workos 0.15.1 → 0.16.0

package/dist/lib/constants.d.ts

@@ -26,7 +26,6 @@ export declare const WORKOS_DASHBOARD_URL: string;
 export declare const ISSUES_URL: string;
 export declare const ANALYTICS_ENABLED: boolean;
 export declare const INSTALLER_INTERACTION_EVENT_NAME: string;
-export declare const WORKOS_TELEMETRY_ENABLED: boolean;
 export declare const OAUTH_PORT: number;
 /**
  * Common glob patterns to ignore when searching for files.

package/dist/lib/constants.js

@@ -18,7 +18,6 @@ export const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;
 export const ISSUES_URL = settings.documentation.issuesUrl;
 export const ANALYTICS_ENABLED = settings.telemetry.enabled;
 export const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;
-export const WORKOS_TELEMETRY_ENABLED = process.env.WORKOS_TELEMETRY !== 'false';
 export const OAUTH_PORT = settings.legacy.oauthPort;
 /**
  * Common glob patterns to ignore when searching for files.

package/dist/lib/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAS1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;CACf,CAAC;AAOX,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,aAAa,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,OAAO,CAAC;AACjF,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,cAAc;IACd,aAAa;CACd,CAAC","sourcesContent":["import { getConfig } from './settings.js';\n\n/**\n * Integration identifier type.\n * No longer an enum — each integration self-registers via the auto-discovery registry.\n * The string value matches the integration directory name (e.g., 'nextjs', 'react-router').\n */\nexport type Integration = string;\n\n/**\n * Well-known integration names for backwards compatibility.\n * New integrations do NOT need to be added here — they're auto-discovered.\n */\nexport const KNOWN_INTEGRATIONS = {\n  nextjs: 'nextjs',\n  react: 'react',\n  tanstackStart: 'tanstack-start',\n  reactRouter: 'react-router',\n  vanillaJs: 'vanilla-js',\n} as const;\n\nexport interface Args {\n  debug: boolean;\n  integration: Integration;\n}\n\nexport const IS_DEV = ['test', 'development'].includes(process.env.NODE_ENV ?? '');\n\nconst settings = getConfig();\n\nexport const DEBUG = settings.logging.debugMode;\nexport const WORKOS_DOCS_URL = settings.documentation.workosDocsUrl;\nexport const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;\nexport const ISSUES_URL = settings.documentation.issuesUrl;\nexport const ANALYTICS_ENABLED = settings.telemetry.enabled;\nexport const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;\nexport const WORKOS_TELEMETRY_ENABLED = process.env.WORKOS_TELEMETRY !== 'false';\nexport const OAUTH_PORT = settings.legacy.oauthPort;\n\n/**\n * Common glob patterns to ignore when searching for files.\n * Used by multiple integrations.\n */\nexport const IGNORE_PATTERNS: string[] = [\n  '**/node_modules/**',\n  '**/dist/**',\n  '**/build/**',\n  '**/public/**',\n  '**/.next/**',\n];\n"]}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAS1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;CACf,CAAC;AAOX,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,aAAa,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,cAAc;IACd,aAAa;CACd,CAAC","sourcesContent":["import { getConfig } from './settings.js';\n\n/**\n * Integration identifier type.\n * No longer an enum — each integration self-registers via the auto-discovery registry.\n * The string value matches the integration directory name (e.g., 'nextjs', 'react-router').\n */\nexport type Integration = string;\n\n/**\n * Well-known integration names for backwards compatibility.\n * New integrations do NOT need to be added here — they're auto-discovered.\n */\nexport const KNOWN_INTEGRATIONS = {\n  nextjs: 'nextjs',\n  react: 'react',\n  tanstackStart: 'tanstack-start',\n  reactRouter: 'react-router',\n  vanillaJs: 'vanilla-js',\n} as const;\n\nexport interface Args {\n  debug: boolean;\n  integration: Integration;\n}\n\nexport const IS_DEV = ['test', 'development'].includes(process.env.NODE_ENV ?? '');\n\nconst settings = getConfig();\n\nexport const DEBUG = settings.logging.debugMode;\nexport const WORKOS_DOCS_URL = settings.documentation.workosDocsUrl;\nexport const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;\nexport const ISSUES_URL = settings.documentation.issuesUrl;\nexport const ANALYTICS_ENABLED = settings.telemetry.enabled;\nexport const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;\nexport const OAUTH_PORT = settings.legacy.oauthPort;\n\n/**\n * Common glob patterns to ignore when searching for files.\n * Used by multiple integrations.\n */\nexport const IGNORE_PATTERNS: string[] = [\n  '**/node_modules/**',\n  '**/dist/**',\n  '**/build/**',\n  '**/public/**',\n  '**/.next/**',\n];\n"]}

package/dist/lib/credential-discovery.js

@@ -35,7 +35,7 @@ export async function checkForEnvFiles(projectDir) {
 export async function scanEnvFile(filePath) {
     const content = await fs.readFile(filePath, 'utf-8');
     // Filter out commented lines before matching
-    const lines = content.split('\n');
+    const lines = content.split(/\r?\n/);
     const uncommentedContent = lines.filter((line) => !line.trim().startsWith('#')).join('\n');
     const clientIdMatch = uncommentedContent.match(WORKOS_CLIENT_ID_PATTERN);
     const apiKeyMatch = uncommentedContent.match(WORKOS_API_KEY_PATTERN);

