// Hop-by-hop headers that must not be forwarded by proxies (RFC 7230 §6.1)\nconst HOP_BY_HOP_HEADERS = new Set([\n  'connection',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailer',\n  'transfer-encoding',\n  'upgrade',\n]);\n\n/** Copy headers, excluding hop-by-hop headers */\nfunction filterHeaders(headers: Record<string, string | string[] | undefined>): http.OutgoingHttpHeaders {\n  const out: http.OutgoingHttpHeaders = {};\n  for (const [key, value] of Object.entries(headers)) {\n    if (!HOP_BY_HOP_HEADERS.has(key.toLowerCase()) && value !== undefined) {\n      out[key] = value;\n    }\n  }\n  return out;\n}\n\n/** Build the upstream path, stripping the `beta` query param (unsupported by WorkOS LLM gateway) */\nfunction buildUpstreamPath(reqUrl: string | undefined, upstream: URL): string {\n  const requestPath = reqUrl || '/';\n  const basePath = upstream.pathname.replace(/\\/$/, '');\n  const fullPath = basePath + requestPath;\n  const upstreamUrl = new URL(fullPath, upstream.origin);\n  const searchParams = new URLSearchParams(upstreamUrl.search);\n  searchParams.delete('beta');\n  const queryString = searchParams.toString();\n  return upstreamUrl.pathname + (queryString ? `?${queryString}` : '');\n}\n\n// Module-level state for lazy refresh\nlet refreshPromise: Promise<void> | null = null;\nlet refreshConfig: RefreshConfig | null = null;\nlet consecutiveFailures = 0;\nconst MAX_CONSECUTIVE_FAILURES = 3;\n\n/**\n * Perform token refresh, updating credentials file.\n * Returns true if refresh succeeded.\n */\nasync function doRefresh(): Promise<boolean> {\n  if (!refreshConfig) {\n    logError('[credential-proxy] No refresh config available');\n    return false;\n  }\n\n  const { authkitDomain, clientId, onRefreshSuccess, onRefreshExpired } = refreshConfig;\n  const startTime = Date.now();\n\n  logInfo('[credential-proxy] Starting token refresh...');\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_attempt',\n    trigger: 'lazy',\n  });\n\n  const result = await refreshAccessToken(authkitDomain, clientId);\n\n  if (result.success && result.accessToken && result.expiresAt) {\n    // Update credentials file atomically\n    updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n\n    consecutiveFailures = 0;\n    const durationMs = Date.now() - startTime;\n\n    logInfo(\n      `[credential-proxy] Token refreshed in ${durationMs}ms, expires: ${new Date(result.expiresAt).toISOString()}`,\n    );\n\n    analytics.capture('installer.token.refresh', {\n      action: 'refresh_success',\n      duration_ms: durationMs,\n      token_rotated: !!result.refreshToken,\n    });\n\n    onRefreshSuccess?.();\n    return true;\n  }\n\n  consecutiveFailures++;\n\n  logError(`[credential-proxy] Refresh failed: ${result.error}`);\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_failure',\n    error_type: result.errorType || 'unknown',\n    error_message: result.error || 'Unknown error',\n    consecutive_failures: consecutiveFailures,\n  });\n\n  // Handle permanent failure\n  if (result.errorType === 'invalid_grant' || consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {\n    logError('[credential-proxy] Refresh token expired or too many failures');\n    onRefreshExpired?.();\n  }\n\n  return false;\n}\n\n/**\n * Ensure we have valid credentials, refreshing if needed.\n * Uses a promise-based lock to prevent concurrent refreshes.\n *\n * @returns Credentials to use for request, or null if unavailable\n */\nasync function ensureValidCredentials(thresholdMs: number): Promise<Credentials | null> {\n  const creds = getCredentials();\n\n  if (!creds?.accessToken) {\n    return null;\n  }\n\n  // No refresh token = can't refresh, just use what we have\n  if (!creds.refreshToken || !refreshConfig) {\n    return creds;\n  }\n\n  const timeUntilExpiry = creds.expiresAt - Date.now();\n\n  if (timeUntilExpiry <= 0) {\n    // Token expired - must wait for refresh\n    logWarn('[credential-proxy] Token expired, waiting for refresh...');\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n\n    await refreshPromise;\n    return getCredentials(); // Return fresh credentials\n  }\n\n  if (timeUntilExpiry < thresholdMs) {\n    // Token expiring soon - trigger background refresh, but use current token\n    logInfo(`[credential-proxy] Token expires in ${Math.round(timeUntilExpiry / 1000)}s, triggering refresh`);\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n    // Don't await - fire and forget, use current (still valid) token\n  }\n\n  return creds;\n}\n\n/**\n * Start the credential injector proxy with optional lazy refresh.\n */\nexport async function startCredentialProxy(options: CredentialProxyOptions): Promise<CredentialProxyHandle> {\n  const upstream = new URL(options.upstreamUrl);\n  const useHttps = upstream.protocol === 'https:';\n  const thresholdMs = options.refresh?.refreshThresholdMs ?? 60_000;\n\n  // Store refresh config for lazy refresh\n  refreshConfig = options.refresh ?? null;\n  consecutiveFailures = 0;\n\n  const server = http.createServer(async (req, res) => {\n    await handleRequest(req, res, upstream, useHttps, thresholdMs);\n  });\n\n  // Find available port\n  const port = await new Promise<number>((resolve, reject) => {\n    const tryPort = options.port ?? 0; // 0 = random available port\n    let attempts = 0;\n    const maxAttempts = 10;\n\n    const tryListen = (p: number) => {\n      server.once('error', (err: NodeJS.ErrnoException) => {\n        if (err.code === 'EADDRINUSE' && attempts < maxAttempts) {\n          attempts++;\n          tryListen(0); // Try random port\n        } else {\n          observeHostFailure('localhost-bind', err, {\n            operation: 'listen',\n            target: `127.0.0.1:${p}`,\n            label: 'credential proxy',\n          });\n          reject(err);\n        }\n      });\n\n      server.listen(p, '127.0.0.1', () => {\n        const addr = server.address();\n        if (addr && typeof addr === 'object') {\n          resolve(addr.port);\n        } else {\n          reject(new Error('Failed to get server address'));\n        }\n      });\n    };\n\n    tryListen(tryPort);\n  });\n\n  const url = `http://127.0.0.1:${port}`;\n  logInfo(`[credential-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);\n  if (refreshConfig) {\n    logInfo(`[credential-proxy] Lazy refresh enabled, threshold: ${thresholdMs}ms`);\n  }\n\n  // Telemetry for proxy start\n  analytics.capture('installer.proxy', {\n    action: 'start',\n    port,\n    refresh_enabled: !!refreshConfig,\n  });\n\n  return {\n    port,\n    url,\n    stop: async () => {\n      // Clear refresh state\n      refreshConfig = null;\n      refreshPromise = null;\n      consecutiveFailures = 0;\n      await stopServer(server);\n    },\n  };\n}\n\nasync function handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  upstream: URL,\n  useHttps: boolean,\n  thresholdMs: number,\n): Promise<void> {\n  // Get valid credentials, potentially triggering refresh\n  const creds = await ensureValidCredentials(thresholdMs);\n\n  if (!creds?.accessToken) {\n    logError('[credential-proxy] No credentials available');\n    res.writeHead(401, { 'Content-Type': 'application/json' });\n    res.end(\n      JSON.stringify({\n        error: 'credentials_unavailable',\n        message: `Not authenticated. Run \\`${formatWorkOSCommand('auth login')}\\` first.