workos 0.17.0 → 0.18.0

package/dist/doctor/checks/auth-patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-patterns.js","sourceRoot":"","sources":["../../../src/doctor/checks/auth-patterns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAU3C,kBAAkB;AAElB,iDAAiD;AACjD,SAAS,QAAQ,CAAC,KAAe;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAE3F;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,WAAmB,EAAE,QAAQ,GAAG,CAAC;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAErC,SAAS,IAAI,CAAC,UAAkB,EAAE,KAAa;QAC7C,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;oBACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;qBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACb,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AACvD,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,4BAA4B;AAE5B,oEAAoE;AACpE,SAAS,aAAa,CAAC,UAAkB;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAiB;IAC/C,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,yDAAyD,CAAC;IAE7E,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,2FAA2F;gBACpG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;gBACzC,WAAW,EACT,yIAAyI;gBAC3I,OAAO,EAAE,0CAA0C;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAiB;IACjD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1D,oDAAoD;IACpD,MAAM,YAAY,GAAG,gEAAgE,CAAC;IAEtF,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,oHAAoH;gBACtH,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC;gBACxC,WAAW,EACT,mGAAmG;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAiB;IAC/C,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEhD,MAAM,eAAe,GAAG;QACtB,eAAe;QACf,eAAe;QACf,UAAU;QACV,UAAU;QACV,mBAAmB;QACnB,mBAAmB;QACnB,cAAc;QACd,cAAc;KACf,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,OAAO;QACL;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EAAE,oGAAoG;YACjH,OAAO,EAAE,mDAAmD;SAC7D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAiB;IACrD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEhD,MAAM,UAAU,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,GAAG,CACjH,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAC/B,CAAC;IAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,OAAO;QACL;YACE,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,6EAA6E;YACtF,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;YACzC,WAAW,EAAE,2EAA2E;YACxF,OAAO,EAAE,mDAAmD;SAC7D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAiB;IACpD,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,WAAW,CAAC,IAAI,CACd,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,CAAC,EACzC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,CAAC,EACzC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,EAChD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CACjD,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAC5F,WAAW,CAAC,IAAI,CACd,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,EACtC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,EACtC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,EACvC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CACxC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC,CAAC,sCAAsC;IAElE,IAAI,YAAY,CAAC,UAAU,EAAE,iBAAiB,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3D,OAAO;QACL;YACE,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,oFAAoF;YAC7F,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC;YAC9C,WAAW,EAAE,0DAA0D;YACvE,OAAO,EAAE,8CAA8C;SACxD;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,mBAAmB,CAAC,GAAiB;IAC5C,0EAA0E;IAC1E,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,WAAW,GACf,UAAU,CAAC,mBAAmB,IAAI,UAAU,CAAC,+BAA+B,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC;IAE9G,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI,CAAC;AACpD,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAiB;IAClD,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,qDAAqD;IACrD,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB;QACpE,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjD,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACnD,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,OAAO;QACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,4CAA4C,YAAY,EAAE;YACnE,WAAW,EAAE,kFAAkF;YAC/F,OAAO,EAAE,8CAA8C;SACxD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAEpF,SAAS,yBAAyB,CAAC,GAAiB;IAClD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,eAAe;YAAE,SAAS;QAE/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAErF,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,wDAAwD,GAAG,EAAE;gBACtE,WAAW,EAAE,4HAA4H;aAC1I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAiB;IACjD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC;IACxD,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC,CAAC,6BAA6B;IAE3D,sEAAsE;IACtE,IAAI,YAAY,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO;YACL;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,yDAAyD;gBAClE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;gBAChD,WAAW,EACT,wHAAwH;aAC3H;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAiB;IACnD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,CAAC;IAErD,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7G,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CACxB,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,IAAI,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvD,OAAO;QACL;YACE,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,iFAAiF;YAC1F,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;YAC5C,WAAW,EAAE,6EAA6E;SAC3F;KACF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAiB;IACtD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,CAAC;IAEvD,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9F,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CACxB,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC,CAAC,0CAA0C;IAErE,IAAI,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5D,OAAO;QACL;YACE,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,sFAAsF;YAC/F,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC;YAC7C,WAAW,EACT,+DAA+D;gBAC/D,+EAA+E;gBAC/E,6EAA6E;SAChF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAiB;IACpD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,CAAC;IAEhG,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,sBAAsB,CAAC;IAEnD,qFAAqF;IACrF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAElD,OAAO;QACL;YACE,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,6BAA6B,QAAQ,CAAC,MAAM,yDAAyD;YAC9G,WAAW,EAAE,0EAA0E;SACxF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;AAE9D,SAAS,uBAAuB,CAAC,GAAiB;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAElE,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACpF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IACjF,IAAI,cAAc;QAAE,OAAO,EAAE,CAAC;IAE9B,OAAO;