package/dist/lib/credential-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-discovery.js","sourceRoot":"","sources":["../../src/lib/credential-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAe5C,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;AAE5F,yDAAyD;AACzD,MAAM,wBAAwB,GAAG,0CAA0C,CAAC;AAC5E,MAAM,sBAAsB,GAAG,wCAAwC,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,OAAO,CAAC,mDAAmD,EAAE,UAAU,CAAC,CAAC;IACzE,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,OAAO,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;IAC/D,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7B,KAAK,EAAE,UAAU;KAClB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAErD,6CAA6C;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3F,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAErE,OAAO;QACL,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,OAAO,CAAC,kEAAkE,CAAC,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;YAE3C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAElE,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBACtC,OAAO,CAAC,mDAAmD,EAAE,QAAQ,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,CAAC,mDAAmD,EAAE,QAAQ,CAAC,CAAC;gBACvE,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC/C,UAAU,EAAE,QAAQ;iBACrB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { logInfo } from '../utils/debug.js';\n\nexport interface DiscoveryResult {\n  found: boolean;\n  source?: 'env' | 'declined';\n  clientId?: string;\n  apiKey?: string;\n  sourcePath?: string;\n}\n\nexport interface EnvFileInfo {\n  exists: boolean;\n  files: string[];\n}\n\nconst ENV_FILE_NAMES = ['.env.local', '.env.development.local', '.env.development', '.env'];\n\n// Only extract WorkOS variables - ignore everything else\nconst WORKOS_CLIENT_ID_PATTERN = /^WORKOS_CLIENT_ID=[\"']?([^\"'\\s#]+)[\"']?/m;\nconst WORKOS_API_KEY_PATTERN = /^WORKOS_API_KEY=[\"']?([^\"'\\s#]+)[\"']?/m;\n\n/**\n * Check if env files exist in the project directory (without reading contents).\n * Returns which files were found so the UI can prompt for consent.\n */\nexport async function checkForEnvFiles(projectDir: string): Promise<EnvFileInfo> {\n  logInfo('[credential-discovery] Checking for env files in:', projectDir);\n  const foundFiles: string[] = [];\n\n  for (const fileName of ENV_FILE_NAMES) {\n    const filePath = path.join(projectDir, fileName);\n    try {\n      await fs.access(filePath, fs.constants.R_OK);\n      foundFiles.push(fileName);\n    } catch {\n      // continue\n    }\n  }\n\n  logInfo('[credential-discovery] Found env files:', foundFiles);\n  return {\n    exists: foundFiles.length > 0,\n    files: foundFiles,\n  };\n}\n\n/**\n * Scan a single env file for WorkOS credentials.\n * Only extracts WORKOS_CLIENT_ID and WORKOS_API_KEY - ignores all other variables.\n */\nexport async function scanEnvFile(filePath: string): Promise<{ clientId?: string; apiKey?: string }> {\n  const content = await fs.readFile(filePath, 'utf-8');\n\n  // Filter out commented lines before matching\n  const lines = content.split('\\n');\n  const uncommentedContent = lines.filter((line) => !line.trim().startsWith('#')).join('\\n');\n\n  const clientIdMatch = uncommentedContent.match(WORKOS_CLIENT_ID_PATTERN);\n  const apiKeyMatch = uncommentedContent.match(WORKOS_API_KEY_PATTERN);\n\n  return {\n    clientId: clientIdMatch?.[1],\n    apiKey: apiKeyMatch?.[1],\n  };\n}\n\n/**\n * Validate client ID format.\n * WorkOS client IDs start with 'client_' prefix.\n */\nexport function isValidClientId(value: string): boolean {\n  return value.startsWith('client_') && value.length > 10;\n}\n\n/**\n * Validate API key format.\n * WorkOS secret keys start with 'sk_' prefix.\n */\nexport function isValidApiKey(value: string): boolean {\n  return value.startsWith('sk_') && value.length > 10;\n}\n\n/**\n * Discover WorkOS credentials from project env files.\n * Must be called AFTER user consent is given.\n *\n * Scans files in priority order: .env.local > .env.development.local > .env.development > .env\n * Returns first complete match (both clientId and apiKey preferred, but clientId-only is valid).\n */\nexport async function discoverCredentials(projectDir: string): Promise<DiscoveryResult> {\n  logInfo('[credential-discovery] Scanning env files for WorkOS credentials');\n  for (const fileName of ENV_FILE_NAMES) {\n    const filePath = path.join(projectDir, fileName);\n\n    try {\n      const result = await scanEnvFile(filePath);\n\n      const clientIdValid = result.clientId && isValidClientId(result.clientId);\n      const apiKeyValid = result.apiKey && isValidApiKey(result.apiKey);\n\n      if (result.clientId && !clientIdValid) {\n        logInfo('[credential-discovery] Invalid clientId format in', fileName);\n      }\n      if (result.apiKey && !apiKeyValid) {\n        logInfo('[credential-discovery] Invalid apiKey format in', fileName);\n      }\n\n      if (clientIdValid) {\n        logInfo('[credential-discovery] Found valid credentials in', fileName);\n        return {\n          found: true,\n          source: 'env',\n          clientId: result.clientId,\n          apiKey: apiKeyValid ? result.apiKey : undefined,\n          sourcePath: fileName,\n        };\n      }\n    } catch {\n      // continue\n    }\n  }\n\n  logInfo('[credential-discovery] No valid credentials found');\n  return { found: false };\n}\n"]}
+{"version":3,"file":"credential-discovery.js","sourceRoot":"","sources":["../../src/lib/credential-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAe5C,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;AAE5F,yDAAyD;AACzD,MAAM,wBAAwB,GAAG,0CAA0C,CAAC;AAC5E,MAAM,sBAAsB,GAAG,wCAAwC,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,OAAO,CAAC,mDAAmD,EAAE,UAAU,CAAC,CAAC;IACzE,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,OAAO,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;IAC/D,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7B,KAAK,EAAE,UAAU;KAClB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAErD,6CAA6C;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3F,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAErE,OAAO;QACL,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,OAAO,CAAC,kEAAkE,CAAC,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;YAE3C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAElE,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBACtC,OAAO,CAAC,mDAAmD,EAAE,QAAQ,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,CAAC,mDAAmD,EAAE,QAAQ,CAAC,CAAC;gBACvE,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC/C,UAAU,EAAE,QAAQ;iBACrB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { logInfo } from '../utils/debug.js';\n\nexport interface DiscoveryResult {\n  found: boolean;\n  source?: 'env' | 'declined';\n  clientId?: string;\n  apiKey?: string;\n  sourcePath?: string;\n}\n\nexport interface EnvFileInfo {\n  exists: boolean;\n  files: string[];\n}\n\nconst ENV_FILE_NAMES = ['.env.local', '.env.development.local', '.env.development', '.env'];\n\n// Only extract WorkOS variables - ignore everything else\nconst WORKOS_CLIENT_ID_PATTERN = /^WORKOS_CLIENT_ID=[\"']?([^\"'\\s#]+)[\"']?/m;\nconst WORKOS_API_KEY_PATTERN = /^WORKOS_API_KEY=[\"']?([^\"'\\s#]+)[\"']?/m;\n\n/**\n * Check if env files exist in the project directory (without reading contents).\n * Returns which files were found so the UI can prompt for consent.\n */\nexport async function checkForEnvFiles(projectDir: string): Promise<EnvFileInfo> {\n  logInfo('[credential-discovery] Checking for env files in:', projectDir);\n  const foundFiles: string[] = [];\n\n  for (const fileName of ENV_FILE_NAMES) {\n    const filePath = path.join(projectDir, fileName);\n    try {\n      await fs.access(filePath, fs.constants.R_OK);\n      foundFiles.push(fileName);\n    } catch {\n      // continue\n    }\n  }\n\n  logInfo('[credential-discovery] Found env files:', foundFiles);\n  return {\n    exists: foundFiles.length > 0,\n    files: foundFiles,\n  };\n}\n\n/**\n * Scan a single env file for WorkOS credentials.\n * Only extracts WORKOS_CLIENT_ID and WORKOS_API_KEY - ignores all other variables.\n */\nexport async function scanEnvFile(filePath: string): Promise<{ clientId?: string; apiKey?: string }> {\n  const content = await fs.readFile(filePath, 'utf-8');\n\n  // Filter out commented lines before matching\n  const lines = content.split(/\\r?\\n/);\n  const uncommentedContent = lines.filter((line) => !line.trim().startsWith('#')).join('\\n');\n\n  const clientIdMatch = uncommentedContent.match(WORKOS_CLIENT_ID_PATTERN);\n  const apiKeyMatch = uncommentedContent.match(WORKOS_API_KEY_PATTERN);\n\n  return {\n    clientId: clientIdMatch?.[1],\n    apiKey: apiKeyMatch?.[1],\n  };\n}\n\n/**\n * Validate client ID format.\n * WorkOS client IDs start with 'client_' prefix.\n */\nexport function isValidClientId(value: string): boolean {\n  return value.startsWith('client_') && value.length > 10;\n}\n\n/**\n * Validate API key format.\n * WorkOS secret keys start with 'sk_' prefix.\n */\nexport function isValidApiKey(value: string): boolean {\n  return value.startsWith('sk_') && value.length > 10;\n}\n\n/**\n * Discover WorkOS credentials from project env files.\n * Must be called AFTER user consent is given.\n *\n * Scans files in priority order: .env.local > .env.development.local > .env.development > .env\n * Returns first complete match (both clientId and apiKey preferred, but clientId-only is valid).\n */\nexport async function discoverCredentials(projectDir: string): Promise<DiscoveryResult> {\n  logInfo('[credential-discovery] Scanning env files for WorkOS credentials');\n  for (const fileName of ENV_FILE_NAMES) {\n    const filePath = path.join(projectDir, fileName);\n\n    try {\n      const result = await scanEnvFile(filePath);\n\n      const clientIdValid = result.clientId && isValidClientId(result.clientId);\n      const apiKeyValid = result.apiKey && isValidApiKey(result.apiKey);\n\n      if (result.clientId && !clientIdValid) {\n        logInfo('[credential-discovery] Invalid clientId format in', fileName);\n      }\n      if (result.apiKey && !apiKeyValid) {\n        logInfo('[credential-discovery] Invalid apiKey format in', fileName);\n      }\n\n      if (clientIdValid) {\n        logInfo('[credential-discovery] Found valid credentials in', fileName);\n        return {\n          found: true,\n          source: 'env',\n          clientId: result.clientId,\n          apiKey: apiKeyValid ? result.apiKey : undefined,\n          sourcePath: fileName,\n        };\n      }\n    } catch {\n      // continue\n    }\n  }\n\n  logInfo('[credential-discovery] No valid credentials found');\n  return { found: false };\n}\n"]}

