workos 0.13.4 → 0.15.0

package/dist/doctor/issues.js.map

@@ -1 +1 @@
-{"version":3,"file":"issues.js","sourceRoot":"","sources":["../../src/doctor/issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,eAAe,EAAE;QACf,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,uCAAuC;KACjD;IACD,iBAAiB,EAAE;QACjB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,4CAA4C;KACtD;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yBAAyB;QAClC,oCAAoC;KACrC;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,+CAA+C;KACzD;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,8DAA8D;QAC3E,OAAO,EAAE,yBAAyB;KACnC;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yBAAyB;QAClC,mDAAmD;KACpD;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,8CAA8C;KACxD;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,mDAAmD;KACjE;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,uCAAuC;KACjD;IACD,kBAAkB,EAAE;QAClB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,4CAA4C;KACtD;CACF,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,MAAgD;IAC3E,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,aAAa;IACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,qCAAqC;YAC9C,WAAW,EAAE,yBAAyB,IAAI,EAAE;YAC5C,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG;YAC9E,WAAW,EAAE,QAAQ,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACvF,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,4BAA4B,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;YAChE,WAAW,EAAE,qDAAqD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IAEtE,6CAA6C;IAC7C,IAAI,MAAM,CAAC,WAAW,CAAC,UAAU,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,GAAG,iBAAiB,CAAC,qBAAqB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,GAAG,iBAAiB,CAAC,eAAe;gBACpC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,GAAG,iBAAiB,CAAC,kBAAkB;gBACvC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,gBAAgB,IAAI,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjG,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,8BAA8B,SAAS,eAAe,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE;gBAC7F,WAAW,EAAE,4BAA4B;gBACzC,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,cAA6B,EAAE,OAAe;IACtE,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,eAAe,OAAO,EAAE,CAAC;QAClC,KAAK,SAAS,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,gBAAgB,OAAO,EAAE,CAAC;QACnC,KAAK,KAAK;YACR,OAAO,cAAc,OAAO,EAAE,CAAC;QACjC;YACE,OAAO,cAAc,OAAO,EAAE,CAAC;IACnC,CAAC;AACH,CAAC","sourcesContent":["import type { Issue, DoctorReport } from './types.js';\nimport { getInstallHint, languageToSdkLanguage } from './checks/language.js';\n\nexport const ISSUE_DEFINITIONS = {\n  MISSING_API_KEY: {\n    severity: 'error' as const,\n    message: 'WORKOS_API_KEY environment variable not set',\n    remediation: 'Set WORKOS_API_KEY in your .env.local file',\n    docsUrl: 'https://dashboard.workos.com/api-keys',\n  },\n  MISSING_CLIENT_ID: {\n    severity: 'error' as const,\n    message: 'WORKOS_CLIENT_ID environment variable not set',\n    remediation: 'Set WORKOS_CLIENT_ID in your .env.local file',\n    docsUrl: 'https://dashboard.workos.com/configuration',\n  },\n  SDK_OUTDATED: {\n    severity: 'warning' as const,\n    message: 'SDK version is outdated',\n    // remediation generated dynamically\n  },\n  COOKIE_DOMAIN_NOT_SET: {\n    severity: 'warning' as const,\n    message: 'Cookie domain not explicitly set',\n    remediation: 'Consider setting WORKOS_COOKIE_DOMAIN for cross-subdomain auth',\n    docsUrl: 'https://workos.com/docs/authkit/cookie-domain',\n  },\n  NO_SDK_FOUND: {\n    severity: 'error' as const,\n    message: 'No WorkOS SDK found in dependencies',\n    remediation: 'Install a WorkOS SDK: npm install @workos-inc/authkit-nextjs',\n    docsUrl: 'https://workos.com/docs',\n  },\n  API_UNREACHABLE: {\n    severity: 'warning' as const,\n    message: 'Cannot reach WorkOS API',\n    // remediation generated dynamically based on error\n  },\n  REDIRECT_URI_MISMATCH: {\n    severity: 'warning' as const,\n    message: 'Redirect URI not found in dashboard configuration',\n    docsUrl: 'https://workos.com/docs/authkit/redirect-uri',\n  },\n  PROD_API_CALL_BLOCKED: {\n    severity: 'warning' as const,\n    message: 'Dashboard settings not fetched (production API key)',\n    remediation: 'Use a staging API key to fetch dashboard settings',\n  },\n  INVALID_API_KEY: {\n    severity: 'error' as const,\n    message: 'API key is invalid or expired',\n    remediation: 'Check your WORKOS_API_KEY in the WorkOS dashboard',\n    docsUrl: 'https://dashboard.workos.com/api-keys',\n  },\n  CLIENT_ID_MISMATCH: {\n    severity: 'error' as const,\n    message: 'Client ID does not match the API key environment',\n    remediation: 'Ensure WORKOS_CLIENT_ID matches the environment for your API key',\n    docsUrl: 'https://dashboard.workos.com/configuration',\n  },\n};\n\nexport function detectIssues(report: Omit<DoctorReport, 'issues' | 'summary'>): Issue[] {\n  const issues: Issue[] = [];\n\n  // SDK issues\n  if (!report.sdk.name) {\n    const lang = languageToSdkLanguage(report.language.name);\n    const hint = getInstallHint(lang);\n    issues.push({\n      code: 'NO_SDK_FOUND',\n      severity: 'error',\n      message: 'No WorkOS SDK found in dependencies',\n      remediation: `Install a WorkOS SDK: ${hint}`,\n      docsUrl: 'https://workos.com/docs',\n    });\n  } else if (report.sdk.outdated && report.sdk.version && report.sdk.latest) {\n    issues.push({\n      code: 'SDK_OUTDATED',\n      severity: 'warning',\n      message: `SDK version outdated (${report.sdk.version} → ${report.sdk.latest})`,\n      remediation: `Run: ${getUpdateCommand(report.runtime.packageManager, report.sdk.name)}`,\n      details: { installed: report.sdk.version, latest: report.sdk.latest },\n    });\n  }\n\n  // Environment issues\n  if (!report.environment.apiKeyConfigured) {\n    issues.push({ code: 'MISSING_API_KEY', ...ISSUE_DEFINITIONS.MISSING_API_KEY });\n  }\n\n  if (!report.environment.clientId) {\n    issues.push({ code: 'MISSING_CLIENT_ID', ...ISSUE_DEFINITIONS.MISSING_CLIENT_ID });\n  }\n\n  if (report.sdk.isAuthKit && !report.environment.cookieDomain) {\n    issues.push({ code: 'COOKIE_DOMAIN_NOT_SET', ...ISSUE_DEFINITIONS.COOKIE_DOMAIN_NOT_SET });\n  }\n\n  // Connectivity issues\n  if (!report.connectivity.apiReachable && !report.connectivity.error?.includes('Skipped')) {\n    issues.push({\n      code: 'API_UNREACHABLE',\n      severity: 'warning',\n      message: `Cannot reach WorkOS API: ${report.connectivity.error}`,\n      remediation: 'Check your network connection and firewall settings',\n    });\n  }\n\n  // Note: Redirect URI mismatch detection disabled - WorkOS API doesn't expose\n  // a public endpoint to list configured redirect URIs for verification\n\n  // Production key warning (no dashboard data)\n  if (report.environment.apiKeyType === 'production' && !report.dashboardSettings) {\n    issues.push({\n      code: 'PROD_API_CALL_BLOCKED',\n      ...ISSUE_DEFINITIONS.PROD_API_CALL_BLOCKED,\n    });\n  }\n\n  // Credential validation issues\n  if (report.credentialValidation) {\n    if (!report.credentialValidation.valid) {\n      issues.push({\n        code: 'INVALID_API_KEY',\n        ...ISSUE_DEFINITIONS.INVALID_API_KEY,\n        details: { error: report.credentialValidation.error },\n      });\n    } else if (!report.credentialValidation.clientIdMatch) {\n      issues.push({\n        code: 'CLIENT_ID_MISMATCH',\n        ...ISSUE_DEFINITIONS.CLIENT_ID_MISMATCH,\n        details: { error: report.credentialValidation.error },\n      });\n    }\n  }\n\n  // Auth pattern findings — map directly to issues\n  if (report.authPatterns) {\n    for (const finding of report.authPatterns.findings) {\n      issues.push({\n        code: finding.code,\n        severity: finding.severity,\n        message: finding.message,\n        remediation: finding.remediation,\n        docsUrl: finding.docsUrl,\n      });\n    }\n  }\n\n  // Skill freshness — warn when agent-installed skills trail the bundled version.\n  // Surfaced so users know their coding agent is using older WorkOS guidance.\n  if (report.skills?.bundledVersion) {\n    const stale = report.skills.agents.filter((a) => a.stale);\n    if (stale.length > 0) {\n      const agentList = stale.map((a) => `${a.agent} (${a.installedVersion ?? 'unknown'})`).join(', ');\n      issues.push({\n        code: 'SKILLS_OUTDATED',\n        severity: 'warning',\n        message: `WorkOS skills outdated for ${agentList} — bundled: ${report.skills.bundledVersion}`,\n        remediation: 'Run: workos skills install',\n        details: { bundledVersion: report.skills.bundledVersion, stale: stale.map((a) => a.agent) },\n      });\n    }\n  }\n\n  return issues;\n}\n\nfunction getUpdateCommand(packageManager: string | null, sdkName: string): string {\n  switch (packageManager) {\n    case 'pnpm':\n      return `pnpm update ${sdkName}`;\n    case 'Yarn V1':\n    case 'Yarn V2/3/4':\n      return `yarn upgrade ${sdkName}`;\n    case 'Bun':\n      return `bun update ${sdkName}`;\n    default:\n      return `npm update ${sdkName}`;\n  }\n}\n"]}