QACL;YACE,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,qGAAqG;YAC9G,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YACpD,WAAW,EACT,uJAAuJ;YACzJ,OAAO,EAAE,wCAAwC;SAClD;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,MAAM,iBAAiB,GAAG,uDAAuD,CAAC;AAClF,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpH,SAAS,yBAAyB,CAAC,YAAoB;IACrD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAiB;IAC5C,MAAM,eAAe,GAAG,iCAAiC,CAAC;IAC1D,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,yBAAyB,CAAC,YAAY,CAAC;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yCAAyC;gBAClD,QAAQ,EAAE,YAAY;gBACtB,WAAW,EACT,4GAA4G;aAC/G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAiB;IAClD,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,SAAS,GACb,SAAS,KAAK,IAAI;YAClB,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,EAAE;oBAAE,OAAO,KAAK,CAAC;gBAC5D,OAAO,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,CAAC;YAClG,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,OAAO,qEAAqE;gBACxF,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,OAAO,OAAO,2BAA2B;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAiB;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC;IACzC,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,IAAI,UAAU,CAAC,+BAA+B,CAAC;IAEjG,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEhD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,eAAe,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,SAAS,IAAI,eAAe,EAAE,CAAC;QACjC,OAAO;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,gEAAgE;gBACzE,WAAW,EACT,yGAAyG;aAC5G;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,OAAO;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,kEAAkE;gBAC3E,WAAW,EACT,uGAAuG;aAC1G;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAMD,MAAM,sBAAsB,GAAc;IACxC,yBAAyB;IACzB,mBAAmB;IACnB,yBAAyB;IACzB,gCAAgC;IAChC,uBAAuB;CACxB,CAAC;AAEF,MAAM,aAAa,GAAc;IAC/B,sBAAsB;IACtB,wBAAwB;IACxB,sBAAsB;IACtB,4BAA4B;IAC5B,2BAA2B;IAC3B,yBAAyB;CAC1B,CAAC;AAEF,MAAM,mBAAmB,GAAc;IACrC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;IAC3B,yBAAyB;IACzB,2BAA2B;CAC5B,CAAC;AAEF,MAAM,eAAe,GAAc;IACjC,6BAA6B;IAC7B,yBAAyB;IACzB,2BAA2B;CAC5B,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAsB,EACtB,SAAwB,EACxB,WAA4B,EAC5B,GAAY;IAEZ,MAAM,GAAG,GAAiB;QACxB,SAAS;QACT,WAAW;QACX,GAAG;QACH,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAc,CAAC,GAAG,sBAAsB,CAAC,CAAC;IAEtD,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,SAAS;YACZ,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,cAAc;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,gBAAgB;YACnB,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;YAChC,MAAM;IACV,CAAC;IAED,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import { existsSync, readFileSync, readdirSync } from 'node:fs';\nimport { join, relative } from 'node:path';\nimport type {\n  AuthPatternFinding,\n  AuthPatternInfo,\n  FrameworkInfo,\n  EnvironmentInfo,\n  SdkInfo,\n  DoctorOptions,\n} from '../types.js';\n\n// --- Helpers ---\n\n/** Return the first path that exists, or null */\nfunction findFile(paths: string[]): string | null {\n  for (const p of paths) {\n    if (existsSync(p)) return p;\n  }\n  return null;\n}\n\n/** Read file content safely, return null on any error */\nfunction readFileSafe(filePath: string): string | null {\n  try {\n    return readFileSync(filePath, 'utf-8');\n  } catch {\n    return null;\n  }\n}\n\n/** Test if a file exists and its content matches a regex */\nfunction fileContains(filePath: string, pattern: RegExp): boolean {\n  const content = readFileSafe(filePath);\n  if (!content) return false;\n  return pattern.test(content);\n}\n\nconst SKIP_DIRS = new Set(['node_modules', '.next', '.turbo', 'dist', '.git', 'coverage']);\n\n/**\n * Find files matching a name pattern in a directory tree, limited to maxDepth levels.\n * Skips node_modules, .next, dist, etc.\n */\nfunction findFilesShallow(dir: string, namePattern: RegExp, maxDepth = 3): string[] {\n  const results: string[] = [];\n  if (!existsSync(dir)) return results;\n\n  function walk(currentDir: string, depth: number) {\n    if (depth > maxDepth) return;\n    try {\n      const dirents = readdirSync(currentDir, { withFileTypes: true });\n      for (const dirent of dirents) {\n        const fullPath = join(currentDir, dirent.name);\n        if (dirent.isDirectory()) {\n          if (!SKIP_DIRS.has(dirent.name)) {\n            walk(fullPath, depth + 1);\n          }\n        } else if (dirent.isFile() && namePattern.test(dirent.name)) {\n          results.push(fullPath);\n        }\n      }\n    } catch {\n      // Directory unreadable\n    }\n  }\n\n  walk(dir, 0);\n  return results;\n}\n\nfunction parseEnvFile(content: string): Record<string, string> {\n  const result: Record<string, string> = {};\n  for (const line of content.split(/\\r?\\n/)) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const entry = trimmed.startsWith('export ') ? trimmed.slice(7) : trimmed;\n    const eqIndex = entry.indexOf('=');\n    if (eqIndex === -1) continue;\n    const key = entry.slice(0, eqIndex).trim();\n    let value = entry.slice(eqIndex + 1).trim();\n    if ((value.startsWith('\"') && value.endsWith('\"')) || (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1);\n    }\n    result[key] = value;\n  }\n  return result;\n}\n\n/** Load all env vars from .env and .env.local files */\nfunction loadProjectEnvRaw(installDir: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const file of ['.env', '.env.local']) {\n    const content = readFileSafe(join(installDir, file));\n    if (content) Object.assign(env, parseEnvFile(content));\n  }\n  return env;\n}\n\n// --- Check Context ---\n\ninterface CheckContext {\n  framework: FrameworkInfo;\n  environment: EnvironmentInfo;\n  sdk: SdkInfo;\n  installDir: string;\n}\n\n// --- Individual Checks ---\n\n/** Resolve the app directory root (app/ or src/app/) for Next.js */\nfunction resolveAppDir(installDir: string): string | null {\n  const srcApp = join(installDir, 'src', 'app');\n  if (existsSync(srcApp)) return srcApp;\n  const app = join(installDir, 'app');\n  if (existsSync(app)) return app;\n  return null;\n}\n\nfunction checkSignoutGetHandler(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'Next.js') return [];\n  const appDir = resolveAppDir(ctx.installDir);\n  if (!appDir) return [];\n\n  const routeFiles = findFilesShallow(appDir, /^route\\.