package/dist/lib/dev-command.js

@@ -1,5 +1,6 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { resolve, join } from 'node:path';
+import { IS_WINDOWS } from '../utils/platform.js';
 /**
  * Framework-to-dev-command mapping. Checked in order after package.json detection.
  * Each entry maps a dependency name to a framework display name and default dev command.
@@ -42,7 +43,13 @@ function hasDependency(pkg, dep) {
  * otherwise returns the bare command name (assumes it's globally available).
  */
 function resolveNodeBin(projectDir, command) {
-    const binPath = join(projectDir, 'node_modules', '.bin', command);
+    const binDir = join(projectDir, 'node_modules', '.bin');
+    if (IS_WINDOWS) {
+        const cmdPath = join(binDir, `${command}.cmd`);
+        if (existsSync(cmdPath))
+            return cmdPath;
+    }
+    const binPath = join(binDir, command);
     if (existsSync(binPath))
         return binPath;
     return command;

package/dist/lib/dev-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev-command.js","sourceRoot":"","sources":["../../src/lib/dev-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAc1C;;;GAGG;AACH,MAAM,sBAAsB,GAKvB;IACH,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IACrE,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC9E,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC1F,EAAE,GAAG,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC9F,EAAE,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAChF,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAClE,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAClE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE;CAC9E,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAKlB;IACH,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;IAC/F,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC3E,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;CACvE,CAAC;AAEF,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAgB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,GAAW;IAClD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,UAAkB,EAAE,OAAe;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,GAAG,EAAE,CAAC;QACR,kEAAkE;QAClE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;YAC3C,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YACrB,+DAA+D;YAC/D,MAAM,cAAc,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;gBACpB,SAAS,EAAE,iBAAiB;aAC7B,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;YAC3C,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;oBAClD,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QACpB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACrE,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAChE,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qBAAqB;AACrB,OAAO,EAAE,eAAe,IAAI,gBAAgB,EAAE,oBAAoB,IAAI,qBAAqB,EAAE,CAAC","sourcesContent":["import { readFileSync, existsSync } from 'node:fs';\nimport { resolve, join } from 'node:path';\n\nexport interface DevCommandResult {\n  command: string;\n  args: string[];\n  framework: string | null;\n}\n\ninterface PackageJson {\n  scripts?: Record<string, string>;\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n}\n\n/**\n * Framework-to-dev-command mapping. Checked in order after package.json detection.\n * Each entry maps a dependency name to a framework display name and default dev command.\n */\nconst FRAMEWORK_DEV_COMMANDS: Array<{\n  dep: string;\n  framework: string;\n  command: string;\n  args: string[];\n}> = [\n  { dep: 'next', framework: 'Next.js', command: 'next', args: ['dev'] },\n  { dep: '@remix-run/dev', framework: 'Remix', command: 'remix', args: ['dev'] },\n  { dep: 'react-router', framework: 'React Router', command: 'react-router', args: ['dev'] },\n  { dep: '@tanstack/react-start', framework: 'TanStack Start', command: 'vinxi', args: ['dev'] },\n  { dep: '@sveltejs/kit', framework: 'SvelteKit', command: 'vite', args: ['dev'] },\n  { dep: 'vite', framework: 'Vite', command: 'vite', args: ['dev'] },\n  { dep: 'nuxt', framework: 'Nuxt', command: 'nuxt', args: ['dev'] },\n  { dep: 'express', framework: 'Express', command: 'node', args: ['index.js'] },\n];\n\n/**\n * Non-JS framework detection: checks for well-known files in the project directory.\n */\nconst NON_JS_FRAMEWORKS: Array<{\n  file: string;\n  framework: string;\n  command: string;\n  args: string[];\n}> = [\n  { file: 'manage.py', framework: 'Django', command: 'python', args: ['manage.py', 'runserver'] },\n  { file: 'Gemfile', framework: 'Rails', command: 'rails', args: ['server'] },\n  { file: 'go.mod', framework: 'Go', command: 'go', args: ['run', '.'] },\n];\n\nfunction readPackageJson(projectDir: string): PackageJson | null {\n  const pkgPath = resolve(projectDir, 'package.json');\n  if (!existsSync(pkgPath)) return null;\n  try {\n    return JSON.parse(readFileSync(pkgPath, 'utf-8')) as PackageJson;\n  } catch {\n    return null;\n  }\n}\n\nfunction hasDependency(pkg: PackageJson, dep: string): boolean {\n  return !!(pkg.dependencies?.[dep] || pkg.devDependencies?.[dep]);\n}\n\n/**\n * Resolve the npx-style command for a given binary.\n * Returns the binary path under node_modules/.bin if it exists,\n * otherwise returns the bare command name (assumes it's globally available).\n */\nfunction resolveNodeBin(projectDir: string, command: string): string {\n  const binPath = join(projectDir, 'node_modules', '.bin', command);\n  if (existsSync(binPath)) return binPath;\n  return command;\n}\n\n/**\n * Resolve the dev command for a project directory.\n *\n * Priority:\n * 1. `scripts.dev` from package.json (developer's config is authoritative)\n * 2. Framework-specific default based on dependency detection\n * 3. Non-JS framework detection (Django, Rails, Go)\n * 4. Error — no dev command could be resolved\n */\nexport async function resolveDevCommand(projectDir: string): Promise<DevCommandResult> {\n  const pkg = readPackageJson(projectDir);\n\n  if (pkg) {\n    // Detect framework from dependencies first (for display purposes)\n    let detectedFramework: string | null = null;\n    for (const entry of FRAMEWORK_DEV_COMMANDS) {\n      if (hasDependency(pkg, entry.dep)) {\n        detectedFramework = entry.framework;\n        break;\n      }\n    }\n\n    // Priority 1: scripts.dev from package.json\n    if (pkg.scripts?.dev) {\n      // Use the package manager's run command to execute scripts.dev\n      const packageManager = detectPackageManager(projectDir);\n      return {\n        command: packageManager,\n        args: ['run', 'dev'],\n        framework: detectedFramework,\n      };\n    }\n\n    // Priority 2: Framework-specific default\n    for (const entry of FRAMEWORK_DEV_COMMANDS) {\n      if (hasDependency(pkg, entry.dep)) {\n        return {\n          command: resolveNodeBin(projectDir, entry.command),\n          args: entry.args,\n          framework: entry.framework,\n        };\n      }\n    }\n  }\n\n  // Priority 3: Non-JS frameworks\n  for (const entry of NON_JS_FRAMEWORKS) {\n    if (existsSync(resolve(projectDir, entry.file))) {\n      return {\n        command: entry.command,\n        args: entry.args,\n        framework: entry.framework,\n      };\n    }\n  }\n\n  // No framework or scripts.dev found\n  return {\n    command: 'npm',\n    args: ['run', 'dev'],\n    framework: null,\n  };\n}\n\n/**\n * Detect the package manager used in the project.\n */\nfunction detectPackageManager(projectDir: string): string {\n  if (existsSync(resolve(projectDir, 'pnpm-lock.yaml'))) return 'pnpm';\n  if (existsSync(resolve(projectDir, 'yarn.lock'))) return 'yarn';\n  if (existsSync(resolve(projectDir, 'bun.lockb')) || existsSync(resolve(projectDir, 'bun.lock'))) return 'bun';\n  return 'npm';\n}\n\n// Export for testing\nexport { readPackageJson as _readPackageJson, detectPackageManager as _detectPackageManager };\n"]}