+{"version":3,"file":"issues.js","sourceRoot":"","sources":["../../src/doctor/issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,eAAe,EAAE;QACf,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,uCAAuC;KACjD;IACD,iBAAiB,EAAE;QACjB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,4CAA4C;KACtD;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yBAAyB;QAClC,oCAAoC;KACrC;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,+CAA+C;KACzD;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,8DAA8D;QAC3E,OAAO,EAAE,yBAAyB;KACnC;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yBAAyB;QAClC,mDAAmD;KACpD;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,8CAA8C;KACxD;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,mDAAmD;KACjE;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,uCAAuC;KACjD;IACD,kBAAkB,EAAE;QAClB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,4CAA4C;KACtD;IACD,wBAAwB,EAAE;QACxB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,4HAA4H;KAC/H;CACF,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,MAAgD;IAC3E,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,aAAa;IACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,qCAAqC;YAC9C,WAAW,EAAE,yBAAyB,IAAI,EAAE;YAC5C,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG;YAC9E,WAAW,EAAE,QAAQ,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACvF,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,GAAG,iBAAiB,CAAC,wBAAwB;YAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,4BAA4B,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;YAChE,WAAW,EAAE,qDAAqD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IAEtE,6CAA6C;IAC7C,IAAI,MAAM,CAAC,WAAW,CAAC,UAAU,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,GAAG,iBAAiB,CAAC,qBAAqB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,GAAG,iBAAiB,CAAC,eAAe;gBACpC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,GAAG,iBAAiB,CAAC,kBAAkB;gBACvC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,gBAAgB,IAAI,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjG,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,8BAA8B,SAAS,eAAe,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE;gBAC7F,WAAW,EAAE,4BAA4B;gBACzC,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,cAA6B,EAAE,OAAe;IACtE,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,eAAe,OAAO,EAAE,CAAC;QAClC,KAAK,SAAS,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,gBAAgB,OAAO,EAAE,CAAC;QACnC,KAAK,KAAK;YACR,OAAO,cAAc,OAAO,EAAE,CAAC;QACjC;YACE,OAAO,cAAc,OAAO,EAAE,CAAC;IACnC,CAAC;AACH,CAAC","sourcesContent":["import type { Issue, DoctorReport } from './types.js';\nimport { getInstallHint, languageToSdkLanguage } from './checks/language.js';\n\nexport const ISSUE_DEFINITIONS = {\n  MISSING_API_KEY: {\n    severity: 'error' as const,\n    message: 'WORKOS_API_KEY environment variable not set',\n    remediation: 'Set WORKOS_API_KEY in your .env.local file',\n    docsUrl: 'https://dashboard.workos.com/api-keys',\n  },\n  MISSING_CLIENT_ID: {\n    severity: 'error' as const,\n    message: 'WORKOS_CLIENT_ID environment variable not set',\n    remediation: 'Set WORKOS_CLIENT_ID in your .env.local file',\n    docsUrl: 'https://dashboard.workos.com/configuration',\n  },\n  SDK_OUTDATED: {\n    severity: 'warning' as const,\n    message: 'SDK version is outdated',\n    // remediation generated dynamically\n  },\n  COOKIE_DOMAIN_NOT_SET: {\n    severity: 'warning' as const,\n    message: 'Cookie domain not explicitly set',\n    remediation: 'Consider setting WORKOS_COOKIE_DOMAIN for cross-subdomain auth',\n    docsUrl: 'https://workos.com/docs/authkit/cookie-domain',\n  },\n  NO_SDK_FOUND: {\n    severity: 'error' as const,\n    message: 'No WorkOS SDK found in dependencies',\n    remediation: 'Install a WorkOS SDK: npm install @workos-inc/authkit-nextjs',\n    docsUrl: 'https://workos.com/docs',\n  },\n  API_UNREACHABLE: {\n    severity: 'warning' as const,\n    message: 'Cannot reach WorkOS API',\n    // remediation generated dynamically based on error\n  },\n  REDIRECT_URI_MISMATCH: {\n    severity: 'warning' as const,\n    message: 'Redirect URI not found in dashboard configuration',\n    docsUrl: 'https://workos.com/docs/authkit/redirect-uri',\n  },\n  PROD_API_CALL_BLOCKED: {\n    severity: 'warning' as const,\n    message: 'Dashboard settings not fetched (production API key)',\n    remediation: 'Use a staging API key to fetch dashboard settings',\n  },\n  INVALID_API_KEY: {\n    severity: 'error' as const,\n    message: 'API key is invalid or expired',\n    remediation: 'Check your WORKOS_API_KEY in the WorkOS dashboard',\n    docsUrl: 'https://dashboard.workos.com/api-keys',\n  },\n  CLIENT_ID_MISMATCH: {\n    severity: 'error' as const,\n    message: 'Client ID does not match the API key environment',\n    remediation: 'Ensure WORKOS_CLIENT_ID matches the environment for your API key',\n    docsUrl: 'https://dashboard.workos.com/configuration',\n  },\n  HOST_EXECUTION_UNTRUSTED: {\n    severity: 'warning' as const,\n    message: 'Host-only WorkOS state may be unavailable in this shell',\n    remediation:\n      'Agent/CI host execution is untrusted. Re-run this command on the host shell before trusting auth, config, or API failures.',\n  },\n};\n\nexport function detectIssues(report: Omit<DoctorReport, 'issues' | 'summary'>): Issue[] {\n  const issues: Issue[] = [];\n\n  // SDK issues\n  if (!report.sdk.name) {\n    const lang = languageToSdkLanguage(report.language.name);\n    const hint = getInstallHint(lang);\n    issues.push({\n      code: 'NO_SDK_FOUND',\n      severity: 'error',\n      message: 'No WorkOS SDK found in dependencies',\n      remediation: `Install a WorkOS SDK: ${hint}`,\n      docsUrl: 'https://workos.com/docs',\n    });\n  } else if (report.sdk.outdated && report.sdk.version && report.sdk.latest) {\n    issues.push({\n      code: 'SDK_OUTDATED',\n      severity: 'warning',\n      message: `SDK version outdated (${report.sdk.version} → ${report.sdk.latest})`,\n      remediation: `Run: ${getUpdateCommand(report.runtime.packageManager, report.sdk.name)}`,\n      details: { installed: report.sdk.version, latest: report.sdk.latest },\n    });\n  }\n\n  // Environment issues\n  if (!report.environment.apiKeyConfigured) {\n    issues.push({ code: 'MISSING_API_KEY', ...ISSUE_DEFINITIONS.MISSING_API_KEY });\n  }\n\n  if (!report.environment.clientId) {\n    issues.push({ code: 'MISSING_CLIENT_ID', ...ISSUE_DEFINITIONS.MISSING_CLIENT_ID });\n  }\n\n  if (report.sdk.isAuthKit && !report.environment.cookieDomain) {\n    issues.push({ code: 'COOKIE_DOMAIN_NOT_SET', ...ISSUE_DEFINITIONS.COOKIE_DOMAIN_NOT_SET });\n  }\n\n  if (!report.hostExecution.ok) {\n    issues.push({\n      code: 'HOST_EXECUTION_UNTRUSTED',\n      ...ISSUE_DEFINITIONS.HOST_EXECUTION_UNTRUSTED,\n      details: { failures: report.hostExecution.failures },\n    });\n  }\n\n  // Connectivity issues\n  if (!report.connectivity.apiReachable && !report.connectivity.error?.includes('Skipped')) {\n    issues.push({\n      code: 'API_UNREACHABLE',\n      severity: 'warning',\n      message: `Cannot reach WorkOS API: ${report.connectivity.error}`,\n      remediation: 'Check your network connection and firewall settings',\n    });\n  }\n\n  // Note: Redirect URI mismatch detection disabled - WorkOS API doesn't expose\n  // a public endpoint to list configured redirect URIs for verification\n\n  // Production key warning (no dashboard data)\n  if (report.environment.apiKeyType === 'production' && !report.dashboardSettings) {\n    issues.push({\n      code: 'PROD_API_CALL_BLOCKED',\n      ...ISSUE_DEFINITIONS.PROD_API_CALL_BLOCKED,\n    });\n  }\n\n  // Credential validation issues\n  if (report.credentialValidation) {\n    if (!report.credentialValidation.valid) {\n      issues.push({\n        code: 'INVALID_API_KEY',\n        ...ISSUE_DEFINITIONS.INVALID_API_KEY,\n        details: { error: report.credentialValidation.error },\n      });\n    } else if (!report.credentialValidation.clientIdMatch) {\n      issues.push({\n        code: 'CLIENT_ID_MISMATCH',\n        ...ISSUE_DEFINITIONS.CLIENT_ID_MISMATCH,\n        details: { error: report.credentialValidation.error },\n      });\n    }\n  }\n\n  // Auth pattern findings — map directly to issues\n  if (report.authPatterns) {\n    for (const finding of report.authPatterns.findings) {\n      issues.push({\n        code: finding.code,\n        severity: finding.severity,\n        message: finding.message,\n        remediation: finding.remediation,\n        docsUrl: finding.docsUrl,\n      });\n    }\n  }\n\n  // Skill freshness — warn when agent-installed skills trail the bundled version.\n  // Surfaced so users know their coding agent is using older WorkOS guidance.\n  if (report.skills?.bundledVersion) {\n    const stale = report.skills.agents.filter((a) => a.stale);\n    if (stale.length > 0) {\n      const agentList = stale.map((a) => `${a.agent} (${a.installedVersion ?? 'unknown'})`).join(', ');\n      issues.push({\n        code: 'SKILLS_OUTDATED',\n        severity: 'warning',\n        message: `WorkOS skills outdated for ${agentList} — bundled: ${report.skills.bundledVersion}`,\n        remediation: 'Run: workos skills install',\n        details: { bundledVersion: report.skills.bundledVersion, stale: stale.map((a) => a.agent) },\n      });\n    }\n  }\n\n  return issues;\n}\n\nfunction getUpdateCommand(packageManager: string | null, sdkName: string): string {\n  switch (packageManager) {\n    case 'pnpm':\n      return `pnpm update ${sdkName}`;\n    case 'Yarn V1':\n    case 'Yarn V2/3/4':\n      return `yarn upgrade ${sdkName}`;\n    case 'Bun':\n      return `bun update ${sdkName}`;\n    default:\n      return `npm update ${sdkName}`;\n  }\n}\n"]}