(ts|tsx|js|jsx)$/);\n  const signoutRoutes = routeFiles.filter((f) => /[/\\\\](sign-?out|logout)[/\\\\]/.test(f));\n\n  const findings: AuthPatternFinding[] = [];\n  const GET_EXPORT = /export\\s+(async\\s+)?function\\s+GET|export\\s+const\\s+GET/;\n\n  for (const route of signoutRoutes) {\n    if (fileContains(route, GET_EXPORT)) {\n      findings.push({\n        code: 'SIGNOUT_GET_HANDLER',\n        severity: 'error',\n        message: 'Signout/logout route uses GET handler — vulnerable to CSRF and prefetch-triggered logouts',\n        filePath: relative(ctx.installDir, route),\n        remediation:\n          'Convert to a POST server action. GET routes with side effects are vulnerable to CSRF and will be triggered by Next.js link prefetching.',\n        docsUrl: 'https://workos.com/docs/authkit/sign-out',\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkSignoutLinkPrefetch(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'Next.js') return [];\n  const appDir = resolveAppDir(ctx.installDir);\n  if (!appDir) return [];\n\n  const tsxFiles = findFilesShallow(appDir, /\\.(tsx|jsx)$/);\n  // Match <Link>, <NextLink>, or other common aliases\n  const LINK_PATTERN = /<(?:Next)?Link\\s[^>]*href\\s*=\\s*[\"'{`/]*(\\/sign-?out|\\/logout)/;\n\n  const findings: AuthPatternFinding[] = [];\n  for (const file of tsxFiles) {\n    if (fileContains(file, LINK_PATTERN)) {\n      findings.push({\n        code: 'SIGNOUT_LINK_PREFETCH',\n        severity: 'warning',\n        message:\n          'Link component points to signout/logout — Next.js will prefetch this in production, potentially triggering logouts',\n        filePath: relative(ctx.installDir, file),\n        remediation:\n          'Use a <form> with a server action or <button> with onClick handler instead of <Link> for signout.',\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkMissingMiddleware(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'Next.js') return [];\n\n  const middlewarePaths = [\n    'middleware.ts',\n    'middleware.js',\n    'proxy.ts',\n    'proxy.js',\n    'src/middleware.ts',\n    'src/middleware.js',\n    'src/proxy.ts',\n    'src/proxy.js',\n  ].map((p) => join(ctx.installDir, p));\n\n  if (findFile(middlewarePaths)) return [];\n\n  return [\n    {\n      code: 'MISSING_MIDDLEWARE',\n      severity: 'error',\n      message: 'No middleware.ts or proxy.ts found — AuthKit session handling requires middleware',\n      remediation: 'Create middleware.ts at the project root with authkitMiddleware() from @workos-inc/authkit-nextjs.',\n      docsUrl: 'https://workos.com/docs/authkit/nextjs/middleware',\n    },\n  ];\n}\n\nfunction checkMiddlewareWrongLocation(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'Next.js') return [];\n\n  const wrongPaths = ['app/middleware.ts', 'app/middleware.js', 'src/app/middleware.ts', 'src/app/middleware.js'].map(\n    (p) => join(ctx.installDir, p),\n  );\n\n  const found = findFile(wrongPaths);\n  if (!found) return [];\n\n  return [\n    {\n      code: 'MIDDLEWARE_WRONG_LOCATION',\n      severity: 'warning',\n      message: 'middleware.ts found inside app/ directory — must be at project root or src/',\n      filePath: relative(ctx.installDir, found),\n      remediation: 'Move middleware.ts to the project root (or src/ if using src/ directory).',\n      docsUrl: 'https://workos.com/docs/authkit/nextjs/middleware',\n    },\n  ];\n}\n\nfunction checkMissingAuthKitProvider(ctx: CheckContext): AuthPatternFinding[] {\n  const layoutPaths: string[] = [];\n\n  if (ctx.framework.name === 'Next.js') {\n    layoutPaths.push(\n      join(ctx.installDir, 'app', 'layout.tsx'),\n      join(ctx.installDir, 'app', 'layout.jsx'),\n      join(ctx.installDir, 'src', 'app', 'layout.tsx'),\n      join(ctx.installDir, 'src', 'app', 'layout.jsx'),\n    );\n  } else if (ctx.framework.name === 'React Router' && ctx.framework.variant === 'declarative') {\n    layoutPaths.push(\n      join(ctx.installDir, 'src', 'App.tsx'),\n      join(ctx.installDir, 'src', 'App.jsx'),\n      join(ctx.installDir, 'app', 'root.tsx'),\n      join(ctx.installDir, 'app', 'root.jsx'),\n    );\n  } else {\n    return [];\n  }\n\n  const layoutFile = findFile(layoutPaths);\n  if (!layoutFile) return []; // Can't check if layout doesn't exist\n\n  if (fileContains(layoutFile, /AuthKitProvider/)) return [];\n\n  return [\n    {\n      code: 'MISSING_AUTHKIT_PROVIDER',\n      severity: 'warning',\n      message: 'AuthKitProvider not found in root layout — required for AuthKit session management',\n      filePath: relative(ctx.installDir, layoutFile),\n      remediation: 'Wrap your app with <AuthKitProvider> in the root layout.',\n      docsUrl: 'https://workos.com/docs/authkit/nextjs/setup',\n    },\n  ];\n}\n\n/** Extract callback path from redirect URI env vars or framework default */\nfunction resolveCallbackPath(ctx: CheckContext): string | null {\n  // Check env vars for actual redirect URI (including NEXT_PUBLIC_ variant)\n  const projectEnv = loadProjectEnvRaw(ctx.installDir);\n  const redirectUri =\n    projectEnv.WORKOS_REDIRECT_URI ?? projectEnv.NEXT_PUBLIC_WORKOS_REDIRECT_URI ?? ctx.environment.redirectUri;\n\n  if (redirectUri) {\n    try {\n      return new URL(redirectUri).pathname;\n    } catch {\n      // Invalid URL, fall through to framework default\n    }\n  }\n\n  return ctx.framework.expectedCallbackPath ?? null;\n}\n\nfunction checkCallbackRouteMissing(ctx: CheckContext): AuthPatternFinding[] {\n  const callbackPath = resolveCallbackPath(ctx);\n  if (!callbackPath) return [];\n\n  // Build expected route file paths based on framework\n  const possiblePaths: string[] = [];\n\n  if (ctx.framework.name === 'Next.js') {\n    // app/auth/callback/route.ts (or src/app/)\n    const routeDir = callbackPath.replace(/^\\//, ''); // 'auth/callback'\n    for (const prefix of ['app', 'src/app']) {\n      for (const ext of ['ts', 'tsx', 'js', 'jsx']) {\n        possiblePaths.push(join(ctx.installDir, prefix, routeDir, `route.${ext}`));\n      }\n    }\n  } else if (ctx.framework.name === 'React Router') {\n    // Flat: app/routes/auth.callback.tsx  Nested: app/routes/auth/callback.tsx\n    const segments = callbackPath.replace(/^\\//, '').split('/');\n    const flat = segments.join('.');\n    const nested = segments.join('/');\n    for (const ext of ['tsx', 'jsx', 'ts', 'js']) {\n      possiblePaths.push(join(ctx.installDir, 'app', 'routes', `${flat}.${ext}`));\n      possiblePaths.push(join(ctx.installDir, 'app', 'routes', nested + `.${ext}`));\n    }\n  } else if (ctx.framework.name === 'TanStack Start') {\n    // Flat: routes/api.auth.callback.tsx  Nested: routes/api/auth/callback.tsx\n    // Both conventions work in both src/ and app/ directories\n    const segments = callbackPath.replace(/^\\//, '').split('/');\n    const flat = segments.join('.');\n    const nested = segments.join('/');\n    for (const prefix of ['src', 'app']) {\n      for (const ext of ['tsx', 'jsx', 'ts', 'js']) {\n        possiblePaths.push(join(ctx.installDir, prefix, 'routes', `${flat}.