+{"version":3,"file":"dev-command.js","sourceRoot":"","sources":["../../src/lib/dev-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAclD;;;GAGG;AACH,MAAM,sBAAsB,GAKvB;IACH,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IACrE,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC9E,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC1F,EAAE,GAAG,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC9F,EAAE,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAChF,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAClE,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAClE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE;CAC9E,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAKlB;IACH,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;IAC/F,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC3E,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;CACvE,CAAC;AAEF,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAgB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,GAAW;IAClD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,UAAkB,EAAE,OAAe;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,GAAG,EAAE,CAAC;QACR,kEAAkE;QAClE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;YAC3C,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YACrB,+DAA+D;YAC/D,MAAM,cAAc,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;gBACpB,SAAS,EAAE,iBAAiB;aAC7B,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;YAC3C,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;oBAClD,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QACpB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACrE,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAChE,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qBAAqB;AACrB,OAAO,EAAE,eAAe,IAAI,gBAAgB,EAAE,oBAAoB,IAAI,qBAAqB,EAAE,CAAC","sourcesContent":["import { readFileSync, existsSync } from 'node:fs';\nimport { resolve, join } from 'node:path';\nimport { IS_WINDOWS } from '../utils/platform.js';\n\nexport interface DevCommandResult {\n  command: string;\n  args: string[];\n  framework: string | null;\n}\n\ninterface PackageJson {\n  scripts?: Record<string, string>;\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n}\n\n/**\n * Framework-to-dev-command mapping. Checked in order after package.json detection.\n * Each entry maps a dependency name to a framework display name and default dev command.\n */\nconst FRAMEWORK_DEV_COMMANDS: Array<{\n  dep: string;\n  framework: string;\n  command: string;\n  args: string[];\n}> = [\n  { dep: 'next', framework: 'Next.js', command: 'next', args: ['dev'] },\n  { dep: '@remix-run/dev', framework: 'Remix', command: 'remix', args: ['dev'] },\n  { dep: 'react-router', framework: 'React Router', command: 'react-router', args: ['dev'] },\n  { dep: '@tanstack/react-start', framework: 'TanStack Start', command: 'vinxi', args: ['dev'] },\n  { dep: '@sveltejs/kit', framework: 'SvelteKit', command: 'vite', args: ['dev'] },\n  { dep: 'vite', framework: 'Vite', command: 'vite', args: ['dev'] },\n  { dep: 'nuxt', framework: 'Nuxt', command: 'nuxt', args: ['dev'] },\n  { dep: 'express', framework: 'Express', command: 'node', args: ['index.js'] },\n];\n\n/**\n * Non-JS framework detection: checks for well-known files in the project directory.\n */\nconst NON_JS_FRAMEWORKS: Array<{\n  file: string;\n  framework: string;\n  command: string;\n  args: string[];\n}> = [\n  { file: 'manage.py', framework: 'Django', command: 'python', args: ['manage.py', 'runserver'] },\n  { file: 'Gemfile', framework: 'Rails', command: 'rails', args: ['server'] },\n  { file: 'go.mod', framework: 'Go', command: 'go', args: ['run', '.'] },\n];\n\nfunction readPackageJson(projectDir: string): PackageJson | null {\n  const pkgPath = resolve(projectDir, 'package.json');\n  if (!existsSync(pkgPath)) return null;\n  try {\n    return JSON.parse(readFileSync(pkgPath, 'utf-8')) as PackageJson;\n  } catch {\n    return null;\n  }\n}\n\nfunction hasDependency(pkg: PackageJson, dep: string): boolean {\n  return !!(pkg.dependencies?.[dep] || pkg.devDependencies?.[dep]);\n}\n\n/**\n * Resolve the npx-style command for a given binary.\n * Returns the binary path under node_modules/.bin if it exists,\n * otherwise returns the bare command name (assumes it's globally available).\n */\nfunction resolveNodeBin(projectDir: string, command: string): string {\n  const binDir = join(projectDir, 'node_modules', '.bin');\n  if (IS_WINDOWS) {\n    const cmdPath = join(binDir, `${command}.cmd`);\n    if (existsSync(cmdPath)) return cmdPath;\n  }\n  const binPath = join(binDir, command);\n  if (existsSync(binPath)) return binPath;\n  return command;\n}\n\n/**\n * Resolve the dev command for a project directory.\n *\n * Priority:\n * 1. `scripts.dev` from package.json (developer's config is authoritative)\n * 2. Framework-specific default based on dependency detection\n * 3. Non-JS framework detection (Django, Rails, Go)\n * 4. Error — no dev command could be resolved\n */\nexport async function resolveDevCommand(projectDir: string): Promise<DevCommandResult> {\n  const pkg = readPackageJson(projectDir);\n\n  if (pkg) {\n    // Detect framework from dependencies first (for display purposes)\n    let detectedFramework: string | null = null;\n    for (const entry of FRAMEWORK_DEV_COMMANDS) {\n      if (hasDependency(pkg, entry.dep)) {\n        detectedFramework = entry.framework;\n        break;\n      }\n    }\n\n    // Priority 1: scripts.dev from package.json\n    if (pkg.scripts?.dev) {\n      // Use the package manager's run command to execute scripts.dev\n      const packageManager = detectPackageManager(projectDir);\n      return {\n        command: packageManager,\n        args: ['run', 'dev'],\n        framework: detectedFramework,\n      };\n    }\n\n    // Priority 2: Framework-specific default\n    for (const entry of FRAMEWORK_DEV_COMMANDS) {\n      if (hasDependency(pkg, entry.dep)) {\n        return {\n          command: resolveNodeBin(projectDir, entry.command),\n          args: entry.args,\n          framework: entry.framework,\n        };\n      }\n    }\n  }\n\n  // Priority 3: Non-JS frameworks\n  for (const entry of NON_JS_FRAMEWORKS) {\n    if (existsSync(resolve(projectDir, entry.file))) {\n      return {\n        command: entry.command,\n        args: entry.args,\n        framework: entry.framework,\n      };\n    }\n  }\n\n  // No framework or scripts.dev found\n  return {\n    command: 'npm',\n    args: ['run', 'dev'],\n    framework: null,\n  };\n}\n\n/**\n * Detect the package manager used in the project.\n */\nfunction detectPackageManager(projectDir: string): string {\n  if (existsSync(resolve(projectDir, 'pnpm-lock.yaml'))) return 'pnpm';\n  if (existsSync(resolve(projectDir, 'yarn.lock'))) return 'yarn';\n  if (existsSync(resolve(projectDir, 'bun.lockb')) || existsSync(resolve(projectDir, 'bun.lock'))) return 'bun';\n  return 'npm';\n}\n\n// Export for testing\nexport { readPackageJson as _readPackageJson, detectPackageManager as _detectPackageManager };\n"]}