`,\n      }),\n    );\n    return;\n  }\n\n  // Build upstream request\n  const headers = filterHeaders(req.headers);\n  headers['authorization'] = `Bearer ${creds.accessToken}`;\n  headers['host'] = upstream.host;\n  const finalPath = buildUpstreamPath(req.url, upstream);\n\n  const requestOptions: http.RequestOptions = {\n    hostname: upstream.hostname,\n    port: upstream.port || (useHttps ? 443 : 80),\n    path: finalPath,\n    method: req.method,\n    headers,\n    timeout: 120_000, // 2 minute timeout\n  };\n\n  const transport = useHttps ? https : http;\n\n  const proxyReq = transport.request(requestOptions, (proxyRes) => {\n    res.writeHead(proxyRes.statusCode || 500, filterHeaders(proxyRes.headers));\n    proxyRes.pipe(res);\n  });\n\n  proxyReq.on('error', (err) => {\n    logError('[credential-proxy] Upstream error:', err.message);\n\n    if (!res.headersSent) {\n      if ((err as NodeJS.ErrnoException).code === 'ECONNREFUSED') {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_unavailable',\n            message: 'Could not connect to upstream server',\n          }),\n        );\n      } else if ((err as NodeJS.ErrnoException).code === 'ETIMEDOUT') {\n        res.writeHead(504, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_timeout',\n            message: 'Upstream server timed out',\n          }),\n        );\n      } else {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'proxy_error',\n            message: err.message,\n          }),\n        );\n      }\n    }\n  });\n\n  proxyReq.on('timeout', () => {\n    proxyReq.destroy();\n    if (!res.headersSent) {\n      res.writeHead(504, { 'Content-Type': 'application/json' });\n      res.end(\n        JSON.stringify({\n          error: 'upstream_timeout',\n          message: 'Upstream server timed out',\n        }),\n      );\n    }\n  });\n\n  // Stream request body\n  req.pipe(proxyReq);\n}\n\n/**\n * Start a lightweight proxy that injects claim token headers for unclaimed environments.\n * No refresh logic — claim tokens are assumed valid for the duration of an install session.\n */\nexport async function startClaimTokenProxy(options: {\n  upstreamUrl: string;\n  claimToken: string;\n  clientId: string;\n}): Promise<CredentialProxyHandle> {\n  const upstream = new URL(options.upstreamUrl);\n  const useHttps = upstream.protocol === 'https:';\n\n  const server = http.createServer(async (req, res) => {\n    const headers = filterHeaders(req.headers);\n    headers['x-workos-claim-token'] = options.claimToken;\n    headers['x-workos-client-id'] = options.clientId;\n    headers['host'] = upstream.host;\n    const finalPath = buildUpstreamPath(req.url, upstream);\n\n    const transport = useHttps ? https : http;\n\n    const proxyReq = transport.request(\n      {\n        hostname: upstream.hostname,\n        port: upstream.port || (useHttps ? 443 : 80),\n        path: finalPath,\n        method: req.method,\n        headers,\n        timeout: 120_000,\n      },\n      (proxyRes) => {\n        res.writeHead(proxyRes.statusCode || 500, filterHeaders(proxyRes.headers));\n        proxyRes.pipe(res);\n      },\n    );\n\n    proxyReq.on('error', (err) => {\n      logError('[claim-token-proxy] Upstream error:', err.message);\n      if (!res.headersSent) {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'proxy_error', message: err.message }));\n      }\n    });\n\n    proxyReq.on('timeout', () => {\n      proxyReq.destroy();\n      if (!res.headersSent) {\n        res.writeHead(504, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'upstream_timeout', message: 'Upstream server timed out' }));\n      }\n    });\n\n    req.pipe(proxyReq);\n  });\n\n  const port = await new Promise<number>((resolve, reject) => {\n    server.once('error', (err) => {\n      observeHostFailure('localhost-bind', err, {\n        operation: 'listen',\n        target: '127.0.0.1:0',\n        label: 'claim token proxy',\n      });\n      reject(err);\n    });\n    server.listen(0, '127.0.0.1', () => {\n      const addr = server.address();\n      if (addr && typeof addr === 'object') resolve(addr.port);\n      else reject(new Error('Failed to get server address'));\n    });\n  });\n\n  const url = `http://127.0.0.1:${port}`;\n  logInfo(`[claim-token-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);\n\n  return {\n    port,\n    url,\n    stop: async () => stopServer(server),\n  };\n}\n\nfunction stopServer(server: http.Server): Promise<void> {\n  return new Promise((resolve, reject) => {\n    // Set a timeout for graceful shutdown\n    const timeout = setTimeout(() => {\n      logInfo('[credential-proxy] Force closing after timeout');\n      server.closeAllConnections?.();\n      resolve();\n    }, 5000);\n\n    server.close((err) => {\n      clearTimeout(timeout);\n      if (err) {\n        logError('[credential-proxy] Error stopping server:', err);\n        reject(err);\n      } else {\n        logInfo('[credential-proxy] Stopped');\n        resolve();\n      }\n    });\n  });\n}\n"]}

package/dist/lib/credential-store.js

@@ -10,6 +10,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { logWarn } from '../utils/debug.js';
+import { observeHostFailure } from './host-probe.js';
 const SERVICE_NAME = 'workos-cli';
 const ACCOUNT_NAME = 'credentials';
 let fallbackWarningShown = false;
@@ -31,27 +32,55 @@ function fileExists() {
 function readFromFile() {
     if (!fileExists())
         return null;
+    const filePath = getCredentialsPath();
     try {
-        const content = fs.readFileSync(getCredentialsPath(), 'utf-8');
+        const content = fs.readFileSync(filePath, 'utf-8');
         return JSON.parse(content);
     }
     catch (error) {
+        observeHostFailure('home-fs', error, {
+            operation: 'read',
+            target: filePath,
+            label: 'credential fallback file',
+        });
         logWarn('Failed to read credentials file:', error);
         return null;
     }
 }
 function writeToFile(creds) {
     const dir = getCredentialsDir();
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const filePath = getCredentialsPath();
+    try {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        fs.writeFileSync(filePath, JSON.stringify(creds, null, 2), {
+            mode: 0o600,
+        });
+    }
+    catch (error) {
+        observeHostFailure('home-fs', error, {
+            operation: 'write',
+            target: filePath,
+            label: 'credential fallback file',
+        });
+        throw error;
     }
-    fs.writeFileSync(getCredentialsPath(), JSON.stringify(creds, null, 2), {
-        mode: 0o600,
-    });
 }
 function deleteFile() {
+    const filePath = getCredentialsPath();
     if (fileExists()) {
-        fs.unlinkSync(getCredentialsPath());
+        try {
+            fs.unlinkSync(filePath);
+        }
+        catch (error) {
+            observeHostFailure('home-fs', error, {
+                operation: 'delete',
+                target: filePath,
+                label: 'credential fallback file',
+            });
+            throw error;
+        }
     }
 }
 function getKeyringEntry() {
@@ -70,6 +99,11 @@ function readFromKeyring() {
     catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
         logWarn(`[credential-store] keyring read failed: ${msg}`);