package/dist/doctor/output.d.ts

@@ -1,5 +1,7 @@
+import type { InteractionModeSource } from '../utils/interaction-mode.js';
 import type { DoctorReport } from './types.js';
 export interface FormatOptions {
     verbose?: boolean;
 }
 export declare function formatReport(report: DoctorReport, options?: FormatOptions): void;
+export declare function formatInteractionModeSource(source: InteractionModeSource): string;

package/dist/doctor/output.js

@@ -41,6 +41,30 @@ export function formatReport(report, options) {
     console.log(`   Client ID:        ${report.environment.clientId ?? Chalk.red('Not set')}`);
     console.log(`   API Key:          ${report.environment.apiKeyConfigured ? Chalk.green('configured') : Chalk.red('not set')}`);
     console.log(`   Base URL:         ${report.environment.baseUrl} ${Chalk.green('✓')}`);
+    // Interaction Mode
+    console.log('');
+    console.log('Interaction Mode');
+    console.log(`   Mode:             ${report.interactionMode.mode} (${formatInteractionModeSource(report.interactionMode.source)})`);
+    // Host Execution
+    console.log('');
+    console.log('Host Execution');
+    if (report.hostExecution.mode === 'interactive') {
+        console.log(`   Shell:            ${Chalk.green('✓')} Interactive host shell`);
+    }
+    else if (report.hostExecution.ok) {
+        console.log(`   Shell:            ${Chalk.green('✓')} Agent/CI context, host state reachable`);
+    }
+    else {
+        console.log(`   Shell:            ${Chalk.yellow('!')} Agent/CI context, host state may be unavailable`);
+        for (const failure of report.hostExecution.failures) {
+            const label = failure.label ?? failure.capability;
+            const target = failure.target ? ` (${failure.target})` : '';
+            console.log(`   ${Chalk.yellow('!')} ${label}${target}`);
+            if (options?.verbose) {
+                console.log(`     ${Chalk.dim(failure.detail)}`);
+            }
+        }
+    }
     // Connectivity & Credential Validation
     console.log('');
     console.log('Connectivity');
@@ -205,6 +229,24 @@ export function formatReport(report, options) {
     }));
     console.log('');
 }
+export function formatInteractionModeSource(source) {
+    switch (source) {
+        case 'flag':
+            return '--mode';
+        case 'env':
+            return 'WORKOS_MODE';
+        case 'workos_no_prompt':
+            return 'WORKOS_NO_PROMPT';
+        case 'ci_env':
+            return 'CI environment';
+        case 'agent_env':
+            return 'agent environment';
+        case 'non_tty':
+            return 'non-TTY';
+        case 'default':
+            return 'default';
+    }
+}
 function formatIssue(issue) {
     const icon = issue.severity === 'error' ? Chalk.red('✗') : Chalk.yellow('!');
     const color = issue.severity === 'error' ? Chalk.red : Chalk.yellow;