package/dist/lib/device-id.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Persistent device identifier for telemetry correlation.
+ *
+ * Stored at ~/.workos/device-id as a plain UTF-8 UUID string. Not a secret
+ * — this is a convenience identifier that survives keyring unavailability.
+ * Any IO failure falls through to a one-shot UUID for the current session.
+ */
+/**
+ * Asynchronously resolve (and lazily create) the device id without blocking
+ * the event loop. Memoized: the first call performs the IO, concurrent and
+ * later callers await the same promise. Populates the shared cache that the
+ * synchronous getDeviceId() reads, so prewarming this at startup keeps the
+ * synchronous telemetry path off blocking fs IO. Never rejects.
+ */
+export declare function loadDeviceId(): Promise<string>;
+/**
+ * Synchronous accessor for the telemetry event path. Returns the prewarmed
+ * value when loadDeviceId() has run; otherwise falls back to a one-time
+ * synchronous read of the same file (returning the persisted id, so the value
+ * never diverges from the async path). On any IO failure, returns a one-shot
+ * UUID scoped to the current process — never throws.
+ */
+export declare function getDeviceId(): string;
+/** Test seam — resets the in-memory cache between test cases. */
+export declare function __resetDeviceIdCache(): void;

package/dist/lib/device-id.js

@@ -0,0 +1,102 @@
+/**
+ * Persistent device identifier for telemetry correlation.
+ *
+ * Stored at ~/.workos/device-id as a plain UTF-8 UUID string. Not a secret
+ * — this is a convenience identifier that survives keyring unavailability.
+ * Any IO failure falls through to a one-shot UUID for the current session.
+ */
+import fs from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+// RFC 4122 v4 format — matches what `crypto.randomUUID()` produces.
+// Rejects non-UUID strings like "------------------------------------".
+const UUID_V4_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+let cached;
+let pending;
+function getDeviceIdPath() {
+    return path.join(os.homedir(), '.workos', 'device-id');
+}
+/**
+ * Asynchronously resolve (and lazily create) the device id without blocking
+ * the event loop. Memoized: the first call performs the IO, concurrent and
+ * later callers await the same promise. Populates the shared cache that the
+ * synchronous getDeviceId() reads, so prewarming this at startup keeps the
+ * synchronous telemetry path off blocking fs IO. Never rejects.
+ */
+export function loadDeviceId() {
+    if (cached)
+        return Promise.resolve(cached);
+    if (pending)
+        return pending;
+    pending = (async () => {
+        const filePath = getDeviceIdPath();
+        try {
+            try {
+                const raw = (await readFile(filePath, 'utf8')).trim();
+                if (UUID_V4_REGEX.test(raw)) {
+                    cached = raw;
+                    return raw;
+                }
+            }
+            catch {
+                // Missing/unreadable file — fall through and create it.
+            }
+            const id = crypto.randomUUID();
+            await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+            await writeFile(filePath, id, { encoding: 'utf8', mode: 0o600 });
+            cached = id;
+            return id;
+        }
+        catch {
+            // IO failure (readonly FS, permission denied, etc.) — fall through to
+            // a session-scoped UUID, cached for the rest of this process.
+            cached = crypto.randomUUID();
+            return cached;
+        }
+        finally {
+            pending = undefined;
+        }
+    })();
+    return pending;
+}
+/**
+ * Synchronous accessor for the telemetry event path. Returns the prewarmed
+ * value when loadDeviceId() has run; otherwise falls back to a one-time
+ * synchronous read of the same file (returning the persisted id, so the value
+ * never diverges from the async path). On any IO failure, returns a one-shot
+ * UUID scoped to the current process — never throws.
+ */
+export function getDeviceId() {
+    if (cached)
+        return cached;
+    const filePath = getDeviceIdPath();
+    try {
+        if (fs.existsSync(filePath)) {
+            const raw = fs.readFileSync(filePath, 'utf8').trim();
+            if (UUID_V4_REGEX.test(raw)) {
+                cached = raw;
+                return raw;
+            }
+        }
+        const id = crypto.randomUUID();
+        fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(filePath, id, { encoding: 'utf8', mode: 0o600 });
+        cached = id;
+        return id;
+    }
+    catch {
+        // IO failure (readonly FS, permission denied, etc.) — fall through to
+        // a session-scoped UUID. Cache it so subsequent calls in this process
+        // return the same value; the next process run will retry IO.
+        cached = crypto.randomUUID();
+        return cached;
+    }
+}
+/** Test seam — resets the in-memory cache between test cases. */
+export function __resetDeviceIdCache() {
+    cached = undefined;
+    pending = undefined;
+}
+//# sourceMappingURL=device-id.js.map

package/dist/lib/device-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-id.js","sourceRoot":"","sources":["../../src/lib/device-id.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,oEAAoE;AACpE,wEAAwE;AACxE,MAAM,aAAa,GAAG,wEAAwE,CAAC;AAE/F,IAAI,MAA0B,CAAC;AAC/B,IAAI,OAAoC,CAAC;AAEzC,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,CAAC;oBACb,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YAED,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,MAAM,GAAG,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW;IACzB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACrD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,CAAC;gBACb,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,GAAG,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,SAAS,CAAC;IACnB,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC","sourcesContent":["/**\n * Persistent device identifier for telemetry correlation.\n *\n * Stored at ~/.workos/device-id as a plain UTF-8 UUID string. Not a secret\n * — this is a convenience identifier that survives keyring unavailability.\n * Any IO failure falls through to a one-shot UUID for the current session.\n */\n\nimport fs from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport path from 'node:path';\nimport os from 'node:os';\nimport crypto from 'node:crypto';\n\n// RFC 4122 v4 format — matches what `crypto.randomUUID()` produces.\n// Rejects non-UUID strings like \"------------------------------------\".\nconst UUID_V4_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nlet cached: string | undefined;\nlet pending: Promise<string> | undefined;\n\nfunction getDeviceIdPath(): string {\n  return path.join(os.homedir(), '.workos', 'device-id');\n}\n\n/**\n * Asynchronously resolve (and lazily create) the device id without blocking\n * the event loop. Memoized: the first call performs the IO, concurrent and\n * later callers await the same promise. Populates the shared cache that the\n * synchronous getDeviceId() reads, so prewarming this at startup keeps the\n * synchronous telemetry path off blocking fs IO. Never rejects.\n */\nexport function loadDeviceId(): Promise<string> {\n  if (cached) return Promise.resolve(cached);\n  if (pending) return pending;\n\n  pending = (async () => {\n    const filePath = getDeviceIdPath();\n    try {\n      try {\n        const raw = (await readFile(filePath, 'utf8')).trim();\n        if (UUID_V4_REGEX.test(raw)) {\n          cached = raw;\n          return raw;\n        }\n      } catch {\n        // Missing/unreadable file — fall through and create it.\n      }\n\n      const id = crypto.randomUUID();\n      await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });\n      await writeFile(filePath, id, { encoding: 'utf8', mode: 0o600 });\n      cached = id;\n      return id;\n    } catch {\n      // IO failure (readonly FS, permission denied, etc.) — fall through to\n      // a session-scoped UUID, cached for the rest of this process.\n      cached = crypto.randomUUID();\n      return cached;\n    } finally {\n      pending = undefined;\n    }\n  })();\n\n  return pending;\n}\n\n/**\n * Synchronous accessor for the telemetry event path. Returns the prewarmed\n * value when loadDeviceId() has run; otherwise falls back to a one-time\n * synchronous read of the same file (returning the persisted id, so the value\n * never diverges from the async path). On any IO failure, returns a one-shot\n * UUID scoped to the current process — never throws.\n */\nexport function getDeviceId(): string {\n  if (cached) return cached;\n\n  const filePath = getDeviceIdPath();\n  try {\n    if (fs.existsSync(filePath)) {\n      const raw = fs.readFileSync(filePath, 'utf8').trim();\n      if (UUID_V4_REGEX.test(raw)) {\n        cached = raw;\n        return raw;\n      }\n    }\n\n    const id = crypto.randomUUID();\n    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });\n    fs.writeFileSync(filePath, id, { encoding: 'utf8', mode: 0o600 });\n    cached = id;\n    return id;\n  } catch {\n    // IO failure (readonly FS, permission denied, etc.) — fall through to\n    // a session-scoped UUID. Cache it so subsequent calls in this process\n    // return the same value; the next process run will retry IO.\n    cached = crypto.randomUUID();\n    return cached;\n  }\n}\n\n/** Test seam — resets the in-memory cache between test cases. */\nexport function __resetDeviceIdCache(): void {\n  cached = undefined;\n  pending = undefined;\n}\n"]}