+        observeHostFailure('keychain', error, {
+            operation: 'read',
+            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
+            label: 'credential keychain entry',
+        });
         return null;
     }
 }
@@ -82,6 +116,11 @@ function writeToKeyring(creds) {
     catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
         logWarn(`[credential-store] keyring write failed: ${msg}`);
+        observeHostFailure('keychain', error, {
+            operation: 'write',
+            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
+            label: 'credential keychain entry',
+        });
         return false;
     }
 }
@@ -94,6 +133,11 @@ function deleteFromKeyring() {
         const msg = error instanceof Error ? error.message : String(error);
         if (!msg.includes('not found') && !msg.includes('No such')) {
             logWarn('Failed to delete from keyring:', error);
+            observeHostFailure('keychain', error, {
+                operation: 'delete',
+                target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
+                label: 'credential keychain entry',
+            });
         }
     }
 }

package/dist/lib/credential-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/lib/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAiB5C,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACrE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,iEAAiE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAkB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,oEAAoE,EACpE,iDAAiD,EACjD,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,eAAe,EAAE,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,SAAiB,EAAE,YAAqB;IACxF,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,GAAG,KAAK;QACR,WAAW;QACX,SAAS;QACT,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;KACtC,CAAC;IAEF,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyB,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,KAAK,CAAC,IAAI,CACR,sBAAsB,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CACjH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;YACxD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,KAAK,CAAC,IAAI,CACR,0BAA0B,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CACrH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/**\n * Credential storage abstraction with keyring support and file fallback.\n *\n * Storage priority:\n * 1. If --insecure-storage: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\n\nexport interface StagingCache {\n  clientId: string;\n  apiKey: string;\n  fetchedAt: number;\n}\n\nexport interface Credentials {\n  accessToken: string;\n  expiresAt: number;\n  userId: string;\n  email?: string;\n  staging?: StagingCache;\n  refreshToken?: string;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'credentials';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getCredentialsDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getCredentialsPath(): string {\n  return path.join(getCredentialsDir(), 'credentials.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getCredentialsPath());\n}\n\nfunction readFromFile(): Credentials | null {\n  if (!fileExists()) return null;\n  try {\n    const content = fs.readFileSync(getCredentialsPath(), 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    logWarn('Failed to read credentials file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(creds: Credentials): void {\n  const dir = getCredentialsDir();\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n  fs.writeFileSync(getCredentialsPath(), JSON.stringify(creds, null, 2), {\n    mode: 0o600,\n  });\n}\n\nfunction deleteFile(): void {\n  if (fileExists()) {\n    fs.unlinkSync(getCredentialsPath());\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): Credentials | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) {\n      logWarn('[credential-store] keyring: entry exists but data is null/empty');\n      return null;\n    }\n    return JSON.parse(data);\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    logWarn(`[credential-store] keyring read failed: ${msg}`);\n    return null;\n  }\n}\n\nfunction writeToKeyring(creds: Credentials): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(creds));\n    return true;\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    logWarn(`[credential-store] keyring write failed: ${msg}`);\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete from keyring:', error);\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store credentials in system keyring. Using file storage.',\n    'Credentials saved to ~/.workos/credentials.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function hasCredentials(): boolean {\n  if (forceInsecureStorage) {\n    return fileExists();\n  }\n  return readFromKeyring() !== null || fileExists();\n}\n\nexport function getCredentials(): Credentials | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringCreds = readFromKeyring();\n  if (keyringCreds) return keyringCreds;\n\n  const fileCreds = readFromFile();\n  if (fileCreds) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileCreds);\n    }\n    return fileCreds;\n  }\n\n  return null;\n}\n\nexport function saveCredentials(creds: Credentials): void {\n  if (forceInsecureStorage) return writeToFile(creds);\n\n  if (!writeToKeyring(creds)) {\n    showFallbackWarning();\n    writeToFile(creds);\n  }\n}\n\nexport function clearCredentials(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function updateTokens(accessToken: string, expiresAt: number, refreshToken?: string): void {\n  const creds = getCredentials();\n  if (!creds) {\n    throw new Error('No existing credentials to update');\n  }\n\n  const updated: Credentials = {\n    ...creds,\n    accessToken,\n    expiresAt,\n    ...(refreshToken && { refreshToken }),\n  };\n\n  saveCredentials(updated);\n}\n\n/**\n * Diagnostic info about credential storage state — for debugging auth failures.\n */\nexport function diagnoseCredentials(): string[] {\n  const lines: string[] = [];\n  const filePath = getCredentialsPath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<Credentials>;\n      const expired = parsed.expiresAt ? Date.now() >= parsed.expiresAt : 'unknown';\n      lines.push(\n        `file creds: userId=${parsed.userId ?? 'missing'}, expired=${expired}, hasRefreshToken=${!!parsed.refreshToken}`,\n      );\n    } catch (e) {\n      lines.push(`file creds: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<Credentials>;\n      const expired = parsed.expiresAt ? Date.now() >= parsed.expiresAt : 'unknown';\n      lines.push(\n        `keyring: found, userId=${parsed.userId ?? 'missing'}, expired=${expired}, hasRefreshToken=${!!parsed.refreshToken}`,\n      );\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\nexport { getCredentialsPath };\n"]}