package/dist/doctor/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/doctor/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AAOhF,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,OAAuB;IACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvC,gBAAgB;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/G,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,uBAAuB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,cAAc;IACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU;QAC3C,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,qBAAqB,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,WAAW,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CACT,wBAAwB,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CACjH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,WAAW,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEtF,uCAAuC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,oBAAoB,CAAC,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACnF,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC7E,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QAC1G,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CACT,wBAAwB,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAChJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,iBAAiB,CAAC,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,aAAa,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,GAAG,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,gBAAgB,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,aAAa,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,aAAa,CAAC,EAAE,CACpH,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACnD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,cAAc;IACd,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACjD,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAC1B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBAChB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;wBAC9B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;wBACnB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBACvG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACxB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;QAChF,MAAM,aAAa,GAAG,CAAC,CAAgB,EAAU,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC;QAElE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,WAAW,CAAC,IAAI,CAAC,KAAK,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvC,SAAS;IACT,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAEvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,kCAAkC;IAClC,MAAM,UAAU,GAAmB,MAAM,CAAC,OAAO,CAAC,OAAO;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO;QAClC,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,iBAAiB;YAC3C,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,uBAAuB,CAAC;IAExD,MAAM,KAAK,GAAqB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAE,OAAiB,CAAC,CAAC,CAAE,SAAmB;QAC5E,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;KACxC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,GAAG,CACT,gBAAgB,CAAC;QACf,UAAU;QACV,KAAK;QACL,KAAK;QACL,MAAM,EAAE,gDAAgD;KACzD,CAAC,CACH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IAEpE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,GAAkB;IACnC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC","sourcesContent":["import Chalk from 'chalk';\nimport { homedir } from 'os';\nimport { createAgents } from '../commands/install-skill.js';\nimport type { DoctorReport, Issue } from './types.js';\nimport { renderSummaryBox, type SummaryBoxItem } from '../utils/summary-box.js';\nimport type { LockExpression } from '../utils/lock-art.js';\n\nexport interface FormatOptions {\n  verbose?: boolean;\n}\n\nexport function formatReport(report: DoctorReport, options?: FormatOptions): void {\n  console.log('');\n  console.log(Chalk.cyan('WorkOS Doctor'));\n  console.log(Chalk.dim('━'.repeat(70)));\n\n  // SDK & Project\n  console.log('');\n  console.log('SDK & Project Information');\n  if (report.sdk.name) {\n    console.log(`   SDK:              ${report.sdk.name}${report.sdk.version ? ` v${report.sdk.version}` : ''}`);\n  } else {\n    console.log(`   SDK:              ${Chalk.red('Not found')}`);\n  }\n  if (report.language.name !== 'Unknown') {\n    console.log(`   Language:         ${report.language.name}`);\n  }\n  if (report.language.name === 'JavaScript/TypeScript' || report.language.name === 'Unknown') {\n    console.log(`   Runtime:          Node.js ${report.runtime.nodeVersion}`);\n  }\n  if (report.framework.name) {\n    const variant = report.framework.variant ? ` (${report.framework.variant})` : '';\n    console.log(`   Framework:        ${report.framework.name} ${report.framework.version ?? ''}${variant}`);\n  }\n  if (report.language.packageManager) {\n    console.log(`   Package Manager:  ${report.language.packageManager}`);\n  } else if (report.runtime.packageManager) {\n    console.log(`   Package Manager:  ${report.runtime.packageManager} ${report.runtime.packageManagerVersion ?? ''}`);\n  }\n\n  // Environment\n  console.log('');\n  console.log('Environment Configuration');\n  const envType = report.environment.apiKeyType\n    ? report.environment.apiKeyType.charAt(0).toUpperCase() + report.environment.apiKeyType.slice(1)\n    : 'Unable to determine';\n  console.log(`   Environment:      ${envType}`);\n  console.log(`   Client ID:        ${report.environment.clientId ?? Chalk.red('Not set')}`);\n  console.log(\n    `   API Key:          ${report.environment.apiKeyConfigured ? Chalk.green('configured') : Chalk.red('not set')}`,\n  );\n  console.log(`   Base URL:         ${report.environment.baseUrl} ${Chalk.green('✓')}`);\n\n  // Connectivity & Credential Validation\n  console.log('');\n  console.log('Connectivity');\n  if (report.connectivity.apiReachable) {\n    console.log(`   API:              ${Chalk.green('✓')} Reachable (${report.connectivity.latencyMs}ms)`);\n  } else if (report.connectivity.error?.includes('Skipped')) {\n    console.log(`   API:              ${Chalk.dim('Skipped (--skip-api)')}`);\n  } else {\n    console.log(`   API:              ${Chalk.red('✗')} ${report.connectivity.error}`);\n  }\n\n  // Credential validation\n  if (report.credentialValidation) {\n    if (report.credentialValidation.valid && report.credentialValidation.clientIdMatch) {\n      console.log(`   Credentials:      ${Chalk.green('✓')} Valid and matching`);\n    } else if (!report.credentialValidation.valid) {\n      console.log(`   Credentials:      ${Chalk.red('✗')} ${report.credentialValidation.error ?? 'Invalid'}`);\n    } else if (!report.credentialValidation.clientIdMatch) {\n      console.log(`   Credentials:      ${Chalk.red('✗')} Client ID mismatch`);\n    }\n  }\n\n  // Dashboard Settings (if available)\n  if (report.dashboardSettings) {\n    console.log('');\n    console.log('Dashboard Settings (Staging)');\n    console.log(\n      `   Auth Methods:     ${report.dashboardSettings.authMethods.length > 0 ? report.dashboardSettings.authMethods.join(', ') : 'None configured'}`,\n    );\n    console.log(`   Session Timeout:  ${report.dashboardSettings.sessionTimeout ?? 'Default'}`);\n    console.log(`   MFA:              ${formatMfa(report.dashboardSettings.mfa)}`);\n    console.log(`   Organizations:    ${report.dashboardSettings.organizationCount} configured`);\n  } else if (report.dashboardError) {\n    console.log('');\n    console.log('Dashboard Settings');\n    console.log(`   Status:           ${Chalk.dim(report.dashboardError)}`);\n  }\n\n  // Redirect URI (can't verify against dashboard - no list API)\n  if (report.redirectUris?.codeUri) {\n    console.log('');\n    const source = report.redirectUris.source === 'inferred' ? 'Inferred' : 'Configured';\n    console.log(`Redirect URI (${source})`);\n    console.log(`   ${report.redirectUris.codeUri}`);\n  }\n\n  // Auth Patterns\n  if (report.authPatterns) {\n    console.log('');\n    console.log('Auth Patterns');\n    if (report.authPatterns.findings.length === 0) {\n      console.log(`   ${Chalk.green('✓')} ${report.authPatterns.checksRun} checks passed`);\n    } else {\n      console.log(\n        `   ${report.authPatterns.checksRun} checked, ${Chalk.yellow(`${report.authPatterns.findings.length} finding(s)`)}`,\n      );\n      for (const finding of report.authPatterns.findings) {\n        const icon = finding.severity === 'error' ? Chalk.red('✗') : Chalk.yellow('!');\n        console.log(`   ${icon} ${finding.message}`);\n        if (finding.filePath) {\n          console.log(`     ${Chalk.dim('File:')} ${finding.filePath}`);\n        }\n      }\n    }\n  }\n\n  // AI Analysis\n  if (report.aiAnalysis) {\n    console.log('');\n    if (report.aiAnalysis.skipped) {\n      console.log('AI Analysis');\n      console.log(`   ${Chalk.dim(report.aiAnalysis.skipReason ?? 'Skipped')}`);\n    } else {\n      const duration = (report.aiAnalysis.durationMs / 1000).toFixed(1);\n      console.log(`AI Analysis ${Chalk.dim(`(${duration}s)`)}`);\n      if (report.aiAnalysis.summary) {\n        console.log(`   ${report.aiAnalysis.summary}`);\n      }\n      console.log('');\n      for (const finding of report.aiAnalysis.findings) {\n        const icon =\n          finding.severity === 'error'\n            ? Chalk.red('✗')\n            : finding.severity === 'warning'\n              ? Chalk.yellow('!')\n              : Chalk.dim('ℹ');\n        const color =\n          finding.severity === 'error' ? Chalk.red : finding.severity === 'warning' ? Chalk.yellow : Chalk.dim;\n        console.log(`   ${icon} ${color(finding.title)}`);\n        console.log(`     ${finding.detail}`);\n        if (finding.remediation) {\n          console.log(`     ${Chalk.dim('→')} ${finding.remediation}`);\n        }\n        if (finding.filePath) {\n          console.log(`     ${Chalk.dim('File:')} ${finding.filePath}`);\n        }\n        console.log('');\n      }\n    }\n  }\n\n  // Skills refresh (--fix path)\n  if (report.skillsRefresh) {\n    const agents = createAgents(homedir());\n    const displayName = (slug: string): string => agents[slug]?.displayName ?? slug;\n    const formatVersion = (v: string | null): string => v ?? '(none)';\n\n    console.log('');\n    console.log('Skills');\n    const slugs = Object.keys(report.skillsRefresh.before);\n    for (const slug of slugs) {\n      const before = formatVersion(report.skillsRefresh.before[slug] ?? null);\n      const after = formatVersion(report.skillsRefresh.after[slug] ?? null);\n      console.log(`   ${Chalk.green('✓')} Updated WorkOS skills for ${displayName(slug)}: ${before} → ${after}`);\n    }\n  }\n\n  // Verbose mode additions\n  if (options?.verbose) {\n    console.log('');\n    console.log(Chalk.dim('Verbose Details'));\n    console.log(`   ${Chalk.dim('Project path:')}  ${report.project.path}`);\n    console.log(`   ${Chalk.dim('Timestamp:')}     ${report.timestamp}`);\n    console.log(`   ${Chalk.dim('Doctor version:')} ${report.version}`);\n  }\n\n  console.log('');\n  console.log(Chalk.dim('━'.repeat(70)));\n\n  // Issues\n  if (report.issues.length > 0) {\n    const errors = report.issues.filter((i) => i.severity === 'error');\n    const warnings = report.issues.filter((i) => i.severity === 'warning');\n\n    console.log('');\n    if (errors.length > 0) {\n      console.log(Chalk.red(`Critical Issues Found (${errors.length} errors)`));\n      console.log('');\n      for (const issue of errors) {\n        formatIssue(issue);\n      }\n    }\n\n    if (warnings.length > 0) {\n      console.log(Chalk.yellow(`Warnings (${warnings.length})`));\n      console.log('');\n      for (const issue of warnings) {\n        formatIssue(issue);\n      }\n    }\n  }\n\n  console.log('');\n\n  // Summary box with lock character\n  const expression: LockExpression = report.summary.healthy\n    ? 'success'\n    : report.summary.errors > 0\n      ? 'error'\n      : 'warning';\n\n  const title = report.summary.healthy\n    ? 'WorkOS Integration Healthy'\n    : report.summary.errors > 0\n      ? `${report.summary.errors} Issue(s) Found`\n      : `${report.summary.warnings} Warning(s) to Review`;\n\n  const items: SummaryBoxItem[] = report.issues.map((issue) => ({\n    type: issue.severity === 'error' ? ('error' as const) : ('pending' as const),\n    text: `${issue.code}: ${issue.message}`,\n  }));\n\n  console.log(\n    renderSummaryBox({\n      expression,\n      title,\n      items,\n      footer: 'workos doctor --copy | https://workos.com/docs',\n    }),\n  );\n  console.log('');\n}\n\nfunction formatIssue(issue: Issue): void {\n  const icon = issue.severity === 'error' ? Chalk.red('✗') : Chalk.yellow('!');\n  const color = issue.severity === 'error' ? Chalk.red : Chalk.yellow;\n\n  console.log(`${icon} ${color(issue.code)}: ${issue.message}`);\n  if (issue.remediation) {\n    console.log(`   ${Chalk.dim('→')} ${issue.remediation}`);\n  }\n  if (issue.docsUrl) {\n    console.log(`   ${Chalk.dim('Docs:')} ${issue.docsUrl}`);\n  }\n  console.log('');\n}\n\nfunction formatMfa(mfa: string | null): string {\n  switch (mfa) {\n    case 'required':\n      return 'Required';\n    case 'optional':\n      return 'Optional';\n    case 'disabled':\n      return 'Disabled';\n    default:\n      return 'Not configured';\n  }\n}\n"]}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/doctor/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AAOhF,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,OAAuB;IACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvC,gBAAgB;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/G,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,uBAAuB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,cAAc;IACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU;QAC3C,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,qBAAqB,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,WAAW,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CACT,wBAAwB,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CACjH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,WAAW,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEtF,mBAAmB;IACnB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CACT,wBAAwB,MAAM,CAAC,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CACtH,CAAC;IAEF,iBAAiB;IACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACjG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QACzG,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC;YAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;YACzD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,oBAAoB,CAAC,KAAK,IAAI,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACnF,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC7E,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QAC1G,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CACT,wBAAwB,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAChJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,iBAAiB,CAAC,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,aAAa,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,GAAG,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,gBAAgB,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,aAAa,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,aAAa,CAAC,EAAE,CACpH,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACnD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,cAAc;IACd,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACjD,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAC1B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBAChB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;wBAC9B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;wBACnB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBACvG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACxB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;QAChF,MAAM,aAAa,GAAG,CAAC,CAAgB,EAAU,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC;QAElE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,WAAW,CAAC,IAAI,CAAC,KAAK,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvC,SAAS;IACT,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAEvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,kCAAkC;IAClC,MAAM,UAAU,GAAmB,MAAM,CAAC,OAAO,CAAC,OAAO;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO;QAClC,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,iBAAiB;YAC3C,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,uBAAuB,CAAC;IAExD,MAAM,KAAK,GAAqB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAE,OAAiB,CAAC,CAAC,CAAE,SAAmB;QAC5E,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;KACxC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,GAAG,CACT,gBAAgB,CAAC;QACf,UAAU;QACV,KAAK;QACL,KAAK;QACL,MAAM,EAAE,gDAAgD;KACzD,CAAC,CACH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA6B;IACvE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,aAAa,CAAC;QACvB,KAAK,kBAAkB;YACrB,OAAO,kBAAkB,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC;QAC1B,KAAK,WAAW;YACd,OAAO,mBAAmB,CAAC;QAC7B,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IAEpE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,GAAkB;IACnC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC","sourcesContent":["import Chalk from 'chalk';\nimport { homedir } from 'os';\nimport { createAgents } from '../commands/install-skill.js';\nimport type { InteractionModeSource } from '../utils/interaction-mode.js';\nimport type { DoctorReport, Issue } from './types.js';\nimport { renderSummaryBox, type SummaryBoxItem } from '../utils/summary-box.js';\nimport type { LockExpression } from '../utils/lock-art.js';\n\nexport interface FormatOptions {\n  verbose?: boolean;\n}\n\nexport function formatReport(report: DoctorReport, options?: FormatOptions): void {\n  console.log('');\n  console.log(Chalk.cyan('WorkOS Doctor'));\n  console.log(Chalk.dim('━'.repeat(70)));\n\n  // SDK & Project\n  console.log('');\n  console.log('SDK & Project Information');\n  if (report.sdk.name) {\n    console.log(`   SDK:              ${report.sdk.name}${report.sdk.version ? ` v${report.sdk.version}` : ''}`);\n  } else {\n    console.log(`   SDK:              ${Chalk.red('Not found')}`);\n  }\n  if (report.language.name !== 'Unknown') {\n    console.log(`   Language:         ${report.language.name}`);\n  }\n  if (report.language.name === 'JavaScript/TypeScript' || report.language.name === 'Unknown') {\n    console.log(`   Runtime:          Node.js ${report.runtime.nodeVersion}`);\n  }\n  if (report.framework.name) {\n    const variant = report.framework.variant ? ` (${report.framework.variant})` : '';\n    console.log(`   Framework:        ${report.framework.name} ${report.framework.version ?? ''}${variant}`);\n  }\n  if (report.language.packageManager) {\n    console.log(`   Package Manager:  ${report.language.packageManager}`);\n  } else if (report.runtime.packageManager) {\n    console.log(`   Package Manager:  ${report.runtime.packageManager} ${report.runtime.packageManagerVersion ?? ''}`);\n  }\n\n  // Environment\n  console.log('');\n  console.log('Environment Configuration');\n  const envType = report.environment.apiKeyType\n    ? report.environment.apiKeyType.charAt(0).toUpperCase() + report.environment.apiKeyType.slice(1)\n    : 'Unable to determine';\n  console.log(`   Environment:      ${envType}`);\n  console.log(`   Client ID:        ${report.environment.clientId ?? Chalk.red('Not set')}`);\n  console.log(\n    `   API Key:          ${report.environment.apiKeyConfigured ? Chalk.green('configured') : Chalk.red('not set')}`,\n  );\n  console.log(`   Base URL:         ${report.environment.baseUrl} ${Chalk.green('✓')}`);\n\n  // Interaction Mode\n  console.log('');\n  console.log('Interaction Mode');\n  console.log(\n    `   Mode:             ${report.interactionMode.mode} (${formatInteractionModeSource(report.interactionMode.source)})`,\n  );\n\n  // Host Execution\n  console.log('');\n  console.log('Host Execution');\n  if (report.hostExecution.mode === 'interactive') {\n    console.log(`   Shell:            ${Chalk.green('✓')} Interactive host shell`);\n  } else if (report.hostExecution.ok) {\n    console.log(`   Shell:            ${Chalk.green('✓')} Agent/CI context, host state reachable`);\n  } else {\n    console.log(`   Shell:            ${Chalk.yellow('!')} Agent/CI context, host state may be unavailable`);\n    for (const failure of report.hostExecution.failures) {\n      const label = failure.label ?? failure.capability;\n      const target = failure.target ? ` (${failure.target})` : '';\n      console.log(`   ${Chalk.yellow('!')} ${label}${target}`);\n      if (options?.verbose) {\n        console.log(`     ${Chalk.dim(failure.detail)}`);\n      }\n    }\n  }\n\n  // Connectivity & Credential Validation\n  console.log('');\n  console.log('Connectivity');\n  if (report.connectivity.apiReachable) {\n    console.log(`   API:              ${Chalk.green('✓')} Reachable (${report.connectivity.latencyMs}ms)`);\n  } else if (report.connectivity.error?.includes('Skipped')) {\n    console.log(`   API:              ${Chalk.dim('Skipped (--skip-api)')}`);\n  } else {\n    console.log(`   API:              ${Chalk.red('✗')} ${report.connectivity.error}`);\n  }\n\n  // Credential validation\n  if (report.credentialValidation) {\n    if (report.credentialValidation.valid && report.credentialValidation.clientIdMatch) {\n      console.log(`   Credentials:      ${Chalk.green('✓')} Valid and matching`);\n    } else if (!report.credentialValidation.valid) {\n      console.log(`   Credentials:      ${Chalk.red('✗')} ${report.credentialValidation.error ?? 'Invalid'}`);\n    } else if (!report.credentialValidation.clientIdMatch) {\n      console.log(`   Credentials:      ${Chalk.red('✗')} Client ID mismatch`);\n    }\n  }\n\n  // Dashboard Settings (if available)\n  if (report.dashboardSettings) {\n    console.log('');\n    console.log('Dashboard Settings (Staging)');\n    console.log(\n      `   Auth Methods:     ${report.dashboardSettings.authMethods.length > 0 ? report.dashboardSettings.authMethods.join(', ') : 'None configured'}`,\n    );\n    console.log(`   Session Timeout:  ${report.dashboardSettings.sessionTimeout ?? 'Default'}`);\n    console.log(`   MFA:              ${formatMfa(report.dashboardSettings.mfa)}`);\n    console.log(`   Organizations:    ${report.dashboardSettings.organizationCount} configured`);\n  } else if (report.dashboardError) {\n    console.log('');\n    console.log('Dashboard Settings');\n    console.log(`   Status:           ${Chalk.dim(report.dashboardError)}`);\n  }\n\n  // Redirect URI (can't verify against dashboard - no list API)\n  if (report.redirectUris?.codeUri) {\n    console.log('');\n    const source = report.redirectUris.source === 'inferred' ? 'Inferred' : 'Configured';\n    console.log(`Redirect URI (${source})`);\n    console.log(`   ${report.redirectUris.codeUri}`);\n  }\n\n  // Auth Patterns\n  if (report.authPatterns) {\n    console.log('');\n    console.log('Auth Patterns');\n    if (report.authPatterns.findings.length === 0) {\n      console.log(`   ${Chalk.green('✓')} ${report.authPatterns.checksRun} checks passed`);\n    } else {\n      console.log(\n        `   ${report.authPatterns.checksRun} checked, ${Chalk.yellow(`${report.authPatterns.findings.length} finding(s)`)}`,\n      );\n      for (const finding of report.authPatterns.findings) {\n        const icon = finding.severity === 'error' ? Chalk.red('✗') : Chalk.yellow('!');\n        console.log(`   ${icon} ${finding.message}`);\n        if (finding.filePath) {\n          console.log(`     ${Chalk.dim('File:')} ${finding.filePath}`);\n        }\n      }\n    }\n  }\n\n  // AI Analysis\n  if (report.aiAnalysis) {\n    console.log('');\n    if (report.aiAnalysis.skipped) {\n      console.log('AI Analysis');\n      console.log(`   ${Chalk.dim(report.aiAnalysis.skipReason ?? 'Skipped')}`);\n    } else {\n      const duration = (report.aiAnalysis.durationMs / 1000).toFixed(1);\n      console.log(`AI Analysis ${Chalk.dim(`(${duration}s)`)}`);\n      if (report.aiAnalysis.summary) {\n        console.log(`   ${report.aiAnalysis.summary}`);\n      }\n      console.log('');\n      for (const finding of report.aiAnalysis.findings) {\n        const icon =\n          finding.severity === 'error'\n            ? Chalk.red('✗')\n            : finding.severity === 'warning'\n              ? Chalk.yellow('!')\n              : Chalk.dim('ℹ');\n        const color =\n          finding.severity === 'error' ? Chalk.red : finding.severity === 'warning' ? Chalk.yellow : Chalk.dim;\n        console.log(`   ${icon} ${color(finding.title)}`);\n        console.log(`     ${finding.detail}`);\n        if (finding.remediation) {\n          console.log(`     ${Chalk.dim('→')} ${finding.remediation}`);\n        }\n        if (finding.filePath) {\n          console.log(`     ${Chalk.dim('File:')} ${finding.filePath}`);\n        }\n        console.log('');\n      }\n    }\n  }\n\n  // Skills refresh (--fix path)\n  if (report.skillsRefresh) {\n    const agents = createAgents(homedir());\n    const displayName = (slug: string): string => agents[slug]?.displayName ?? slug;\n    const formatVersion = (v: string | null): string => v ?? '(none)';\n\n    console.log('');\n    console.log('Skills');\n    const slugs = Object.keys(report.skillsRefresh.before);\n    for (const slug of slugs) {\n      const before = formatVersion(report.skillsRefresh.before[slug] ?? null);\n      const after = formatVersion(report.skillsRefresh.after[slug] ?? null);\n      console.log(`   ${Chalk.green('✓')} Updated WorkOS skills for ${displayName(slug)}: ${before} → ${after}`);\n    }\n  }\n\n  // Verbose mode additions\n  if (options?.verbose) {\n    console.log('');\n    console.log(Chalk.dim('Verbose Details'));\n    console.log(`   ${Chalk.dim('Project path:')}  ${report.project.path}`);\n    console.log(`   ${Chalk.dim('Timestamp:')}     ${report.timestamp}`);\n    console.log(`   ${Chalk.dim('Doctor version:')} ${report.version}`);\n  }\n\n  console.log('');\n  console.log(Chalk.dim('━'.repeat(70)));\n\n  // Issues\n  if (report.issues.length > 0) {\n    const errors = report.issues.filter((i) => i.severity === 'error');\n    const warnings = report.issues.filter((i) => i.severity === 'warning');\n\n    console.log('');\n    if (errors.length > 0) {\n      console.log(Chalk.red(`Critical Issues Found (${errors.length} errors)`));\n      console.log('');\n      for (const issue of errors) {\n        formatIssue(issue);\n      }\n    }\n\n    if (warnings.length > 0) {\n      console.log(Chalk.yellow(`Warnings (${warnings.length})`));\n      console.log('');\n      for (const issue of warnings) {\n        formatIssue(issue);\n      }\n    }\n  }\n\n  console.log('');\n\n  // Summary box with lock character\n  const expression: LockExpression = report.summary.healthy\n    ? 'success'\n    : report.summary.errors > 0\n      ? 'error'\n      : 'warning';\n\n  const title = report.summary.healthy\n    ? 'WorkOS Integration Healthy'\n    : report.summary.errors > 0\n      ? `${report.summary.errors} Issue(s) Found`\n      : `${report.summary.warnings} Warning(s) to Review`;\n\n  const items: SummaryBoxItem[] = report.issues.map((issue) => ({\n    type: issue.severity === 'error' ? ('error' as const) : ('pending' as const),\n    text: `${issue.code}: ${issue.message}`,\n  }));\n\n  console.log(\n    renderSummaryBox({\n      expression,\n      title,\n      items,\n      footer: 'workos doctor --copy | https://workos.com/docs',\n    }),\n  );\n  console.log('');\n}\n\nexport function formatInteractionModeSource(source: InteractionModeSource): string {\n  switch (source) {\n    case 'flag':\n      return '--mode';\n    case 'env':\n      return 'WORKOS_MODE';\n    case 'workos_no_prompt':\n      return 'WORKOS_NO_PROMPT';\n    case 'ci_env':\n      return 'CI environment';\n    case 'agent_env':\n      return 'agent environment';\n    case 'non_tty':\n      return 'non-TTY';\n    case 'default':\n      return 'default';\n  }\n}\n\nfunction formatIssue(issue: Issue): void {\n  const icon = issue.severity === 'error' ? Chalk.red('✗') : Chalk.yellow('!');\n  const color = issue.severity === 'error' ? Chalk.red : Chalk.yellow;\n\n  console.log(`${icon} ${color(issue.code)}: ${issue.message}`);\n  if (issue.remediation) {\n    console.log(`   ${Chalk.dim('→')} ${issue.remediation}`);\n  }\n  if (issue.docsUrl) {\n    console.log(`   ${Chalk.dim('Docs:')} ${issue.docsUrl}`);\n  }\n  console.log('');\n}\n\nfunction formatMfa(mfa: string | null): string {\n  switch (mfa) {\n    case 'required':\n      return 'Required';\n    case 'optional':\n      return 'Optional';\n    case 'disabled':\n      return 'Disabled';\n    default:\n      return 'Not configured';\n  }\n}\n"]}