${ext}`));\n        possiblePaths.push(join(ctx.installDir, prefix, 'routes', nested + `.${ext}`));\n      }\n    }\n  }\n\n  if (possiblePaths.length === 0) return [];\n  if (findFile(possiblePaths)) return [];\n\n  return [\n    {\n      code: 'CALLBACK_ROUTE_MISSING',\n      severity: 'error',\n      message: `No callback route found at expected path ${callbackPath}`,\n      remediation: `Create the callback route handler at the path matching your WORKOS_REDIRECT_URI.`,\n      docsUrl: 'https://workos.com/docs/authkit/redirect-uri',\n    },\n  ];\n}\n\nconst CLIENT_ENV_PREFIXES = ['NEXT_PUBLIC_', 'VITE_', 'REACT_APP_', 'EXPO_PUBLIC_'];\n\nfunction checkApiKeyLeakedToClient(ctx: CheckContext): AuthPatternFinding[] {\n  const projectEnv = loadProjectEnvRaw(ctx.installDir);\n  const findings: AuthPatternFinding[] = [];\n\n  for (const [key, value] of Object.entries(projectEnv)) {\n    const hasClientPrefix = CLIENT_ENV_PREFIXES.some((prefix) => key.startsWith(prefix));\n    if (!hasClientPrefix) continue;\n\n    const isApiKey = key.includes('WORKOS_API_KEY');\n    const isSecretValue = value?.startsWith('sk_test_') || value?.startsWith('sk_live_');\n\n    if (isApiKey || isSecretValue) {\n      findings.push({\n        code: 'API_KEY_LEAKED_TO_CLIENT',\n        severity: 'error',\n        message: `Secret API key exposed via client-accessible env var ${key}`,\n        remediation: `Remove the client prefix. WORKOS_API_KEY must be server-only (no NEXT_PUBLIC_, VITE_, REACT_APP_, or EXPO_PUBLIC_ prefix).`,\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkWrongCallbackLoader(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'React Router') return [];\n  const callbackPath = ctx.framework.expectedCallbackPath;\n  if (!callbackPath) return [];\n\n  const segments = callbackPath.replace(/^\\//, '').split('/');\n  const flat = segments.join('.');\n  const nested = segments.join('/');\n\n  const possiblePaths: string[] = [];\n  for (const ext of ['tsx', 'jsx', 'ts', 'js']) {\n    possiblePaths.push(join(ctx.installDir, 'app', 'routes', `${flat}.${ext}`));\n    possiblePaths.push(join(ctx.installDir, 'app', 'routes', nested + `.${ext}`));\n  }\n\n  const callbackFile = findFile(possiblePaths);\n  if (!callbackFile) return []; // No callback route to check\n\n  // authkitLoader is for regular routes; authLoader is for the callback\n  if (fileContains(callbackFile, /authkitLoader/) && !fileContains(callbackFile, /authLoader/)) {\n    return [\n      {\n        code: 'WRONG_CALLBACK_LOADER',\n        severity: 'warning',\n        message: 'Callback route uses authkitLoader instead of authLoader',\n        filePath: relative(ctx.installDir, callbackFile),\n        remediation:\n          'Use authLoader (not authkitLoader) for the callback route. authkitLoader is for regular routes that need auth context.',\n      },\n    ];\n  }\n  return [];\n}\n\nfunction checkMissingRootAuthLoader(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'React Router') return [];\n\n  const rootPaths = ['app/root.tsx', 'app/root.jsx', 'app/routes/_index.tsx', 'app/routes/_index.jsx'].map((p) =>\n    join(ctx.installDir, p),\n  );\n\n  const rootFile = findFile(rootPaths);\n  if (!rootFile) return [];\n\n  if (fileContains(rootFile, /authkitLoader/)) return [];\n\n  return [\n    {\n      code: 'MISSING_ROOT_AUTH_LOADER',\n      severity: 'warning',\n      message: 'Root route does not use authkitLoader — child routes will not have auth context',\n      filePath: relative(ctx.installDir, rootFile),\n      remediation: 'Add authkitLoader to your root route so child routes can access auth state.',\n    },\n  ];\n}\n\nfunction checkMissingAuthkitMiddleware(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'TanStack Start') return [];\n\n  const startPaths = ['src/start.ts', 'src/start.tsx', 'app/start.ts', 'app/start.tsx'].map((p) =>\n    join(ctx.installDir, p),\n  );\n\n  const startFile = findFile(startPaths);\n  if (!startFile) return []; // Can't check if start file doesn't exist\n\n  if (fileContains(startFile, /authkitMiddleware/)) return [];\n\n  return [\n    {\n      code: 'MISSING_AUTHKIT_MIDDLEWARE',\n      severity: 'warning',\n      message: 'start.ts does not reference authkitMiddleware — AuthKit session handling requires it',\n      filePath: relative(ctx.installDir, startFile),\n      remediation:\n        'Add authkitMiddleware to requestMiddleware in src/start.ts:\\n' +\n        '  import { authkitMiddleware } from \"@workos/authkit-tanstack-react-start\";\\n' +\n        '  export default createStart({ requestMiddleware: [authkitMiddleware()] });',\n    },\n  ];\n}\n\nfunction checkCookiePasswordTooShort(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'React Router' && ctx.framework.name !== 'TanStack Start') return [];\n\n  const projectEnv = loadProjectEnvRaw(ctx.installDir);\n  const password = projectEnv.WORKOS_COOKIE_PASSWORD;\n\n  // Only warn if password is set but too short; missing password is a separate concern\n  if (!password || password.length >= 32) return [];\n\n  return [\n    {\n      code: 'COOKIE_PASSWORD_TOO_SHORT',\n      severity: 'warning',\n      message: `WORKOS_COOKIE_PASSWORD is ${password.length} characters — minimum 32 required for secure encryption`,\n      remediation: 'Set WORKOS_COOKIE_PASSWORD to a random string of at least 32 characters.',\n    },\n  ];\n}\n\nconst REACT_SPA_SDKS = new Set(['@workos-inc/authkit-react']);\n\nfunction checkMissingApiHostname(ctx: CheckContext): AuthPatternFinding[] {\n  if (!ctx.sdk.name || !REACT_SPA_SDKS.has(ctx.sdk.name)) return [];\n\n  const sourceFiles = findFilesShallow(ctx.installDir, /\\.(tsx|jsx|ts|js)$/, 4);\n  const providerFiles = sourceFiles.filter((f) => fileContains(f, /AuthKitProvider/));\n  if (providerFiles.length === 0) return [];\n\n  const hasApiHostname = providerFiles.some((f) => fileContains(f, /apiHostname/));\n  if (hasApiHostname) return [];\n\n  return [\n    {\n      code: 'MISSING_API_HOSTNAME',\n      severity: 'warning',\n      message: 'AuthKitProvider does not specify apiHostname — authorize requests will route through api.workos.com',\n      filePath: relative(ctx.installDir, providerFiles[0]),\n      remediation:\n        'Set the apiHostname prop on AuthKitProvider to your custom Authentication API domain (e.g. auth.example.com) to avoid routing through api.workos.com.',\n      docsUrl: 'https://workos.com/docs/custom-domains',\n    },\n  ];\n}\n\n// --- Cross-language checks (run for ALL projects, not just JS/AuthKit) ---\n\nconst SOURCE_EXTENSIONS = /\\.