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/lib/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAiBrD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,0BAA0B;SAClC,CAAC,CAAC;QACH,OAAO,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACzD,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,0BAA0B;SAClC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;gBACnC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,0BAA0B;aAClC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,iEAAiE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QAC1D,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,2BAA2B;SACnC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAkB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;QAC3D,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,2BAA2B;SACnC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACjD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;gBACpC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;gBACzC,KAAK,EAAE,2BAA2B;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,oEAAoE,EACpE,iDAAiD,EACjD,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,eAAe,EAAE,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,SAAiB,EAAE,YAAqB;IACxF,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,GAAG,KAAK;QACR,WAAW;QACX,SAAS;QACT,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;KACtC,CAAC;IAEF,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyB,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,KAAK,CAAC,IAAI,CACR,sBAAsB,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CACjH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;YACxD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,KAAK,CAAC,IAAI,CACR,0BAA0B,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CACrH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/**\n * Credential storage abstraction with keyring support and file fallback.\n *\n * Storage priority:\n * 1. If --insecure-storage: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\nimport { observeHostFailure } from './host-probe.js';\n\nexport interface StagingCache {\n  clientId: string;\n  apiKey: string;\n  fetchedAt: number;\n}\n\nexport interface Credentials {\n  accessToken: string;\n  expiresAt: number;\n  userId: string;\n  email?: string;\n  staging?: StagingCache;\n  refreshToken?: string;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'credentials';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getCredentialsDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getCredentialsPath(): string {\n  return path.join(getCredentialsDir(), 'credentials.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getCredentialsPath());\n}\n\nfunction readFromFile(): Credentials | null {\n  if (!fileExists()) return null;\n  const filePath = getCredentialsPath();\n  try {\n    const content = fs.readFileSync(filePath, 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'read',\n      target: filePath,\n      label: 'credential fallback file',\n    });\n    logWarn('Failed to read credentials file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(creds: Credentials): void {\n  const dir = getCredentialsDir();\n  const filePath = getCredentialsPath();\n  try {\n    if (!fs.existsSync(dir)) {\n      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    fs.writeFileSync(filePath, JSON.stringify(creds, null, 2), {\n      mode: 0o600,\n    });\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'write',\n      target: filePath,\n      label: 'credential fallback file',\n    });\n    throw error;\n  }\n}\n\nfunction deleteFile(): void {\n  const filePath = getCredentialsPath();\n  if (fileExists()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch (error) {\n      observeHostFailure('home-fs', error, {\n        operation: 'delete',\n        target: filePath,\n        label: 'credential fallback file',\n      });\n      throw error;\n    }\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): Credentials | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) {\n      logWarn('[credential-store] keyring: entry exists but data is null/empty');\n      return null;\n    }\n    return JSON.parse(data);\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    logWarn(`[credential-store] keyring read failed: ${msg}`);\n    observeHostFailure('keychain', error, {\n      operation: 'read',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'credential keychain entry',\n    });\n    return null;\n  }\n}\n\nfunction writeToKeyring(creds: Credentials): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(creds));\n    return true;\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    logWarn(`[credential-store] keyring write failed: ${msg}`);\n    observeHostFailure('keychain', error, {\n      operation: 'write',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'credential keychain entry',\n    });\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete from keyring:', error);\n      observeHostFailure('keychain', error, {\n        operation: 'delete',\n        target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n        label: 'credential keychain entry',\n      });\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store credentials in system keyring. Using file storage.',\n    'Credentials saved to ~/.workos/credentials.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function hasCredentials(): boolean {\n  if (forceInsecureStorage) {\n    return fileExists();\n  }\n  return readFromKeyring() !== null || fileExists();\n}\n\nexport function getCredentials(): Credentials | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringCreds = readFromKeyring();\n  if (keyringCreds) return keyringCreds;\n\n  const fileCreds = readFromFile();\n  if (fileCreds) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileCreds);\n    }\n    return fileCreds;\n  }\n\n  return null;\n}\n\nexport function saveCredentials(creds: Credentials): void {\n  if (forceInsecureStorage) return writeToFile(creds);\n\n  if (!writeToKeyring(creds)) {\n    showFallbackWarning();\n    writeToFile(creds);\n  }\n}\n\nexport function clearCredentials(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function updateTokens(accessToken: string, expiresAt: number, refreshToken?: string): void {\n  const creds = getCredentials();\n  if (!creds) {\n    throw new Error('No existing credentials to update');\n  }\n\n  const updated: Credentials = {\n    ...creds,\n    accessToken,\n    expiresAt,\n    ...(refreshToken && { refreshToken }),\n  };\n\n  saveCredentials(updated);\n}\n\n/**\n * Diagnostic info about credential storage state — for debugging auth failures.\n */\nexport function diagnoseCredentials(): string[] {\n  const lines: string[] = [];\n  const filePath = getCredentialsPath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<Credentials>;\n      const expired = parsed.expiresAt ? Date.now() >= parsed.expiresAt : 'unknown';\n      lines.push(\n        `file creds: userId=${parsed.userId ?? 'missing'}, expired=${expired}, hasRefreshToken=${!!parsed.refreshToken}`,\n      );\n    } catch (e) {\n      lines.push(`file creds: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<Credentials>;\n      const expired = parsed.expiresAt ? Date.now() >= parsed.expiresAt : 'unknown';\n      lines.push(\n        `keyring: found, userId=${parsed.userId ?? 'missing'}, expired=${expired}, hasRefreshToken=${!!parsed.refreshToken}`,\n      );\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\nexport { getCredentialsPath };\n"]}

package/dist/lib/ensure-auth.d.ts

@@ -9,14 +9,4 @@ export interface EnsureAuthResult {
     /** Whether token was refreshed */
     tokenRefreshed: boolean;
 }
-/**
- * Ensure valid authentication before command execution.