package/dist/lib/preferences.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Plain CLI preferences store.
+ *
+ * Stored at ~/.workos/preferences.json as plain JSON. These are NOT secrets —
+ * knowing that someone opted out of telemetry leaks nothing — so this
+ * deliberately avoids the keyring abstraction (config-store.ts) to prevent a
+ * non-secret write from ever triggering the insecure-fallback security warning.
+ *
+ * Mirrors the structural pattern of device-id.ts: a synchronous accessor backed
+ * by a cache, an async prewarm that populates that cache off the blocking-fs
+ * path, and a never-throws contract on every read/parse so a corrupt file can
+ * never break a command.
+ */
+export interface CliPreferences {
+    telemetry?: {
+        /** true => the user explicitly opted out of telemetry. */
+        optedOut?: boolean;
+        /** ISO timestamp the first-run notice was shown — written in Phase 2 only. */
+        noticeShownAt?: string;
+    };
+}
+/** Effective source of the resolved telemetry-enabled decision. */
+export type TelemetrySource = 'env' | 'preference' | 'default';
+export declare function getPreferencesPath(): string;
+/**
+ * Asynchronously load preferences and warm the cache the synchronous
+ * getPreferences() reads. Memoized: the first call performs the IO, concurrent
+ * and later callers await the same promise. Prewarming this at startup keeps
+ * the synchronous telemetry path off blocking fs IO. Never rejects.
+ */
+export declare function loadPreferences(): Promise<CliPreferences>;
+/**
+ * Synchronous accessor. Returns the prewarmed value when loadPreferences() has
+ * run; otherwise performs a one-time synchronous read of the same file. On any
+ * IO/parse failure returns {} (telemetry stays at its default-on state). Never
+ * throws.
+ */
+export declare function getPreferences(): CliPreferences;
+/**
+ * Read-modify-write the on-disk preferences, merging `next` over the current
+ * persisted value so future fields are never clobbered, then update the cache.
+ * Throws on write failure so callers on the command path (opt-out/opt-in) can
+ * surface a clear error — the read path swallows, the write path does not.
+ */
+export declare function savePreferences(next: CliPreferences): void;
+/** Whether the user has explicitly opted out via the saved preference. */
+export declare function isTelemetryOptedOut(): boolean;
+/** Persist the opt-out flag. Throws on write failure (see savePreferences). */
+export declare function setTelemetryOptedOut(value: boolean): void;
+/** Whether the first-run telemetry notice has already been shown (ever). */
+export declare function isNoticeShown(): boolean;
+/**
+ * Persist the first-run notice as shown, stamping the current time. Uses the
+ * read-modify-write savePreferences so it never clobbers the optedOut flag.
+ * Throws on write failure (see savePreferences) — the caller in
+ * telemetry-notice.ts swallows it so a read-only FS never blocks a command.
+ */
+export declare function markNoticeShown(): void;
+/**
+ * Tri-state env override for telemetry.
+ *
+ * Only the explicit strings 'true' / 'false' count as an override. Any other
+ * value — including unset or garbage like '1' — returns undefined and falls
+ * through to the saved preference.
+ *
+ * This is a deliberate, documented change from the old `WORKOS_TELEMETRY !==
+ * 'false'` behaviour: previously `WORKOS_TELEMETRY=1` forced telemetry on even
+ * for opted-out users; now an opt-out is respected unless the env var
+ * explicitly says 'true'.
+ */
+export declare function envTelemetryOverride(): boolean | undefined;
+/**
+ * Effective telemetry-enabled decision.
+ *
+ * Resolution order:
+ *   1. envTelemetryOverride() if defined — env wins in BOTH directions.
+ *   2. otherwise !isTelemetryOptedOut() — default-on unless explicitly opted out.
+ */
+export declare function isTelemetryEnabled(): boolean;
+/**
+ * Which signal produced the effective telemetry decision. Mirrors the
+ * precedence in isTelemetryEnabled() so the `telemetry status` command and the
+ * resolver can never drift.
+ *
+ * Note: an explicit opt-in (optedOut === false) reads as 'default', not
+ * 'preference' — its outcome is identical to a fresh install, and the resolver
+ * only treats optedOut === true as a non-default signal, so reporting
+ * 'preference' here would imply a behavioral difference that does not exist.
+ */
+export declare function getTelemetrySource(): TelemetrySource;
+/**
+ * Delete the preferences file, returning telemetry to its fresh-install state
+ * (opted-in, first-run notice unseen). Used by `debug reset` to wipe stored CLI
+ * state alongside credentials and config. No-op if the file does not exist;
+ * throws on a real delete failure (e.g. permission denied) so the caller can
+ * surface it, mirroring clearConfig/clearCredentials. Resets the in-memory
+ * cache so subsequent reads in this process reflect the cleared state.
+ */
+export declare function clearPreferences(): void;
+/** Test seam — resets the in-memory cache between test cases. */
+export declare function __resetPreferencesCache(): void;