(ts|tsx|js|jsx|py|rb|go|java|kt|php|cs|swift|dart)$/;\nconst SECRET_SOURCE_IGNORED_SEGMENTS = new Set(['__fixtures__', '__tests__', 'evals', 'fixtures', 'test', 'tests']);\n\nfunction isIgnoredSecretSourcePath(relativePath: string): boolean {\n  const normalized = relativePath.replace(/\\\\/g, '/');\n  const parts = normalized.split('/');\n  if (parts.some((part) => SECRET_SOURCE_IGNORED_SEGMENTS.has(part))) return true;\n  return /\\.(spec|test)\\.[^.]+$/.test(normalized);\n}\n\nfunction checkApiKeyInSource(ctx: CheckContext): AuthPatternFinding[] {\n  const API_KEY_PATTERN = /sk_(test|live)_[A-Za-z0-9]{10,}/;\n  const sourceFiles = findFilesShallow(ctx.installDir, SOURCE_EXTENSIONS, 4);\n  const findings: AuthPatternFinding[] = [];\n\n  for (const file of sourceFiles) {\n    const relativePath = relative(ctx.installDir, file);\n    if (isIgnoredSecretSourcePath(relativePath)) continue;\n    const content = readFileSafe(file);\n    if (!content) continue;\n    if (API_KEY_PATTERN.test(content)) {\n      findings.push({\n        code: 'API_KEY_IN_SOURCE',\n        severity: 'error',\n        message: `WorkOS API key hardcoded in source file`,\n        filePath: relativePath,\n        remediation:\n          'Move the API key to an environment variable (WORKOS_API_KEY) and load it from .env or your secret manager.',\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkEnvFileNotGitignored(ctx: CheckContext): AuthPatternFinding[] {\n  const envFiles = ['.env', '.env.local'].filter((f) => existsSync(join(ctx.installDir, f)));\n  if (envFiles.length === 0) return [];\n\n  const gitignorePath = join(ctx.installDir, '.gitignore');\n  const gitignore = readFileSafe(gitignorePath);\n\n  const findings: AuthPatternFinding[] = [];\n  for (const envFile of envFiles) {\n    const isIgnored =\n      gitignore !== null &&\n      gitignore.split(/\\r?\\n/).some((line) => {\n        const trimmed = line.trim();\n        if (trimmed.startsWith('#') || trimmed === '') return false;\n        return trimmed === envFile || trimmed === '.env*' || trimmed === '.env.*' || trimmed === '.env';\n      });\n\n    if (!isIgnored) {\n      findings.push({\n        code: 'ENV_FILE_NOT_GITIGNORED',\n        severity: 'warning',\n        message: `${envFile} is not in .gitignore — secrets may be committed to version control`,\n        filePath: envFile,\n        remediation: `Add ${envFile} to your .gitignore file.`,\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkMixedEnvironmentCredentials(ctx: CheckContext): AuthPatternFinding[] {\n  const projectEnv = loadProjectEnvRaw(ctx.installDir);\n  const apiKey = projectEnv.WORKOS_API_KEY;\n  const redirectUri = projectEnv.WORKOS_REDIRECT_URI ?? projectEnv.NEXT_PUBLIC_WORKOS_REDIRECT_URI;\n\n  if (!apiKey || !redirectUri) return [];\n\n  const isTestKey = apiKey.startsWith('sk_test_');\n  const isLiveKey = apiKey.startsWith('sk_live_');\n\n  let isProductionUri = false;\n  try {\n    const url = new URL(redirectUri);\n    isProductionUri = url.hostname !== 'localhost' && !url.hostname.startsWith('127.0.0.');\n  } catch {\n    return [];\n  }\n\n  if (isTestKey && isProductionUri) {\n    return [\n      {\n        code: 'MIXED_ENVIRONMENT',\n        severity: 'warning',\n        message: 'Staging API key (sk_test_) used with a production redirect URI',\n        remediation:\n          'Use sk_live_ API key for production redirect URIs, or change the redirect URI to localhost for staging.',\n      },\n    ];\n  }\n\n  if (isLiveKey && !isProductionUri) {\n    return [\n      {\n        code: 'MIXED_ENVIRONMENT',\n        severity: 'warning',\n        message: 'Production API key (sk_live_) used with a localhost redirect URI',\n        remediation:\n          'Use sk_test_ API key for localhost development, or update the redirect URI to your production domain.',\n      },\n    ];\n  }\n\n  return [];\n}\n\n// --- Main Entry Point ---\n\ntype CheckFn = (ctx: CheckContext) => AuthPatternFinding[];\n\nconst CROSS_FRAMEWORK_CHECKS: CheckFn[] = [\n  checkApiKeyLeakedToClient,\n  checkApiKeyInSource,\n  checkEnvFileNotGitignored,\n  checkMixedEnvironmentCredentials,\n  checkMissingApiHostname,\n];\n\nconst NEXTJS_CHECKS: CheckFn[] = [\n  checkSignoutGetHandler,\n  checkSignoutLinkPrefetch,\n  checkMissingMiddleware,\n  checkMiddlewareWrongLocation,\n  checkMissingAuthKitProvider,\n  checkCallbackRouteMissing,\n];\n\nconst REACT_ROUTER_CHECKS: CheckFn[] = [\n  checkWrongCallbackLoader,\n  checkMissingRootAuthLoader,\n  checkMissingAuthKitProvider,\n  checkCallbackRouteMissing,\n  checkCookiePasswordTooShort,\n];\n\nconst TANSTACK_CHECKS: CheckFn[] = [\n  checkMissingAuthkitMiddleware,\n  checkCallbackRouteMissing,\n  checkCookiePasswordTooShort,\n];\n\nexport async function checkAuthPatterns(\n  options: DoctorOptions,\n  framework: FrameworkInfo,\n  environment: EnvironmentInfo,\n  sdk: SdkInfo,\n): Promise<AuthPatternInfo> {\n  const ctx: CheckContext = {\n    framework,\n    environment,\n    sdk,\n    installDir: options.installDir,\n  };\n\n  const checks: CheckFn[] = [...CROSS_FRAMEWORK_CHECKS];\n\n  switch (framework.name) {\n    case 'Next.js':\n      checks.push(...NEXTJS_CHECKS);\n      break;\n    case 'React Router':\n      checks.push(...REACT_ROUTER_CHECKS);\n      break;\n    case 'TanStack Start':\n      checks.push(...TANSTACK_CHECKS);\n      break;\n  }\n\n  const findings: AuthPatternFinding[] = [];\n  for (const check of checks) {\n    findings.push(...check(ctx));\n  }\n\n  return {\n    checksRun: checks.length,\n    findings,\n  };\n}\n"]}
+{"version":3,"file":"auth-patterns.js","sourceRoot":"","sources":["../../../src/doctor/checks/auth-patterns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAU3C,kBAAkB;AAElB,iDAAiD;AACjD,SAAS,QAAQ,CAAC,KAAe;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAE3F;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,WAAmB,EAAE,QAAQ,GAAG,CAAC;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAErC,SAAS,IAAI,CAAC,UAAkB,EAAE,KAAa;QAC7C,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;oBACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;qBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACb,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AACvD,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,4BAA4B;AAE5B,oEAAoE;AACpE,SAAS,aAAa,CAAC,UAAkB;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAiB;IAC/C,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,yDAAyD,CAAC;IAE7E,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,2FAA2F;gBACpG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;gBACzC,WAAW,EACT,yIAAyI;gBAC3I,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAiB;IACjD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1D,oDAAoD;IACpD,MAAM,YAAY,GAAG,gEAAgE,CAAC;IAEtF,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,oHAAoH;gBACtH,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC;gBACxC,WAAW,EACT,mGAAmG;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAiB;IAC/C,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEhD,MAAM,eAAe,GAAG;QACtB,eAAe;QACf,eAAe;QACf,UAAU;QACV,UAAU;QACV,mBAAmB;QACnB,mBAAmB;QACnB,cAAc;QACd,cAAc;KACf,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,OAAO;QACL;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EAAE,oGAAoG;YACjH,OAAO,EAAE,mDAAmD;SAC7D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAiB;IACrD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEhD,MAAM,UAAU,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,GAAG,CACjH,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAC/B,CAAC;IAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,OAAO;QACL;YACE,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,6EAA6E;YACtF,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;YACzC,WAAW,EAAE,2EAA2E;YACxF,OAAO,EAAE,mDAAmD;SAC7D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAiB;IACpD,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,WAAW,CAAC,IAAI,CACd,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,CAAC,EACzC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,CAAC,EACzC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,EAChD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CACjD,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAC5F,WAAW,CAAC,IAAI,CACd,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,EACtC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,EACtC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,EACvC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CACxC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC,CAAC,sCAAsC;IAElE,IAAI,YAAY,CAAC,UAAU,EAAE,iBAAiB,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3D,OAAO;QACL;YACE,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,oFAAoF;YAC7F,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC;YAC9C,WAAW,EAAE,0DAA0D;YACvE,OAAO,EAAE,8CAA8C;SACxD;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,mBAAmB,CAAC,GAAiB;IAC5C,0EAA0E;IAC1E,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,WAAW,GACf,UAAU,CAAC,mBAAmB,IAAI,UAAU,CAAC,+BAA+B,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC;IAE9G,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI,CAAC;AACpD,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAiB;IAClD,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,qDAAqD;IACrD,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB;QACpE,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjD,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACnD,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,OAAO;QACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,4CAA4C,YAAY,EAAE;YACnE,WAAW,EAAE,kFAAkF;YAC/F,OAAO,EAAE,8CAA8C;SACxD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAEpF,SAAS,yBAAyB,CAAC,GAAiB;IAClD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,eAAe;YAAE,SAAS;QAE/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAErF,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,wDAAwD,GAAG,EAAE;gBACtE,WAAW,EAAE,4HAA4H;aAC1I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAiB;IACjD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC;IACxD,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC,CAAC,6BAA6B;IAE3D,sEAAsE;IACtE,IAAI,YAAY,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO;YACL;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,yDAAyD;gBAClE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;gBAChD,WAAW,EACT,wHAAwH;aAC3H;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAiB;IACnD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,CAAC;IAErD,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7G,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CACxB,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,IAAI,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvD,OAAO;QACL;YACE,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,iFAAiF;YAC1F,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;YAC5C,WAAW,EAAE,6EAA6E;SAC3F;KACF,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAiB;IACtD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,CAAC;IAEvD,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9F,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CACxB,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC,CAAC,0CAA0C;IAErE,IAAI,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5D,OAAO;QACL;YACE,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,sFAAsF;YAC/F,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC;YAC7C,WAAW,EACT,+DAA+D;gBAC/D,+EAA+E;gBAC/E,6EAA6E;SAChF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAiB;IACpD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,CAAC;IAEhG,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,sBAAsB,CAAC;IAEnD,qFAAqF;IACrF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAElD,OAAO;QACL;YACE,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,6BAA6B,QAAQ,CAAC,MAAM,yDAAyD;YAC9G,WAAW,EAAE,0EAA0E;SACxF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;AAE9D,SAAS,uBAAuB,CAAC,GAAiB;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAElE,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACpF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IACjF,IAAI,cAAc;QAAE,OAAO,EAAE,CAAC;IAE9B,OAAO;QACL;YACE,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,qGAAqG;YAC9G,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YACpD,WAAW,EACT,uJAAuJ;YACzJ,OAAO,EAAE,wCAAwC;SAClD;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,MAAM,iBAAiB,GAAG,uDAAuD,CAAC;AAClF,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpH,SAAS,yBAAyB,CAAC,YAAoB;IACrD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAiB;IAC5C,MAAM,eAAe,GAAG,iCAAiC,CAAC;IAC1D,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,yBAAyB,CAAC,YAAY,CAAC;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yCAAyC;gBAClD,QAAQ,EAAE,YAAY;gBACtB,WAAW,EACT,4GAA4G;aAC/G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAiB;IAClD,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,SAAS,GACb,SAAS,KAAK,IAAI;YAClB,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,EAAE;oBAAE,OAAO,KAAK,CAAC;gBAC5D,OAAO,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,CAAC;YAClG,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,OAAO,qEAAqE;gBACxF,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,OAAO,OAAO,2BAA2B;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAiB;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC;IACzC,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,IAAI,UAAU,CAAC,+BAA+B,CAAC;IAEjG,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEhD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,eAAe,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