- *
- * - No credentials: triggers login flow
- * - Expired access token (valid refresh): silently refreshes
- * - Expired refresh token: triggers login flow
- *
- * @returns Result indicating what actions were taken
- * @throws Error if login fails or refresh fails unexpectedly
- */
 export declare function ensureAuthenticated(): Promise<EnsureAuthResult>;

package/dist/lib/ensure-auth.js

@@ -6,9 +6,10 @@ import { refreshAccessToken } from './token-refresh-client.js';
 import { getCliAuthClientId, getAuthkitDomain } from './settings.js';
 import { runLogin } from '../commands/login.js';
 import { logInfo } from '../utils/debug.js';
-import { isNonInteractiveEnvironment } from '../utils/environment.js';
+import { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';
 import { exitWithAuthRequired } from '../utils/exit-codes.js';
 import { formatWorkOSCommand } from '../utils/command-invocation.js';
+import { warnIfSandboxed } from './host-probe.js';
 /**
  * Ensure valid authentication before command execution.
  *
@@ -19,18 +20,29 @@ import { formatWorkOSCommand } from '../utils/command-invocation.js';
  * @returns Result indicating what actions were taken
  * @throws Error if login fails or refresh fails unexpectedly
  */
+function exitForAuthRequired(message) {
+    if (isCiMode()) {
+        exitWithAuthRequired(message ?? 'Not authenticated. Set WORKOS_API_KEY or configure credentials before running in CI.');
+    }
+    if (isAgentMode()) {
+        exitWithAuthRequired(message ??
+            `Not authenticated. Run \`${formatWorkOSCommand('auth login')}\` on the host shell or set WORKOS_API_KEY.`);
+    }
+    exitWithAuthRequired(message);
+}
 export async function ensureAuthenticated() {
     const result = {
         authenticated: false,
         loginTriggered: false,
         tokenRefreshed: false,
     };
+    await warnIfSandboxed();
     // Case 1: No credentials or invalid credentials
     const creds = getCredentials();
     if (!creds) {
         clearCredentials(); // Clean up any corrupt/empty files
-        if (isNonInteractiveEnvironment()) {
-            exitWithAuthRequired();
+        if (!isPromptAllowed()) {
+            exitForAuthRequired();
         }
         logInfo('[ensure-auth] No valid credentials found, triggering login');
         await runLogin();
@@ -59,8 +71,10 @@ export async function ensureAuthenticated() {
             // Refresh failed - check if it's recoverable
             if (refreshResult.errorType === 'invalid_grant') {
                 clearCredentials();
-                if (isNonInteractiveEnvironment()) {
-                    exitWithAuthRequired(`Session expired. Run \`${formatWorkOSCommand('auth login')}\` in an interactive terminal to re-authenticate.`);
+                if (!isPromptAllowed()) {
+                    exitForAuthRequired(isCiMode()
+                        ? 'Session expired. Refresh credentials before running in CI, or set WORKOS_API_KEY.'
+                        : `Session expired. Run \`${formatWorkOSCommand('auth login')}\` on the host shell or set WORKOS_API_KEY.`);
                 }
                 logInfo('[ensure-auth] Refresh token expired, triggering login');
                 await runLogin();
@@ -69,8 +83,10 @@ export async function ensureAuthenticated() {
                 return result;
             }
             // Network or server error - keep credentials intact for retry
-            if (isNonInteractiveEnvironment()) {
-                exitWithAuthRequired(`Authentication refresh failed (${refreshResult.errorType}). Run \`${formatWorkOSCommand('auth login')}\` in an interactive terminal.`);
+            if (!isPromptAllowed()) {
+                exitForAuthRequired(isCiMode()
+                    ? `Authentication refresh failed (${refreshResult.errorType}). Refresh credentials before running in CI, or set WORKOS_API_KEY.`
+                    : `Authentication refresh failed (${refreshResult.errorType}). Run \`${formatWorkOSCommand('auth login')}\` on the host shell or set WORKOS_API_KEY.`);
             }
             logInfo(`[ensure-auth] Refresh failed (${refreshResult.errorType}), triggering login`);
             await runLogin();
@@ -81,8 +97,10 @@ export async function ensureAuthenticated() {
     }
     // Case 4: No refresh token available — clear stale creds, must login
     clearCredentials();
-    if (isNonInteractiveEnvironment()) {
-        exitWithAuthRequired(`Session expired. Run \`${formatWorkOSCommand('auth login')}\` in an interactive terminal to re-authenticate.`);
+    if (!isPromptAllowed()) {
+        exitForAuthRequired(isCiMode()
+            ? 'Session expired. Refresh credentials before running in CI, or set WORKOS_API_KEY.'
+            : `Session expired. Run \`${formatWorkOSCommand('auth login')}\` on the host shell or set WORKOS_API_KEY.`);
     }
     logInfo('[ensure-auth] No refresh token, triggering login');
     await runLogin();

package/dist/lib/ensure-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-auth.js","sourceRoot":"","sources":["../../src/lib/ensure-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAWrE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,MAAM,GAAqB;QAC/B,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,KAAK;KACtB,CAAC;IAEF,gDAAgD;IAChD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,gBAAgB,EAAE,CAAC,CAAC,mCAAmC;QACvD,IAAI,2BAA2B,EAAE,EAAE,CAAC;YAClC,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,4DAA4D,CAAC,CAAC;QACtE,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,wDAAwD,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QAEzC,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAExE,IAAI,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,WAAW,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;gBAClF,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC7F,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,6CAA6C;YAC7C,IAAI,aAAa,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;gBAChD,gBAAgB,EAAE,CAAC;gBACnB,IAAI,2BAA2B,EAAE,EAAE,CAAC;oBAClC,oBAAoB,CAClB,0BAA0B,mBAAmB,CAAC,YAAY,CAAC,mDAAmD,CAC/G,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,uDAAuD,CAAC,CAAC;gBACjE,MAAM,QAAQ,EAAE,CAAC;gBACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,8DAA8D;YAC9D,IAAI,2BAA2B,EAAE,EAAE,CAAC;gBAClC,oBAAoB,CAClB,kCAAkC,aAAa,CAAC,SAAS,YAAY,mBAAmB,CAAC,YAAY,CAAC,gCAAgC,CACvI,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iCAAiC,aAAa,CAAC,SAAS,qBAAqB,CAAC,CAAC;YACvF,MAAM,QAAQ,EAAE,CAAC;YACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;YACjD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,gBAAgB,EAAE,CAAC;IACnB,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,oBAAoB,CAClB,0BAA0B,mBAAmB,CAAC,YAAY,CAAC,mDAAmD,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAC5D,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Startup auth guard - ensures valid authentication before command execution.