package/dist/doctor/types.d.ts

@@ -1,3 +1,4 @@
+import type { InteractionModeInfo } from '../utils/interaction-mode.js';
 export type IssueSeverity = 'error' | 'warning';
 export interface Issue {
     code: string;
@@ -57,6 +58,19 @@ export interface ConnectivityInfo {
     tlsValid: boolean;
     error?: string;
 }
+export interface HostExecutionFailure {
+    capability: string;
+    detail: string;
+    operation?: string;
+    target?: string;
+    label?: string;
+}
+export interface HostExecutionInfo {
+    mode: 'interactive' | 'non-interactive';
+    ok: boolean;
+    failures: HostExecutionFailure[];
+    warning?: string;
+}
 export interface DashboardSettings {
     redirectUris: string[];
     authMethods: string[];
@@ -117,6 +131,7 @@ export interface SkillsRefreshResult {
 export interface DoctorReport {
     version: string;
     timestamp: string;
+    interactionMode: InteractionModeInfo;
     project: {
         path: string;
         packageManager: string | null;
@@ -126,6 +141,7 @@ export interface DoctorReport {
     runtime: RuntimeInfo;
     framework: FrameworkInfo;
     environment: EnvironmentInfo;
+    hostExecution: HostExecutionInfo;
     connectivity: ConnectivityInfo;
     dashboardSettings?: DashboardSettings;
     dashboardError?: string;

package/dist/doctor/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/doctor/types.ts"],"names":[],"mappings":"","sourcesContent":["export type IssueSeverity = 'error' | 'warning';\n\nexport interface Issue {\n  code: string;\n  severity: IssueSeverity;\n  message: string;\n  details?: Record<string, unknown>;\n  remediation?: string;\n  docsUrl?: string;\n}\n\nexport interface SdkInfo {\n  name: string | null;\n  version: string | null;\n  latest: string | null;\n  outdated: boolean;\n  isAuthKit: boolean;\n  language: string; // 'javascript' | 'python' | 'ruby' | 'go' | 'java' | 'php' | 'dotnet'\n}\n\nexport interface LanguageInfo {\n  name: string; // e.g., 'JavaScript/TypeScript', 'Python', 'Ruby', 'Go', etc.\n  manifestFile?: string; // e.g., 'package.json', 'requirements.txt'\n  runtimeVersion?: string; // e.g., 'Python 3.12'\n  packageManager?: string; // e.g., 'pip', 'poetry', 'bundler'\n}\n\nexport interface FrameworkInfo {\n  name: string | null;\n  version: string | null;\n  variant?: string; // e.g., 'app-router' | 'pages-router'\n  expectedCallbackPath?: string; // e.g., '/auth/callback' for Next.js\n  detectedPort?: number;\n}\n\nexport interface RuntimeInfo {\n  nodeVersion: string;\n  packageManager: string | null;\n  packageManagerVersion: string | null;\n}\n\nexport interface EnvironmentInfo {\n  apiKeyConfigured: boolean;\n  apiKeyType: 'staging' | 'production' | null;\n  clientId: string | null; // truncated for display\n  redirectUri: string | null;\n  cookieDomain: string | null;\n  baseUrl: string | null;\n}\n\n/** Internal environment data - not included in report output */\nexport interface EnvironmentRaw {\n  apiKey: string | null;\n  clientId: string | null;\n  baseUrl: string | null;\n}\n\nexport interface EnvironmentCheckResult {\n  info: EnvironmentInfo;\n  raw: EnvironmentRaw;\n}\n\nexport interface ConnectivityInfo {\n  apiReachable: boolean;\n  latencyMs: number | null;\n  tlsValid: boolean;\n  error?: string;\n}\n\nexport interface DashboardSettings {\n  redirectUris: string[];\n  authMethods: string[];\n  sessionTimeout: string | null;\n  mfa: 'optional' | 'required' | 'disabled' | null;\n  organizationCount: number;\n}\n\nexport interface RedirectUriComparison {\n  codeUri: string | null;\n  dashboardUris: string[];\n  match: boolean;\n  source?: 'env' | 'inferred'; // Where the codeUri came from\n}\n\nexport interface CredentialValidation {\n  valid: boolean;\n  clientIdMatch: boolean;\n  error?: string;\n}\n\nexport interface DashboardFetchResult {\n  settings: DashboardSettings | null;\n  credentialValidation?: CredentialValidation;\n  error?: string;\n}\n\nexport interface AuthPatternFinding {\n  code: string;\n  severity: IssueSeverity;\n  message: string;\n  filePath?: string;\n  remediation?: string;\n  docsUrl?: string;\n}\n\nexport interface AuthPatternInfo {\n  checksRun: number;\n  findings: AuthPatternFinding[];\n}\n\nexport interface SkillAgentStatus {\n  agent: string;\n  installedVersion: string | null;\n  stale: boolean;\n}\n\nexport interface SkillsInfo {\n  bundledVersion: string | null;\n  agents: SkillAgentStatus[];\n}\n\n/**\n * Result of `workos doctor --fix` refreshing WorkOS skills. Captured per agent\n * so the human-mode renderer can show a before/after line and the JSON consumer\n * can reason about which agents changed.\n */\nexport interface SkillsRefreshResult {\n  /** Marker version per agent.name BEFORE refresh (null = no marker). */\n  before: Record<string, string | null>;\n  /** Marker version per agent.name AFTER refresh. */\n  after: Record<string, string | null>;\n  /** Skills the refresh was scoped to (the FIXABLE_SKILLS allowlist). */\n  skillsInstalled: string[];\n}\n\nexport interface DoctorReport {\n  version: string;\n  timestamp: string;\n  project: {\n    path: string;\n    packageManager: string | null;\n  };\n  sdk: SdkInfo;\n  language: LanguageInfo;\n  runtime: RuntimeInfo;\n  framework: FrameworkInfo;\n  environment: EnvironmentInfo;\n  connectivity: ConnectivityInfo;\n  dashboardSettings?: DashboardSettings;\n  dashboardError?: string;\n  redirectUris?: RedirectUriComparison;\n  credentialValidation?: CredentialValidation;\n  authPatterns?: AuthPatternInfo;\n  aiAnalysis?: AiAnalysis;\n  skills?: SkillsInfo;\n  /** Present only when `--fix` actually performed a refresh. */\n  skillsRefresh?: SkillsRefreshResult;\n  issues: Issue[];\n  summary: {\n    errors: number;\n    warnings: number;\n    healthy: boolean;\n  };\n}\n\nexport interface AiFinding {\n  severity: 'error' | 'warning' | 'info';\n  title: string;\n  detail: string;\n  remediation: string;\n  filePath?: string;\n}\n\nexport interface AiAnalysis {\n  findings: AiFinding[];\n  summary: string;\n  model: string;\n  durationMs: number;\n  skipped?: boolean;\n  skipReason?: string;\n}\n\nexport interface DoctorOptions {\n  installDir: string;\n  verbose?: boolean;\n  skipApi?: boolean;\n  skipAi?: boolean;\n  json?: boolean;\n  copy?: boolean;\n  /** When true, refresh stale WorkOS skills (constrained to workos/ + workos-widgets/). */\n  fix?: boolean;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/doctor/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { InteractionModeInfo } from '../utils/interaction-mode.js';\n\nexport type IssueSeverity = 'error' | 'warning';\n\nexport interface Issue {\n  code: string;\n  severity: IssueSeverity;\n  message: string;\n  details?: Record<string, unknown>;\n  remediation?: string;\n  docsUrl?: string;\n}\n\nexport interface SdkInfo {\n  name: string | null;\n  version: string | null;\n  latest: string | null;\n  outdated: boolean;\n  isAuthKit: boolean;\n  language: string; // 'javascript' | 'python' | 'ruby' | 'go' | 'java' | 'php' | 'dotnet'\n}\n\nexport interface LanguageInfo {\n  name: string; // e.g., 'JavaScript/TypeScript', 'Python', 'Ruby', 'Go', etc.\n  manifestFile?: string; // e.g., 'package.json', 'requirements.txt'\n  runtimeVersion?: string; // e.g., 'Python 3.12'\n  packageManager?: string; // e.g., 'pip', 'poetry', 'bundler'\n}\n\nexport interface FrameworkInfo {\n  name: string | null;\n  version: string | null;\n  variant?: string; // e.g., 'app-router' | 'pages-router'\n  expectedCallbackPath?: string; // e.g., '/auth/callback' for Next.js\n  detectedPort?: number;\n}\n\nexport interface RuntimeInfo {\n  nodeVersion: string;\n  packageManager: string | null;\n  packageManagerVersion: string | null;\n}\n\nexport interface EnvironmentInfo {\n  apiKeyConfigured: boolean;\n  apiKeyType: 'staging' | 'production' | null;\n  clientId: string | null; // truncated for display\n  redirectUri: string | null;\n  cookieDomain: string | null;\n  baseUrl: string | null;\n}\n\n/** Internal environment data - not included in report output */\nexport interface EnvironmentRaw {\n  apiKey: string | null;\n  clientId: string | null;\n  baseUrl: string | null;\n}\n\nexport interface EnvironmentCheckResult {\n  info: EnvironmentInfo;\n  raw: EnvironmentRaw;\n}\n\nexport interface ConnectivityInfo {\n  apiReachable: boolean;\n  latencyMs: number | null;\n  tlsValid: boolean;\n  error?: string;\n}\n\nexport interface HostExecutionFailure {\n  capability: string;\n  detail: string;\n  operation?: string;\n  target?: string;\n  label?: string;\n}\n\nexport interface HostExecutionInfo {\n  mode: 'interactive' | 'non-interactive';\n  ok: boolean;\n  failures: HostExecutionFailure[];\n  warning?: string;\n}\n\nexport interface DashboardSettings {\n  redirectUris: string[];\n  authMethods: string[];\n  sessionTimeout: string | null;\n  mfa: 'optional' | 'required' | 'disabled' | null;\n  organizationCount: number;\n}\n\nexport interface RedirectUriComparison {\n  codeUri: string | null;\n  dashboardUris: string[];\n  match: boolean;\n  source?: 'env' | 'inferred'; // Where the codeUri came from\n}\n\nexport interface CredentialValidation {\n  valid: boolean;\n  clientIdMatch: boolean;\n  error?: string;\n}\n\nexport interface DashboardFetchResult {\n  settings: DashboardSettings | null;\n  credentialValidation?: CredentialValidation;\n  error?: string;\n}\n\nexport interface AuthPatternFinding {\n  code: string;\n  severity: IssueSeverity;\n  message: string;\n  filePath?: string;\n  remediation?: string;\n  docsUrl?: string;\n}\n\nexport interface AuthPatternInfo {\n  checksRun: number;\n  findings: AuthPatternFinding[];\n}\n\nexport interface SkillAgentStatus {\n  agent: string;\n  installedVersion: string | null;\n  stale: boolean;\n}\n\nexport interface SkillsInfo {\n  bundledVersion: string | null;\n  agents: SkillAgentStatus[];\n}\n\n/**\n * Result of `workos doctor --fix` refreshing WorkOS skills. Captured per agent\n * so the human-mode renderer can show a before/after line and the JSON consumer\n * can reason about which agents changed.\n */\nexport interface SkillsRefreshResult {\n  /** Marker version per agent.name BEFORE refresh (null = no marker). */\n  before: Record<string, string | null>;\n  /** Marker version per agent.name AFTER refresh. */\n  after: Record<string, string | null>;\n  /** Skills the refresh was scoped to (the FIXABLE_SKILLS allowlist). */\n  skillsInstalled: string[];\n}\n\nexport interface DoctorReport {\n  version: string;\n  timestamp: string;\n  interactionMode: InteractionModeInfo;\n  project: {\n    path: string;\n    packageManager: string | null;\n  };\n  sdk: SdkInfo;\n  language: LanguageInfo;\n  runtime: RuntimeInfo;\n  framework: FrameworkInfo;\n  environment: EnvironmentInfo;\n  hostExecution: HostExecutionInfo;\n  connectivity: ConnectivityInfo;\n  dashboardSettings?: DashboardSettings;\n  dashboardError?: string;\n  redirectUris?: RedirectUriComparison;\n  credentialValidation?: CredentialValidation;\n  authPatterns?: AuthPatternInfo;\n  aiAnalysis?: AiAnalysis;\n  skills?: SkillsInfo;\n  /** Present only when `--fix` actually performed a refresh. */\n  skillsRefresh?: SkillsRefreshResult;\n  issues: Issue[];\n  summary: {\n    errors: number;\n    warnings: number;\n    healthy: boolean;\n  };\n}\n\nexport interface AiFinding {\n  severity: 'error' | 'warning' | 'info';\n  title: string;\n  detail: string;\n  remediation: string;\n  filePath?: string;\n}\n\nexport interface AiAnalysis {\n  findings: AiFinding[];\n  summary: string;\n  model: string;\n  durationMs: number;\n  skipped?: boolean;\n  skipReason?: string;\n}\n\nexport interface DoctorOptions {\n  installDir: string;\n  verbose?: boolean;\n  skipApi?: boolean;\n  skipAi?: boolean;\n  json?: boolean;\n  copy?: boolean;\n  /** When true, refresh stale WorkOS skills (constrained to workos/ + workos-widgets/). */\n  fix?: boolean;\n}\n"]}