,SAAS,IAAI,eAAe,EAAE,CAAC;QACjC,OAAO;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,gEAAgE;gBACzE,WAAW,EACT,yGAAyG;aAC5G;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,OAAO;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,kEAAkE;gBAC3E,WAAW,EACT,uGAAuG;aAC1G;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAMD,MAAM,sBAAsB,GAAc;IACxC,yBAAyB;IACzB,mBAAmB;IACnB,yBAAyB;IACzB,gCAAgC;IAChC,uBAAuB;CACxB,CAAC;AAEF,MAAM,aAAa,GAAc;IAC/B,sBAAsB;IACtB,wBAAwB;IACxB,sBAAsB;IACtB,4BAA4B;IAC5B,2BAA2B;IAC3B,yBAAyB;CAC1B,CAAC;AAEF,MAAM,mBAAmB,GAAc;IACrC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;IAC3B,yBAAyB;IACzB,2BAA2B;CAC5B,CAAC;AAEF,MAAM,eAAe,GAAc;IACjC,6BAA6B;IAC7B,yBAAyB;IACzB,2BAA2B;CAC5B,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAsB,EACtB,SAAwB,EACxB,WAA4B,EAC5B,GAAY;IAEZ,MAAM,GAAG,GAAiB;QACxB,SAAS;QACT,WAAW;QACX,GAAG;QACH,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAc,CAAC,GAAG,sBAAsB,CAAC,CAAC;IAEtD,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,SAAS;YACZ,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,cAAc;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,gBAAgB;YACnB,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;YAChC,MAAM;IACV,CAAC;IAED,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import { existsSync, readFileSync, readdirSync } from 'node:fs';\nimport { join, relative } from 'node:path';\nimport type {\n  AuthPatternFinding,\n  AuthPatternInfo,\n  FrameworkInfo,\n  EnvironmentInfo,\n  SdkInfo,\n  DoctorOptions,\n} from '../types.js';\n\n// --- Helpers ---\n\n/** Return the first path that exists, or null */\nfunction findFile(paths: string[]): string | null {\n  for (const p of paths) {\n    if (existsSync(p)) return p;\n  }\n  return null;\n}\n\n/** Read file content safely, return null on any error */\nfunction readFileSafe(filePath: string): string | null {\n  try {\n    return readFileSync(filePath, 'utf-8');\n  } catch {\n    return null;\n  }\n}\n\n/** Test if a file exists and its content matches a regex */\nfunction fileContains(filePath: string, pattern: RegExp): boolean {\n  const content = readFileSafe(filePath);\n  if (!content) return false;\n  return pattern.test(content);\n}\n\nconst SKIP_DIRS = new Set(['node_modules', '.next', '.turbo', 'dist', '.git', 'coverage']);\n\n/**\n * Find files matching a name pattern in a directory tree, limited to maxDepth levels.\n * Skips node_modules, .next, dist, etc.\n */\nfunction findFilesShallow(dir: string, namePattern: RegExp, maxDepth = 3): string[] {\n  const results: string[] = [];\n  if (!existsSync(dir)) return results;\n\n  function walk(currentDir: string, depth: number) {\n    if (depth > maxDepth) return;\n    try {\n      const dirents = readdirSync(currentDir, { withFileTypes: true });\n      for (const dirent of dirents) {\n        const fullPath = join(currentDir, dirent.name);\n        if (dirent.isDirectory()) {\n          if (!SKIP_DIRS.has(dirent.name)) {\n            walk(fullPath, depth + 1);\n          }\n        } else if (dirent.isFile() && namePattern.test(dirent.name)) {\n          results.push(fullPath);\n        }\n      }\n    } catch {\n      // Directory unreadable\n    }\n  }\n\n  walk(dir, 0);\n  return results;\n}\n\nfunction parseEnvFile(content: string): Record<string, string> {\n  const result: Record<string, string> = {};\n  for (const line of content.split(/\\r?\\n/)) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const entry = trimmed.startsWith('export ') ? trimmed.slice(7) : trimmed;\n    const eqIndex = entry.indexOf('=');\n    if (eqIndex === -1) continue;\n    const key = entry.slice(0, eqIndex).trim();\n    let value = entry.slice(eqIndex + 1).trim();\n    if ((value.startsWith('\"') && value.endsWith('\"')) || (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1);\n    }\n    result[key] = value;\n  }\n  return result;\n}\n\n/** Load all env vars from .env and .env.local files */\nfunction loadProjectEnvRaw(installDir: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const file of ['.env', '.env.local']) {\n    const content = readFileSafe(join(installDir, file));\n    if (content) Object.assign(env, parseEnvFile(content));\n  }\n  return env;\n}\n\n// --- Check Context ---\n\ninterface CheckContext {\n  framework: FrameworkInfo;\n  environment: EnvironmentInfo;\n  sdk: SdkInfo;\n  installDir: string;\n}\n\n// --- Individual Checks ---\n\n/** Resolve the app directory root (app/ or src/app/) for Next.js */\nfunction resolveAppDir(installDir: string): string | null {\n  const srcApp = join(installDir, 'src', 'app');\n  if (existsSync(srcApp)) return srcApp;\n  const app = join(installDir, 'app');\n  if (existsSync(app)) return app;\n  return null;\n}\n\nfunction checkSignoutGetHandler(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'Next.js') return [];\n  const appDir = resolveAppDir(ctx.installDir);\n  if (!appDir) return [];\n\n  const routeFiles = findFilesShallow(appDir, /^route\\.(ts|tsx|js|jsx)$/);\n  const signoutRoutes = routeFiles.filter((f) => /[/\\\\](sign-?out|logout)[/\\\\]/.test(f));\n\n  const findings: AuthPatternFinding[] = [];\n  const GET_EXPORT = /export\\s+(async\\s+)?function\\s+GET|export\\s+const\\s+GET/;\n\n  for (const route of signoutRoutes) {\n    if (fileContains(route, GET_EXPORT)) {\n      findings.push({\n        code: 'SIGNOUT_GET_HANDLER',\n        severity: 'error',\n        message: 'Signout/logout route uses GET handler — vulnerable to CSRF and prefetch-triggered logouts',\n        filePath: relative(ctx.installDir, route),\n        remediation:\n          'Convert to a POST server action. GET routes with side effects are vulnerable to CSRF and will be triggered by Next.js link prefetching.',\n        docsUrl: 'https://workos.com/docs/authkit/nextjs#ending-the-session',\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkSignoutLinkPrefetch(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'Next.js') return [];\n  const appDir = resolveAppDir(ctx.installDir);\n  if (!appDir) return [];\n\n  const tsxFiles = findFilesShallow(appDir, /\\.