\n */\n\nimport { getCredentials, updateTokens, isTokenExpired, clearCredentials } from './credentials.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\nimport { getCliAuthClientId, getAuthkitDomain } from './settings.js';\nimport { runLogin } from '../commands/login.js';\nimport { logInfo } from '../utils/debug.js';\nimport { isNonInteractiveEnvironment } from '../utils/environment.js';\nimport { exitWithAuthRequired } from '../utils/exit-codes.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nexport interface EnsureAuthResult {\n  /** Whether auth is now valid */\n  authenticated: boolean;\n  /** Whether login flow was triggered */\n  loginTriggered: boolean;\n  /** Whether token was refreshed */\n  tokenRefreshed: boolean;\n}\n\n/**\n * Ensure valid authentication before command execution.\n *\n * - No credentials: triggers login flow\n * - Expired access token (valid refresh): silently refreshes\n * - Expired refresh token: triggers login flow\n *\n * @returns Result indicating what actions were taken\n * @throws Error if login fails or refresh fails unexpectedly\n */\nexport async function ensureAuthenticated(): Promise<EnsureAuthResult> {\n  const result: EnsureAuthResult = {\n    authenticated: false,\n    loginTriggered: false,\n    tokenRefreshed: false,\n  };\n\n  // Case 1: No credentials or invalid credentials\n  const creds = getCredentials();\n  if (!creds) {\n    clearCredentials(); // Clean up any corrupt/empty files\n    if (isNonInteractiveEnvironment()) {\n      exitWithAuthRequired();\n    }\n    logInfo('[ensure-auth] No valid credentials found, triggering login');\n    await runLogin();\n    result.loginTriggered = true;\n    result.authenticated = getCredentials() !== null;\n    return result;\n  }\n\n  // Case 2: Access token still valid\n  if (!isTokenExpired(creds)) {\n    result.authenticated = true;\n    return result;\n  }\n\n  // Case 3: Access token expired, try refresh\n  if (creds.refreshToken) {\n    logInfo('[ensure-auth] Access token expired, attempting refresh');\n\n    const clientId = getCliAuthClientId();\n    const authkitDomain = getAuthkitDomain();\n\n    if (clientId && authkitDomain) {\n      const refreshResult = await refreshAccessToken(authkitDomain, clientId);\n\n      if (refreshResult.success && refreshResult.accessToken && refreshResult.expiresAt) {\n        updateTokens(refreshResult.accessToken, refreshResult.expiresAt, refreshResult.refreshToken);\n        result.tokenRefreshed = true;\n        result.authenticated = true;\n        return result;\n      }\n\n      // Refresh failed - check if it's recoverable\n      if (refreshResult.errorType === 'invalid_grant') {\n        clearCredentials();\n        if (isNonInteractiveEnvironment()) {\n          exitWithAuthRequired(\n            `Session expired. Run \\`${formatWorkOSCommand('auth login')}\\` in an interactive terminal to re-authenticate.`,\n          );\n        }\n        logInfo('[ensure-auth] Refresh token expired, triggering login');\n        await runLogin();\n        result.loginTriggered = true;\n        result.authenticated = getCredentials() !== null;\n        return result;\n      }\n\n      // Network or server error - keep credentials intact for retry\n      if (isNonInteractiveEnvironment()) {\n        exitWithAuthRequired(\n          `Authentication refresh failed (${refreshResult.errorType}). Run \\`${formatWorkOSCommand('auth login')}\\` in an interactive terminal.`,\n        );\n      }\n      logInfo(`[ensure-auth] Refresh failed (${refreshResult.errorType}), triggering login`);\n      await runLogin();\n      result.loginTriggered = true;\n      result.authenticated = getCredentials() !== null;\n      return result;\n    }\n  }\n\n  // Case 4: No refresh token available — clear stale creds, must login\n  clearCredentials();\n  if (isNonInteractiveEnvironment()) {\n    exitWithAuthRequired(\n      `Session expired. Run \\`${formatWorkOSCommand('auth login')}\\` in an interactive terminal to re-authenticate.`,\n    );\n  }\n  logInfo('[ensure-auth] No refresh token, triggering login');\n  await runLogin();\n  result.loginTriggered = true;\n  result.authenticated = getCredentials() !== null;\n  return result;\n}\n"]}
+{"version":3,"file":"ensure-auth.js","sourceRoot":"","sources":["../../src/lib/ensure-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAWlD;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,oBAAoB,CAClB,OAAO,IAAI,sFAAsF,CAClG,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,EAAE,CAAC;QAClB,oBAAoB,CAClB,OAAO;YACL,4BAA4B,mBAAmB,CAAC,YAAY,CAAC,6CAA6C,CAC7G,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,MAAM,GAAqB;QAC/B,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,KAAK;KACtB,CAAC;IAEF,MAAM,eAAe,EAAE,CAAC;IAExB,gDAAgD;IAChD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,gBAAgB,EAAE,CAAC,CAAC,mCAAmC;QACvD,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACvB,mBAAmB,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,4DAA4D,CAAC,CAAC;QACtE,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,wDAAwD,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QAEzC,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAExE,IAAI,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,WAAW,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;gBAClF,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC7F,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,6CAA6C;YAC7C,IAAI,aAAa,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;gBAChD,gBAAgB,EAAE,CAAC;gBACnB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;oBACvB,mBAAmB,CACjB,QAAQ,EAAE;wBACR,CAAC,CAAC,mFAAmF;wBACrF,CAAC,CAAC,0BAA0B,mBAAmB,CAAC,YAAY,CAAC,6CAA6C,CAC7G,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,uDAAuD,CAAC,CAAC;gBACjE,MAAM,QAAQ,EAAE,CAAC;gBACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,8DAA8D;YAC9D,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBACvB,mBAAmB,CACjB,QAAQ,EAAE;oBACR,CAAC,CAAC,kCAAkC,aAAa,CAAC,SAAS,qEAAqE;oBAChI,CAAC,CAAC,kCAAkC,aAAa,CAAC,SAAS,YAAY,mBAAmB,CAAC,YAAY,CAAC,6CAA6C,CACxJ,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iCAAiC,aAAa,CAAC,SAAS,qBAAqB,CAAC,CAAC;YACvF,MAAM,QAAQ,EAAE,CAAC;YACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;YACjD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,gBAAgB,EAAE,CAAC;IACnB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,mBAAmB,CACjB,QAAQ,EAAE;YACR,CAAC,CAAC,mFAAmF;YACrF,CAAC,CAAC,0BAA0B,mBAAmB,CAAC,YAAY,CAAC,6CAA6C,CAC7G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAC5D,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Startup auth guard - ensures valid authentication before command execution.