package/dist/lib/preferences.js

@@ -0,0 +1,198 @@
+/**
+ * Plain CLI preferences store.
+ *
+ * Stored at ~/.workos/preferences.json as plain JSON. These are NOT secrets —
+ * knowing that someone opted out of telemetry leaks nothing — so this
+ * deliberately avoids the keyring abstraction (config-store.ts) to prevent a
+ * non-secret write from ever triggering the insecure-fallback security warning.
+ *
+ * Mirrors the structural pattern of device-id.ts: a synchronous accessor backed
+ * by a cache, an async prewarm that populates that cache off the blocking-fs
+ * path, and a never-throws contract on every read/parse so a corrupt file can
+ * never break a command.
+ */
+import fs from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+let cached;
+let pending;
+export function getPreferencesPath() {
+    return path.join(os.homedir(), '.workos', 'preferences.json');
+}
+function parsePreferences(raw) {
+    try {
+        const value = JSON.parse(raw);
+        // Defend against a file that parses to a non-object (e.g. `"true"`, `42`).
+        if (value && typeof value === 'object' && !Array.isArray(value)) {
+            return value;
+        }
+    }
+    catch {
+        // Corrupt JSON — fall through to empty preferences. A later savePreferences
+        // overwrites it cleanly; we never auto-delete.
+    }
+    return {};
+}
+/**
+ * Asynchronously load preferences and warm the cache the synchronous
+ * getPreferences() reads. Memoized: the first call performs the IO, concurrent
+ * and later callers await the same promise. Prewarming this at startup keeps
+ * the synchronous telemetry path off blocking fs IO. Never rejects.
+ */
+export function loadPreferences() {
+    if (cached)
+        return Promise.resolve(cached);
+    if (pending)
+        return pending;
+    pending = (async () => {
+        try {
+            const raw = await readFile(getPreferencesPath(), 'utf8');
+            cached = parsePreferences(raw);
+        }
+        catch {
+            // Missing/unreadable file — treat as no preferences set.
+            cached = {};
+        }
+        finally {
+            pending = undefined;
+        }
+        return cached;
+    })();
+    return pending;
+}
+/**
+ * Synchronous accessor. Returns the prewarmed value when loadPreferences() has
+ * run; otherwise performs a one-time synchronous read of the same file. On any
+ * IO/parse failure returns {} (telemetry stays at its default-on state). Never
+ * throws.
+ */
+export function getPreferences() {
+    if (cached)
+        return cached;
+    try {
+        const raw = fs.readFileSync(getPreferencesPath(), 'utf8');
+        cached = parsePreferences(raw);
+    }
+    catch {
+        // Missing/unreadable/corrupt — telemetry stays at its default-on state.
+        cached = {};
+    }
+    return cached;
+}
+/**
+ * Read-modify-write the on-disk preferences, merging `next` over the current
+ * persisted value so future fields are never clobbered, then update the cache.
+ * Throws on write failure so callers on the command path (opt-out/opt-in) can
+ * surface a clear error — the read path swallows, the write path does not.
+ */
+export function savePreferences(next) {
+    const filePath = getPreferencesPath();
+    // Read-modify-write over the CURRENT on-disk value (not the cache) so a field
+    // written by another process / a future phase is preserved.
+    let current = {};
+    try {
+        current = parsePreferences(fs.readFileSync(filePath, 'utf8'));
+    }
+    catch {
+        // No existing file (or unreadable) — start from empty.
+    }
+    const merged = {
+        ...current,
+        ...next,
+        ...(current.telemetry || next.telemetry ? { telemetry: { ...current.telemetry, ...next.telemetry } } : {}),
+    };
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(filePath, JSON.stringify(merged), { encoding: 'utf8', mode: 0o600 });
+    cached = merged;
+}
+/** Whether the user has explicitly opted out via the saved preference. */
+export function isTelemetryOptedOut() {
+    return getPreferences().telemetry?.optedOut === true;
+}
+/** Persist the opt-out flag. Throws on write failure (see savePreferences). */
+export function setTelemetryOptedOut(value) {
+    savePreferences({ telemetry: { optedOut: value } });
+}
+/** Whether the first-run telemetry notice has already been shown (ever). */
+export function isNoticeShown() {
+    return !!getPreferences().telemetry?.noticeShownAt;
+}
+/**
+ * Persist the first-run notice as shown, stamping the current time. Uses the
+ * read-modify-write savePreferences so it never clobbers the optedOut flag.
+ * Throws on write failure (see savePreferences) — the caller in
+ * telemetry-notice.ts swallows it so a read-only FS never blocks a command.
+ */
+export function markNoticeShown() {
+    savePreferences({ telemetry: { noticeShownAt: new Date().toISOString() } });
+}
+/**
+ * Tri-state env override for telemetry.
+ *
+ * Only the explicit strings 'true' / 'false' count as an override. Any other
+ * value — including unset or garbage like '1' — returns undefined and falls
+ * through to the saved preference.
+ *
+ * This is a deliberate, documented change from the old `WORKOS_TELEMETRY !==
+ * 'false'` behaviour: previously `WORKOS_TELEMETRY=1` forced telemetry on even
+ * for opted-out users; now an opt-out is respected unless the env var
+ * explicitly says 'true'.
+ */
+export function envTelemetryOverride() {
+    const value = process.env.WORKOS_TELEMETRY;
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    return undefined;
+}
+/**
+ * Effective telemetry-enabled decision.
+ *
+ * Resolution order:
+ *   1. envTelemetryOverride() if defined — env wins in BOTH directions.
+ *   2. otherwise !isTelemetryOptedOut() — default-on unless explicitly opted out.
+ */
+export function isTelemetryEnabled() {
+    const override = envTelemetryOverride();
+    if (override !== undefined)
+        return override;
+    return !isTelemetryOptedOut();
+}
+/**
+ * Which signal produced the effective telemetry decision. Mirrors the
+ * precedence in isTelemetryEnabled() so the `telemetry status` command and the
+ * resolver can never drift.
+ *
+ * Note: an explicit opt-in (optedOut === false) reads as 'default', not
+ * 'preference' — its outcome is identical to a fresh install, and the resolver
+ * only treats optedOut === true as a non-default signal, so reporting
+ * 'preference' here would imply a behavioral difference that does not exist.
+ */
+export function getTelemetrySource() {
+    if (envTelemetryOverride() !== undefined)
+        return 'env';
+    if (isTelemetryOptedOut())
+        return 'preference';
+    return 'default';
+}
+/**
+ * Delete the preferences file, returning telemetry to its fresh-install state
+ * (opted-in, first-run notice unseen). Used by `debug reset` to wipe stored CLI
+ * state alongside credentials and config. No-op if the file does not exist;
+ * throws on a real delete failure (e.g. permission denied) so the caller can
+ * surface it, mirroring clearConfig/clearCredentials. Resets the in-memory
+ * cache so subsequent reads in this process reflect the cleared state.
+ */
+export function clearPreferences() {
+    fs.rmSync(getPreferencesPath(), { force: true });
+    cached = {};
+    pending = undefined;
+}
+/** Test seam — resets the in-memory cache between test cases. */
+export function __resetPreferencesCache() {
+    cached = undefined;
+    pending = undefined;
+}
+//# sourceMappingURL=preferences.js.map