package/dist/lib/config-store.js

@@ -13,6 +13,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { logWarn } from '../utils/debug.js';
+import { observeHostFailure } from './host-probe.js';
 /**
  * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.
  */
@@ -40,27 +41,55 @@ function fileExists() {
 function readFromFile() {
     if (!fileExists())
         return null;
+    const filePath = getConfigFilePath();
     try {
-        const content = fs.readFileSync(getConfigFilePath(), 'utf-8');
+        const content = fs.readFileSync(filePath, 'utf-8');
         return JSON.parse(content);
     }
     catch (error) {
+        observeHostFailure('home-fs', error, {
+            operation: 'read',
+            target: filePath,
+            label: 'config fallback file',
+        });
         logWarn('Failed to read config file:', error);
         return null;
     }
 }
 function writeToFile(config) {
     const dir = getConfigDir();
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const filePath = getConfigFilePath();
+    try {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        }
+        fs.writeFileSync(filePath, JSON.stringify(config, null, 2), {
+            mode: 0o600,
+        });
+    }
+    catch (error) {
+        observeHostFailure('home-fs', error, {
+            operation: 'write',
+            target: filePath,
+            label: 'config fallback file',
+        });
+        throw error;
     }
-    fs.writeFileSync(getConfigFilePath(), JSON.stringify(config, null, 2), {
-        mode: 0o600,
-    });
 }
 function deleteFile() {
+    const filePath = getConfigFilePath();
     if (fileExists()) {
-        fs.unlinkSync(getConfigFilePath());
+        try {
+            fs.unlinkSync(filePath);
+        }
+        catch (error) {
+            observeHostFailure('home-fs', error, {
+                operation: 'delete',
+                target: filePath,
+                label: 'config fallback file',
+            });
+            throw error;
+        }
     }
 }
 function getKeyringEntry() {
@@ -76,6 +105,11 @@ function readFromKeyring() {
     }
     catch (error) {
         logWarn('Failed to read config from keyring:', error);
+        observeHostFailure('keychain', error, {
+            operation: 'read',
+            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
+            label: 'config keychain entry',
+        });
         return null;
     }
 }
@@ -87,6 +121,11 @@ function writeToKeyring(config) {
     }
     catch (error) {
         logWarn('Failed to write config to keyring:', error);
+        observeHostFailure('keychain', error, {
+            operation: 'write',
+            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
+            label: 'config keychain entry',
+        });
         return false;
     }
 }
@@ -99,6 +138,11 @@ function deleteFromKeyring() {
         const msg = error instanceof Error ? error.message : String(error);
         if (!msg.includes('not found') && !msg.includes('No such')) {
             logWarn('Failed to delete config from keyring:', error);
+            observeHostFailure('keychain', error, {
+                operation: 'delete',
+                target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
+                label: 'config keychain entry',
+            });
         }
     }
 }