\n */\n\nimport { getCredentials, updateTokens, isTokenExpired, clearCredentials } from './credentials.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\nimport { getCliAuthClientId, getAuthkitDomain } from './settings.js';\nimport { runLogin } from '../commands/login.js';\nimport { logInfo } from '../utils/debug.js';\nimport { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';\nimport { exitWithAuthRequired } from '../utils/exit-codes.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { warnIfSandboxed } from './host-probe.js';\n\nexport interface EnsureAuthResult {\n  /** Whether auth is now valid */\n  authenticated: boolean;\n  /** Whether login flow was triggered */\n  loginTriggered: boolean;\n  /** Whether token was refreshed */\n  tokenRefreshed: boolean;\n}\n\n/**\n * Ensure valid authentication before command execution.\n *\n * - No credentials: triggers login flow\n * - Expired access token (valid refresh): silently refreshes\n * - Expired refresh token: triggers login flow\n *\n * @returns Result indicating what actions were taken\n * @throws Error if login fails or refresh fails unexpectedly\n */\nfunction exitForAuthRequired(message?: string): never {\n  if (isCiMode()) {\n    exitWithAuthRequired(\n      message ?? 'Not authenticated. Set WORKOS_API_KEY or configure credentials before running in CI.',\n    );\n  }\n\n  if (isAgentMode()) {\n    exitWithAuthRequired(\n      message ??\n        `Not authenticated. Run \\`${formatWorkOSCommand('auth login')}\\` on the host shell or set WORKOS_API_KEY.`,\n    );\n  }\n\n  exitWithAuthRequired(message);\n}\n\nexport async function ensureAuthenticated(): Promise<EnsureAuthResult> {\n  const result: EnsureAuthResult = {\n    authenticated: false,\n    loginTriggered: false,\n    tokenRefreshed: false,\n  };\n\n  await warnIfSandboxed();\n\n  // Case 1: No credentials or invalid credentials\n  const creds = getCredentials();\n  if (!creds) {\n    clearCredentials(); // Clean up any corrupt/empty files\n    if (!isPromptAllowed()) {\n      exitForAuthRequired();\n    }\n    logInfo('[ensure-auth] No valid credentials found, triggering login');\n    await runLogin();\n    result.loginTriggered = true;\n    result.authenticated = getCredentials() !== null;\n    return result;\n  }\n\n  // Case 2: Access token still valid\n  if (!isTokenExpired(creds)) {\n    result.authenticated = true;\n    return result;\n  }\n\n  // Case 3: Access token expired, try refresh\n  if (creds.refreshToken) {\n    logInfo('[ensure-auth] Access token expired, attempting refresh');\n\n    const clientId = getCliAuthClientId();\n    const authkitDomain = getAuthkitDomain();\n\n    if (clientId && authkitDomain) {\n      const refreshResult = await refreshAccessToken(authkitDomain, clientId);\n\n      if (refreshResult.success && refreshResult.accessToken && refreshResult.expiresAt) {\n        updateTokens(refreshResult.accessToken, refreshResult.expiresAt, refreshResult.refreshToken);\n        result.tokenRefreshed = true;\n        result.authenticated = true;\n        return result;\n      }\n\n      // Refresh failed - check if it's recoverable\n      if (refreshResult.errorType === 'invalid_grant') {\n        clearCredentials();\n        if (!isPromptAllowed()) {\n          exitForAuthRequired(\n            isCiMode()\n              ? 'Session expired. Refresh credentials before running in CI, or set WORKOS_API_KEY.'\n              : `Session expired. Run \\`${formatWorkOSCommand('auth login')}\\` on the host shell or set WORKOS_API_KEY.`,\n          );\n        }\n        logInfo('[ensure-auth] Refresh token expired, triggering login');\n        await runLogin();\n        result.loginTriggered = true;\n        result.authenticated = getCredentials() !== null;\n        return result;\n      }\n\n      // Network or server error - keep credentials intact for retry\n      if (!isPromptAllowed()) {\n        exitForAuthRequired(\n          isCiMode()\n            ? `Authentication refresh failed (${refreshResult.errorType}). Refresh credentials before running in CI, or set WORKOS_API_KEY.`\n            : `Authentication refresh failed (${refreshResult.errorType}). Run \\`${formatWorkOSCommand('auth login')}\\` on the host shell or set WORKOS_API_KEY.`,\n        );\n      }\n      logInfo(`[ensure-auth] Refresh failed (${refreshResult.errorType}), triggering login`);\n      await runLogin();\n      result.loginTriggered = true;\n      result.authenticated = getCredentials() !== null;\n      return result;\n    }\n  }\n\n  // Case 4: No refresh token available — clear stale creds, must login\n  clearCredentials();\n  if (!isPromptAllowed()) {\n    exitForAuthRequired(\n      isCiMode()\n        ? 'Session expired. Refresh credentials before running in CI, or set WORKOS_API_KEY.'\n        : `Session expired. Run \\`${formatWorkOSCommand('auth login')}\\` on the host shell or set WORKOS_API_KEY.`,\n    );\n  }\n  logInfo('[ensure-auth] No refresh token, triggering login');\n  await runLogin();\n  result.loginTriggered = true;\n  result.authenticated = getCredentials() !== null;\n  return result;\n}\n"]}

package/dist/lib/host-probe.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Host capability probes for non-interactive / sandboxed environments.
+ *
+ * When the CLI runs inside an AI agent sandbox (Claude Code, Codex, Cursor),
+ * the keyring, home directory, network, or browser may be unavailable.
+ * These helpers detect that situation and emit a single actionable warning
+ * per session instead of letting opaque EPERM errors confuse the agent.
+ */
+export type HostCapability = 'home-fs' | 'keychain' | 'network' | 'browser-launch' | 'localhost-bind';
+export type HostOperation = 'read' | 'write' | 'delete' | 'connect' | 'open' | 'listen';
+export interface HostCapabilityDetails {
+    operation?: HostOperation;
+    target?: string;
+    label?: string;
+}
+export interface ProbeFailure extends HostCapabilityDetails {
+    capability: HostCapability;
+    detail: string;
+}
+export interface ProbeResult {
+    ok: boolean;
+    failures: ProbeFailure[];
+}
+export declare function formatHostProbeFailure(failure: ProbeFailure): string;
+export declare function runHostProbe(): Promise<ProbeResult>;
+export declare function warnIfSandboxed(): Promise<void>;
+export declare function observeHostFailure(capability: HostCapability, error: unknown, details?: HostCapabilityDetails): void;
+export declare function _resetProbeState(): void;

package/dist/lib/host-probe.js

@@ -0,0 +1,154 @@
+/**
+ * Host capability probes for non-interactive / sandboxed environments.