package/dist/lib/preferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preferences.js","sourceRoot":"","sources":["../../src/lib/preferences.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAczB,IAAI,MAAkC,CAAC;AACvC,IAAI,OAA4C,CAAC;AAEjD,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,2EAA2E;QAC3E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAuB,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,+CAA+C;IACjD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IAEtC,8EAA8E;IAC9E,4DAA4D;IAC5D,IAAI,OAAO,GAAmB,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,MAAM,MAAM,GAAmB;QAC7B,GAAG,OAAO;QACV,GAAG,IAAI;QACP,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3G,CAAC;IAEF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,MAAM,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB;IACjC,OAAO,cAAc,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,eAAe,CAAC,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa;IAC3B,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,eAAe,CAAC,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC3C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,CAAC,mBAAmB,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,oBAAoB,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,mBAAmB,EAAE;QAAE,OAAO,YAAY,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB;IAC9B,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,EAAE,CAAC;IACZ,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,SAAS,CAAC;IACnB,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC","sourcesContent":["/**\n * Plain CLI preferences store.\n *\n * Stored at ~/.workos/preferences.json as plain JSON. These are NOT secrets —\n * knowing that someone opted out of telemetry leaks nothing — so this\n * deliberately avoids the keyring abstraction (config-store.ts) to prevent a\n * non-secret write from ever triggering the insecure-fallback security warning.\n *\n * Mirrors the structural pattern of device-id.ts: a synchronous accessor backed\n * by a cache, an async prewarm that populates that cache off the blocking-fs\n * path, and a never-throws contract on every read/parse so a corrupt file can\n * never break a command.\n */\n\nimport fs from 'node:fs';\nimport { readFile } from 'node:fs/promises';\nimport path from 'node:path';\nimport os from 'node:os';\n\nexport interface CliPreferences {\n  telemetry?: {\n    /** true => the user explicitly opted out of telemetry. */\n    optedOut?: boolean;\n    /** ISO timestamp the first-run notice was shown — written in Phase 2 only. */\n    noticeShownAt?: string;\n  };\n}\n\n/** Effective source of the resolved telemetry-enabled decision. */\nexport type TelemetrySource = 'env' | 'preference' | 'default';\n\nlet cached: CliPreferences | undefined;\nlet pending: Promise<CliPreferences> | undefined;\n\nexport function getPreferencesPath(): string {\n  return path.join(os.homedir(), '.workos', 'preferences.json');\n}\n\nfunction parsePreferences(raw: string): CliPreferences {\n  try {\n    const value = JSON.parse(raw);\n    // Defend against a file that parses to a non-object (e.g. `\"true\"`, `42`).\n    if (value && typeof value === 'object' && !Array.isArray(value)) {\n      return value as CliPreferences;\n    }\n  } catch {\n    // Corrupt JSON — fall through to empty preferences. A later savePreferences\n    // overwrites it cleanly; we never auto-delete.\n  }\n  return {};\n}\n\n/**\n * Asynchronously load preferences and warm the cache the synchronous\n * getPreferences() reads. Memoized: the first call performs the IO, concurrent\n * and later callers await the same promise. Prewarming this at startup keeps\n * the synchronous telemetry path off blocking fs IO. Never rejects.\n */\nexport function loadPreferences(): Promise<CliPreferences> {\n  if (cached) return Promise.resolve(cached);\n  if (pending) return pending;\n\n  pending = (async () => {\n    try {\n      const raw = await readFile(getPreferencesPath(), 'utf8');\n      cached = parsePreferences(raw);\n    } catch {\n      // Missing/unreadable file — treat as no preferences set.\n      cached = {};\n    } finally {\n      pending = undefined;\n    }\n    return cached;\n  })();\n\n  return pending;\n}\n\n/**\n * Synchronous accessor. Returns the prewarmed value when loadPreferences() has\n * run; otherwise performs a one-time synchronous read of the same file. On any\n * IO/parse failure returns {} (telemetry stays at its default-on state). Never\n * throws.\n */\nexport function getPreferences(): CliPreferences {\n  if (cached) return cached;\n\n  try {\n    const raw = fs.readFileSync(getPreferencesPath(), 'utf8');\n    cached = parsePreferences(raw);\n  } catch {\n    // Missing/unreadable/corrupt — telemetry stays at its default-on state.\n    cached = {};\n  }\n  return cached;\n}\n\n/**\n * Read-modify-write the on-disk preferences, merging `next` over the current\n * persisted value so future fields are never clobbered, then update the cache.\n * Throws on write failure so callers on the command path (opt-out/opt-in) can\n * surface a clear error — the read path swallows, the write path does not.\n */\nexport function savePreferences(next: CliPreferences): void {\n  const filePath = getPreferencesPath();\n\n  // Read-modify-write over the CURRENT on-disk value (not the cache) so a field\n  // written by another process / a future phase is preserved.\n  let current: CliPreferences = {};\n  try {\n    current = parsePreferences(fs.readFileSync(filePath, 'utf8'));\n  } catch {\n    // No existing file (or unreadable) — start from empty.\n  }\n\n  const merged: CliPreferences = {\n    ...current,\n    ...next,\n    ...(current.telemetry || next.telemetry ? { telemetry: { ...current.telemetry, ...next.telemetry } } : {}),\n  };\n\n  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });\n  fs.writeFileSync(filePath, JSON.stringify(merged), { encoding: 'utf8', mode: 0o600 });\n  cached = merged;\n}\n\n/** Whether the user has explicitly opted out via the saved preference. */\nexport function isTelemetryOptedOut(): boolean {\n  return getPreferences().telemetry?.optedOut === true;\n}\n\n/** Persist the opt-out flag. Throws on write failure (see savePreferences). */\nexport function setTelemetryOptedOut(value: boolean): void {\n  savePreferences({ telemetry: { optedOut: value } });\n}\n\n/** Whether the first-run telemetry notice has already been shown (ever). */\nexport function isNoticeShown(): boolean {\n  return !!getPreferences().telemetry?.noticeShownAt;\n}\n\n/**\n * Persist the first-run notice as shown, stamping the current time. Uses the\n * read-modify-write savePreferences so it never clobbers the optedOut flag.\n * Throws on write failure (see savePreferences) — the caller in\n * telemetry-notice.ts swallows it so a read-only FS never blocks a command.\n */\nexport function markNoticeShown(): void {\n  savePreferences({ telemetry: { noticeShownAt: new Date().toISOString() } });\n}\n\n/**\n * Tri-state env override for telemetry.\n *\n * Only the explicit strings 'true' / 'false' count as an override. Any other\n * value — including unset or garbage like '1' — returns undefined and falls\n * through to the saved preference.\n *\n * This is a deliberate, documented change from the old `WORKOS_TELEMETRY !==\n * 'false'` behaviour: previously `WORKOS_TELEMETRY=1` forced telemetry on even\n * for opted-out users; now an opt-out is respected unless the env var\n * explicitly says 'true'.\n */\nexport function envTelemetryOverride(): boolean | undefined {\n  const value = process.env.WORKOS_TELEMETRY;\n  if (value === 'true') return true;\n  if (value === 'false') return false;\n  return undefined;\n}\n\n/**\n * Effective telemetry-enabled decision.\n *\n * Resolution order:\n *   1. envTelemetryOverride() if defined — env wins in BOTH directions.\n *   2. otherwise !isTelemetryOptedOut() — default-on unless explicitly opted out.\n */\nexport function isTelemetryEnabled(): boolean {\n  const override = envTelemetryOverride();\n  if (override !== undefined) return override;\n  return !isTelemetryOptedOut();\n}\n\n/**\n * Which signal produced the effective telemetry decision. Mirrors the\n * precedence in isTelemetryEnabled() so the `telemetry status` command and the\n * resolver can never drift.\n *\n * Note: an explicit opt-in (optedOut === false) reads as 'default', not\n * 'preference' — its outcome is identical to a fresh install, and the resolver\n * only treats optedOut === true as a non-default signal, so reporting\n * 'preference' here would imply a behavioral difference that does not exist.\n */\nexport function getTelemetrySource(): TelemetrySource {\n  if (envTelemetryOverride() !== undefined) return 'env';\n  if (isTelemetryOptedOut()) return 'preference';\n  return 'default';\n}\n\n/**\n * Delete the preferences file, returning telemetry to its fresh-install state\n * (opted-in, first-run notice unseen). Used by `debug reset` to wipe stored CLI\n * state alongside credentials and config. No-op if the file does not exist;\n * throws on a real delete failure (e.g. permission denied) so the caller can\n * surface it, mirroring clearConfig/clearCredentials. Resets the in-memory\n * cache so subsequent reads in this process reflect the cleared state.\n */\nexport function clearPreferences(): void {\n  fs.rmSync(getPreferencesPath(), { force: true });\n  cached = {};\n  pending = undefined;\n}\n\n/** Test seam — resets the in-memory cache between test cases. */\nexport function __resetPreferencesCache(): void {\n  cached = undefined;\n  pending = undefined;\n}\n"]}

package/dist/lib/registry.js

@@ -1,6 +1,6 @@
 import { readdirSync, existsSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 /**
  * Build the integration registry by discovering all integration modules.
  * Scans `src/integrations/` (or `dist/integrations/` at runtime) for directories
@@ -33,7 +33,7 @@ export async function buildRegistry() {
             continue;
         }
         try {
-            const mod = (await import(join(integrationsDir, dir, 'index.js')));
+            const mod = (await import(pathToFileURL(join(integrationsDir, dir, 'index.js')).href));
             if (!mod.config || !mod.run) {
                 console.warn(`Integration ${dir} missing 'config' or 'run' export, skipping`);
                 continue;