package/dist/lib/config-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/lib/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAqB5C;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,OAAO,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;AAClC,CAAC;AAOD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACrE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,+DAA+D,EAC/D,uCAAuC,EACvC,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC;IACxC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,qEAAqE,CAAC,CAAC;QAC/E,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpC,0DAA0D;QAC1D,IAAI,MAAM,GAAG,SAAS,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,MAAM,CAAC,CAAC,kDAAkD;QACrE,CAAC;QAED,MAAM,OAAO,GAA6B;YACxC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;SAChD,CAAC;QAEF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAElC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["/**\n * CLI config storage abstraction with keyring support and file fallback.\n *\n * Stores environment configurations (names, API keys, endpoints) separately\n * from OAuth credentials. Uses a second keyring entry under the same service.\n *\n * Storage priority:\n * 1. If insecure storage forced: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\n\ninterface BaseEnvironmentConfig {\n  name: string;\n  apiKey: string;\n  endpoint?: string;\n}\n\nexport interface ClaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'production' | 'sandbox';\n  clientId?: string;\n}\n\nexport interface UnclaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'unclaimed';\n  clientId: string;\n  claimToken: string;\n}\n\nexport type EnvironmentConfig = ClaimedEnvironmentConfig | UnclaimedEnvironmentConfig;\n\n/**\n * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.\n */\nexport function isUnclaimedEnvironment(env: EnvironmentConfig): env is UnclaimedEnvironmentConfig {\n  return env.type === 'unclaimed';\n}\n\nexport interface CliConfig {\n  activeEnvironment?: string;\n  environments: Record<string, EnvironmentConfig>;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'config';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureConfigStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getConfigDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getConfigFilePath(): string {\n  return path.join(getConfigDir(), 'config.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getConfigFilePath());\n}\n\nfunction readFromFile(): CliConfig | null {\n  if (!fileExists()) return null;\n  try {\n    const content = fs.readFileSync(getConfigFilePath(), 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    logWarn('Failed to read config file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(config: CliConfig): void {\n  const dir = getConfigDir();\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n  fs.writeFileSync(getConfigFilePath(), JSON.stringify(config, null, 2), {\n    mode: 0o600,\n  });\n}\n\nfunction deleteFile(): void {\n  if (fileExists()) {\n    fs.unlinkSync(getConfigFilePath());\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): CliConfig | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) return null;\n    return JSON.parse(data);\n  } catch (error) {\n    logWarn('Failed to read config from keyring:', error);\n    return null;\n  }\n}\n\nfunction writeToKeyring(config: CliConfig): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(config));\n    return true;\n  } catch (error) {\n    logWarn('Failed to write config to keyring:', error);\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete config from keyring:', error);\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store config in system keyring. Using file storage.',\n    'Config saved to ~/.workos/config.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function getConfig(): CliConfig | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringConfig = readFromKeyring();\n  if (keyringConfig) return keyringConfig;\n\n  const fileConfig = readFromFile();\n  if (fileConfig) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileConfig);\n    }\n    return fileConfig;\n  }\n\n  return null;\n}\n\nexport function saveConfig(config: CliConfig): void {\n  if (forceInsecureStorage) return writeToFile(config);\n\n  if (!writeToKeyring(config)) {\n    showFallbackWarning();\n    writeToFile(config);\n    return;\n  }\n\n  // Verify the keyring write is readable (guards against silent keyring failures\n  // where setPassword succeeds but getPassword returns null in the same process)\n  if (!readFromKeyring()) {\n    logWarn('Keyring write succeeded but read-back failed — falling back to file');\n    writeToFile(config);\n  }\n}\n\nexport function clearConfig(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function getActiveEnvironment(): EnvironmentConfig | null {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return null;\n  return config.environments[config.activeEnvironment] ?? null;\n}\n\nexport function getConfigPath(): string {\n  return getConfigFilePath();\n}\n\n/**\n * Diagnostic info about config storage state — for debugging config persistence failures.\n */\nexport function diagnoseConfig(): string[] {\n  const lines: string[] = [];\n  const filePath = getConfigFilePath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`file config: active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } catch (e) {\n      lines.push(`file config: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`keyring: found, active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\n/**\n * Mark the active unclaimed environment as claimed.\n * Updates type to 'sandbox', removes the claim token, and renames\n * the environment key from 'unclaimed' to 'sandbox'.\n */\nexport function markEnvironmentClaimed(): void {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return;\n  const oldKey = config.activeEnvironment;\n  const env = config.environments[oldKey];\n  if (env && env.type === 'unclaimed') {\n    // Pick a key that won't overwrite an existing environment\n    let newKey = 'sandbox';\n    if (oldKey !== newKey && config.environments[newKey]) {\n      newKey = oldKey; // keep existing key if 'sandbox' is already taken\n    }\n\n    const claimed: ClaimedEnvironmentConfig = {\n      name: newKey,\n      type: 'sandbox',\n      apiKey: env.apiKey,\n      clientId: env.clientId,\n      ...(env.endpoint && { endpoint: env.endpoint }),\n    };\n\n    if (oldKey !== newKey) {\n      delete config.environments[oldKey];\n    }\n    config.environments[newKey] = claimed;\n    config.activeEnvironment = newKey;\n\n    saveConfig(config);\n  }\n}\n"]}
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/lib/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAqBrD;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,OAAO,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;AAClC,CAAC;AAOD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC1D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;gBACnC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,sBAAsB;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACtD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACrD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YACxD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;gBACpC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;gBACzC,KAAK,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,+DAA+D,EAC/D,uCAAuC,EACvC,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC;IACxC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,qEAAqE,CAAC,CAAC;QAC/E,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpC,0DAA0D;QAC1D,IAAI,MAAM,GAAG,SAAS,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,MAAM,CAAC,CAAC,kDAAkD;QACrE,CAAC;QAED,MAAM,OAAO,GAA6B;YACxC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;SAChD,CAAC;QAEF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAElC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["/**\n * CLI config storage abstraction with keyring support and file fallback.\n *\n * Stores environment configurations (names, API keys, endpoints) separately\n * from OAuth credentials. Uses a second keyring entry under the same service.\n *\n * Storage priority:\n * 1. If insecure storage forced: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\nimport { observeHostFailure } from './host-probe.js';\n\ninterface BaseEnvironmentConfig {\n  name: string;\n  apiKey: string;\n  endpoint?: string;\n}\n\nexport interface ClaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'production' | 'sandbox';\n  clientId?: string;\n}\n\nexport interface UnclaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'unclaimed';\n  clientId: string;\n  claimToken: string;\n}\n\nexport type EnvironmentConfig = ClaimedEnvironmentConfig | UnclaimedEnvironmentConfig;\n\n/**\n * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.\n */\nexport function isUnclaimedEnvironment(env: EnvironmentConfig): env is UnclaimedEnvironmentConfig {\n  return env.type === 'unclaimed';\n}\n\nexport interface CliConfig {\n  activeEnvironment?: string;\n  environments: Record<string, EnvironmentConfig>;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'config';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureConfigStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getConfigDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getConfigFilePath(): string {\n  return path.join(getConfigDir(), 'config.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getConfigFilePath());\n}\n\nfunction readFromFile(): CliConfig | null {\n  if (!fileExists()) return null;\n  const filePath = getConfigFilePath();\n  try {\n    const content = fs.readFileSync(filePath, 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'read',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    logWarn('Failed to read config file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(config: CliConfig): void {\n  const dir = getConfigDir();\n  const filePath = getConfigFilePath();\n  try {\n    if (!fs.existsSync(dir)) {\n      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    fs.writeFileSync(filePath, JSON.stringify(config, null, 2), {\n      mode: 0o600,\n    });\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'write',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    throw error;\n  }\n}\n\nfunction deleteFile(): void {\n  const filePath = getConfigFilePath();\n  if (fileExists()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch (error) {\n      observeHostFailure('home-fs', error, {\n        operation: 'delete',\n        target: filePath,\n        label: 'config fallback file',\n      });\n      throw error;\n    }\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): CliConfig | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) return null;\n    return JSON.parse(data);\n  } catch (error) {\n    logWarn('Failed to read config from keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'read',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return null;\n  }\n}\n\nfunction writeToKeyring(config: CliConfig): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(config));\n    return true;\n  } catch (error) {\n    logWarn('Failed to write config to keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'write',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete config from keyring:', error);\n      observeHostFailure('keychain', error, {\n        operation: 'delete',\n        target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n        label: 'config keychain entry',\n      });\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store config in system keyring. Using file storage.',\n    'Config saved to ~/.workos/config.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function getConfig(): CliConfig | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringConfig = readFromKeyring();\n  if (keyringConfig) return keyringConfig;\n\n  const fileConfig = readFromFile();\n  if (fileConfig) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileConfig);\n    }\n    return fileConfig;\n  }\n\n  return null;\n}\n\nexport function saveConfig(config: CliConfig): void {\n  if (forceInsecureStorage) return writeToFile(config);\n\n  if (!writeToKeyring(config)) {\n    showFallbackWarning();\n    writeToFile(config);\n    return;\n  }\n\n  // Verify the keyring write is readable (guards against silent keyring failures\n  // where setPassword succeeds but getPassword returns null in the same process)\n  if (!readFromKeyring()) {\n    logWarn('Keyring write succeeded but read-back failed — falling back to file');\n    writeToFile(config);\n  }\n}\n\nexport function clearConfig(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function getActiveEnvironment(): EnvironmentConfig | null {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return null;\n  return config.environments[config.activeEnvironment] ?? null;\n}\n\nexport function getConfigPath(): string {\n  return getConfigFilePath();\n}\n\n/**\n * Diagnostic info about config storage state — for debugging config persistence failures.\n */\nexport function diagnoseConfig(): string[] {\n  const lines: string[] = [];\n  const filePath = getConfigFilePath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`file config: active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } catch (e) {\n      lines.push(`file config: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`keyring: found, active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\n/**\n * Mark the active unclaimed environment as claimed.\n * Updates type to 'sandbox', removes the claim token, and renames\n * the environment key from 'unclaimed' to 'sandbox'.\n */\nexport function markEnvironmentClaimed(): void {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return;\n  const oldKey = config.activeEnvironment;\n  const env = config.environments[oldKey];\n  if (env && env.type === 'unclaimed') {\n    // Pick a key that won't overwrite an existing environment\n    let newKey = 'sandbox';\n    if (oldKey !== newKey && config.environments[newKey]) {\n      newKey = oldKey; // keep existing key if 'sandbox' is already taken\n    }\n\n    const claimed: ClaimedEnvironmentConfig = {\n      name: newKey,\n      type: 'sandbox',\n      apiKey: env.apiKey,\n      clientId: env.clientId,\n      ...(env.endpoint && { endpoint: env.endpoint }),\n    };\n\n    if (oldKey !== newKey) {\n      delete config.environments[oldKey];\n    }\n    config.environments[newKey] = claimed;\n    config.activeEnvironment = newKey;\n\n    saveConfig(config);\n  }\n}\n"]}

package/dist/lib/credential-proxy.js

@@ -10,6 +10,7 @@ import { getCredentials, updateTokens } from './credentials.js';
 import { analytics } from '../utils/analytics.js';
 import { refreshAccessToken } from './token-refresh-client.js';
 import { formatWorkOSCommand } from '../utils/command-invocation.js';
+import { observeHostFailure } from './host-probe.js';
 // Hop-by-hop headers that must not be forwarded by proxies (RFC 7230 §6.1)
 const HOP_BY_HOP_HEADERS = new Set([
     'connection',
@@ -161,6 +162,11 @@ export async function startCredentialProxy(options) {
                     tryListen(0); // Try random port
                 }
                 else {
+                    observeHostFailure('localhost-bind', err, {
+                        operation: 'listen',
+                        target: `127.0.0.1:${p}`,
+                        label: 'credential proxy',
+                    });
                     reject(err);
                 }
             });
@@ -310,7 +316,14 @@ export async function startClaimTokenProxy(options) {
         req.pipe(proxyReq);
     });
     const port = await new Promise((resolve, reject) => {
-        server.once('error', (err) => reject(err));
+        server.once('error', (err) => {
+            observeHostFailure('localhost-bind', err, {
+                operation: 'listen',
+                target: '127.0.0.1:0',
+                label: 'claim token proxy',
+            });
+            reject(err);
+        });
         server.listen(0, '127.0.0.1', () => {
             const addr = server.address();
             if (addr && typeof addr === 'object')