+ *
+ * When the CLI runs inside an AI agent sandbox (Claude Code, Codex, Cursor),
+ * the keyring, home directory, network, or browser may be unavailable.
+ * These helpers detect that situation and emit a single actionable warning
+ * per session instead of letting opaque EPERM errors confuse the agent.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { Entry } from '@napi-rs/keyring';
+import { isAgentMode, isCiMode } from '../utils/interaction-mode.js';
+import { logInfo, logVisibleWarn } from '../utils/debug.js';
+let warnedThisSession = false;
+let cachedProbe;
+const KEYCHAIN_SERVICE = 'workos-cli';
+const KEYCHAIN_PROBE_ACCOUNT = 'probe';
+const PERMISSION_PATTERNS = [
+    /\bEPERM\b/i,
+    /\bEACCES\b/i,
+    /operation not permitted/i,
+    /permission denied/i,
+    /\bsandboxd?\b/i,
+    /interaction is not allowed/i,
+    /access denied/i,
+];
+function isPermissionError(error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    return PERMISSION_PATTERNS.some((p) => p.test(msg));
+}
+function isLikelyHostFailure(capability, error) {
+    if (capability === 'browser-launch' || capability === 'localhost-bind') {
+        return true;
+    }
+    return isPermissionError(error);
+}
+function isMissingEntryError(error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    return msg.includes('not found') || msg.includes('No such');
+}
+async function probeHomeFs() {
+    const dir = path.join(os.homedir(), '.workos');
+    const probePath = path.join(dir, `.probe-${process.pid}-${crypto.randomUUID()}`);
+    try {
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+        await fs.writeFile(probePath, new Date().toISOString(), { mode: 0o600 });
+        return null;
+    }
+    catch (error) {
+        // Only treat permission-class errors as sandbox indicators. Transient
+        // errors like ENOSPC/EIO would otherwise produce a misleading "sandboxed
+        // environment" warning. Mirrors the gating in observeHostFailure().
+        if (!isPermissionError(error))
+            return null;
+        const detail = error instanceof Error ? error.message : String(error);
+        return { capability: 'home-fs', detail, operation: 'write', target: dir, label: 'WorkOS home directory' };
+    }
+    finally {
+        // Best-effort cleanup so a successful write never leaves an orphan file
+        // behind. Ignore unlink failures: if the file was never created the
+        // unlink will fail with ENOENT, and any other failure is unrelated to
+        // the probe's purpose (which is checking write access, not delete).
+        await fs.unlink(probePath).catch(() => { });
+    }
+}
+function probeKeychain() {
+    try {
+        const entry = new Entry(KEYCHAIN_SERVICE, KEYCHAIN_PROBE_ACCOUNT);
+        entry.getPassword();
+        return null;
+    }
+    catch (error) {
+        // A "not found" / "No such" error means the keychain is reachable but the
+        // probe entry simply doesn't exist — that's a healthy state, not a failure.
+        if (isMissingEntryError(error)) {
+            return null;
+        }
+        // Only treat permission-class errors as sandbox indicators. A user-canceled
+        // macOS prompt or a transient keyring daemon hiccup would otherwise produce
+        // a misleading "sandboxed environment" warning. Mirrors probeHomeFs() and
+        // observeHostFailure().
+        if (!isPermissionError(error))
+            return null;
+        const detail = error instanceof Error ? error.message : String(error);
+        return {
+            capability: 'keychain',
+            detail,
+            operation: 'read',
+            target: `${KEYCHAIN_SERVICE}/${KEYCHAIN_PROBE_ACCOUNT}`,
+            label: 'WorkOS keychain probe',
+        };
+    }
+}
+export function formatHostProbeFailure(failure) {
+    const parts = [failure.label ?? failure.capability];
+    if (failure.operation)
+        parts.push(`operation=${failure.operation}`);
+    if (failure.target)
+        parts.push(`target=${failure.target}`);
+    parts.push(`error=${failure.detail}`);
+    return parts.join(', ');
+}
+function formatHostFailureContext(capability, details, detail) {
+    return formatHostProbeFailure({ capability, ...details, detail });
+}
+export async function runHostProbe() {
+    if (cachedProbe)
+        return cachedProbe;
+    const failures = [];
+    const fsResult = await probeHomeFs();
+    if (fsResult)
+        failures.push(fsResult);
+    const keychainResult = probeKeychain();
+    if (keychainResult)
+        failures.push(keychainResult);
+    cachedProbe = { ok: failures.length === 0, failures };
+    return cachedProbe;
+}
+function shouldWarnForHostTrust() {
+    return isAgentMode() || isCiMode();
+}
+export async function warnIfSandboxed() {
+    if (warnedThisSession)
+        return;
+    if (!shouldWarnForHostTrust())
+        return;
+    const probe = await runHostProbe();
+    if (probe.ok)
+        return;
+    warnedThisSession = true;
+    const caps = probe.failures.map((f) => f.capability).join(', ');
+    logVisibleWarn(`Host capabilities may be unavailable (${caps}). This may be a sandboxed environment.`, 'Re-run this command on the host shell before trusting auth or API failures.');
+    for (const f of probe.failures) {
+        logInfo(`[host-probe] ${formatHostProbeFailure(f)}`);
+    }
+}
+export function observeHostFailure(capability, error, details = {}) {
+    if (warnedThisSession)
+        return;
+    if (!shouldWarnForHostTrust())
+        return;
+    if (!isLikelyHostFailure(capability, error))
+        return;
+    warnedThisSession = true;
+    const detail = error instanceof Error ? error.message : String(error);
+    logVisibleWarn(`Host capability "${capability}" failed (${detail}). This may be a sandboxed environment.`, 'Re-run this command on the host shell before trusting auth or API failures.');
+    logInfo(`[host-probe] ${formatHostFailureContext(capability, details, detail)}`);
+}
+export function _resetProbeState() {
+    cachedProbe = undefined;
+    warnedThisSession = false;
+}
+//# sourceMappingURL=host-probe.js.map