(tsx|jsx)$/);\n  // Match <Link>, <NextLink>, or other common aliases\n  const LINK_PATTERN = /<(?:Next)?Link\\s[^>]*href\\s*=\\s*[\"'{`/]*(\\/sign-?out|\\/logout)/;\n\n  const findings: AuthPatternFinding[] = [];\n  for (const file of tsxFiles) {\n    if (fileContains(file, LINK_PATTERN)) {\n      findings.push({\n        code: 'SIGNOUT_LINK_PREFETCH',\n        severity: 'warning',\n        message:\n          'Link component points to signout/logout — Next.js will prefetch this in production, potentially triggering logouts',\n        filePath: relative(ctx.installDir, file),\n        remediation:\n          'Use a <form> with a server action or <button> with onClick handler instead of <Link> for signout.',\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkMissingMiddleware(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'Next.js') return [];\n\n  const middlewarePaths = [\n    'middleware.ts',\n    'middleware.js',\n    'proxy.ts',\n    'proxy.js',\n    'src/middleware.ts',\n    'src/middleware.js',\n    'src/proxy.ts',\n    'src/proxy.js',\n  ].map((p) => join(ctx.installDir, p));\n\n  if (findFile(middlewarePaths)) return [];\n\n  return [\n    {\n      code: 'MISSING_MIDDLEWARE',\n      severity: 'error',\n      message: 'No middleware.ts or proxy.ts found — AuthKit session handling requires middleware',\n      remediation: 'Create middleware.ts at the project root with authkitMiddleware() from @workos-inc/authkit-nextjs.',\n      docsUrl: 'https://workos.com/docs/authkit/nextjs/middleware',\n    },\n  ];\n}\n\nfunction checkMiddlewareWrongLocation(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'Next.js') return [];\n\n  const wrongPaths = ['app/middleware.ts', 'app/middleware.js', 'src/app/middleware.ts', 'src/app/middleware.js'].map(\n    (p) => join(ctx.installDir, p),\n  );\n\n  const found = findFile(wrongPaths);\n  if (!found) return [];\n\n  return [\n    {\n      code: 'MIDDLEWARE_WRONG_LOCATION',\n      severity: 'warning',\n      message: 'middleware.ts found inside app/ directory — must be at project root or src/',\n      filePath: relative(ctx.installDir, found),\n      remediation: 'Move middleware.ts to the project root (or src/ if using src/ directory).',\n      docsUrl: 'https://workos.com/docs/authkit/nextjs/middleware',\n    },\n  ];\n}\n\nfunction checkMissingAuthKitProvider(ctx: CheckContext): AuthPatternFinding[] {\n  const layoutPaths: string[] = [];\n\n  if (ctx.framework.name === 'Next.js') {\n    layoutPaths.push(\n      join(ctx.installDir, 'app', 'layout.tsx'),\n      join(ctx.installDir, 'app', 'layout.jsx'),\n      join(ctx.installDir, 'src', 'app', 'layout.tsx'),\n      join(ctx.installDir, 'src', 'app', 'layout.jsx'),\n    );\n  } else if (ctx.framework.name === 'React Router' && ctx.framework.variant === 'declarative') {\n    layoutPaths.push(\n      join(ctx.installDir, 'src', 'App.tsx'),\n      join(ctx.installDir, 'src', 'App.jsx'),\n      join(ctx.installDir, 'app', 'root.tsx'),\n      join(ctx.installDir, 'app', 'root.jsx'),\n    );\n  } else {\n    return [];\n  }\n\n  const layoutFile = findFile(layoutPaths);\n  if (!layoutFile) return []; // Can't check if layout doesn't exist\n\n  if (fileContains(layoutFile, /AuthKitProvider/)) return [];\n\n  return [\n    {\n      code: 'MISSING_AUTHKIT_PROVIDER',\n      severity: 'warning',\n      message: 'AuthKitProvider not found in root layout — required for AuthKit session management',\n      filePath: relative(ctx.installDir, layoutFile),\n      remediation: 'Wrap your app with <AuthKitProvider> in the root layout.',\n      docsUrl: 'https://workos.com/docs/authkit/nextjs/setup',\n    },\n  ];\n}\n\n/** Extract callback path from redirect URI env vars or framework default */\nfunction resolveCallbackPath(ctx: CheckContext): string | null {\n  // Check env vars for actual redirect URI (including NEXT_PUBLIC_ variant)\n  const projectEnv = loadProjectEnvRaw(ctx.installDir);\n  const redirectUri =\n    projectEnv.WORKOS_REDIRECT_URI ?? projectEnv.NEXT_PUBLIC_WORKOS_REDIRECT_URI ?? ctx.environment.redirectUri;\n\n  if (redirectUri) {\n    try {\n      return new URL(redirectUri).pathname;\n    } catch {\n      // Invalid URL, fall through to framework default\n    }\n  }\n\n  return ctx.framework.expectedCallbackPath ?? null;\n}\n\nfunction checkCallbackRouteMissing(ctx: CheckContext): AuthPatternFinding[] {\n  const callbackPath = resolveCallbackPath(ctx);\n  if (!callbackPath) return [];\n\n  // Build expected route file paths based on framework\n  const possiblePaths: string[] = [];\n\n  if (ctx.framework.name === 'Next.js') {\n    // app/auth/callback/route.ts (or src/app/)\n    const routeDir = callbackPath.replace(/^\\//, ''); // 'auth/callback'\n    for (const prefix of ['app', 'src/app']) {\n      for (const ext of ['ts', 'tsx', 'js', 'jsx']) {\n        possiblePaths.push(join(ctx.installDir, prefix, routeDir, `route.${ext}`));\n      }\n    }\n  } else if (ctx.framework.name === 'React Router') {\n    // Flat: app/routes/auth.callback.tsx  Nested: app/routes/auth/callback.tsx\n    const segments = callbackPath.replace(/^\\//, '').split('/');\n    const flat = segments.join('.');\n    const nested = segments.join('/');\n    for (const ext of ['tsx', 'jsx', 'ts', 'js']) {\n      possiblePaths.push(join(ctx.installDir, 'app', 'routes', `${flat}.${ext}`));\n      possiblePaths.push(join(ctx.installDir, 'app', 'routes', nested + `.${ext}`));\n    }\n  } else if (ctx.framework.name === 'TanStack Start') {\n    // Flat: routes/api.auth.callback.tsx  Nested: routes/api/auth/callback.tsx\n    // Both conventions work in both src/ and app/ directories\n    const segments = callbackPath.replace(/^\\//, '').split('/');\n    const flat = segments.join('.');\n    const nested = segments.join('/');\n    for (const prefix of ['src', 'app']) {\n      for (const ext of ['tsx', 'jsx', 'ts', 'js']) {\n        possiblePaths.push(join(ctx.installDir, prefix, 'routes', `${flat}.${ext}`));\n        possiblePaths.push(join(ctx.installDir, prefix, 'routes', nested + `.${ext}`));\n      }\n    }\n  }\n\n  if (possiblePaths.length === 0) return [];\n  if (findFile(possiblePaths)) return [];\n\n  return [\n    {\n      code: 'CALLBACK_ROUTE_MISSING',\n      severity: 'error',\n      message: `No callback route found at expected path ${callbackPath}`,\n      remediation: `Create the callback route handler at the path matching your WORKOS_REDIRECT_URI.`,\n      docsUrl: 'https://workos.com/docs/authkit/redirect-uri',\n    },\n  ];\n}\n\nconst CLIENT_ENV_PREFIXES = ['NEXT_PUBLIC_', 'VITE_', 'REACT_APP_', 'EXPO_PUBLIC_'];\n\nfunction checkApiKeyLeakedToClient(ctx: CheckContext): AuthPatternFinding[] {\n  const projectEnv = loadProjectEnvRaw(ctx.installDir);\n  const findings: AuthPatternFinding[] = [];\n\n  for (const [key, value] of Object.entries(projectEnv)) {\n    const hasClientPrefix = CLIENT_ENV_PREFIXES.some((prefix) => key.startsWith(prefix));\n    if (!hasClientPrefix) continue;\n\n    const isApiKey = key.includes('WORKOS_API_KEY');\n    const isSecretValue = value?.startsWith('sk_test_') || value?.startsWith('sk_live_');\n\n    if (isApiKey || isSecretValue) {\n      findings.push({\n        code: 'API_KEY_LEAKED_TO_CLIENT',\n        severity: 'error',\n        message: `Secret API key exposed via client-accessible env var ${key}`,\n        remediation: `Remove the client prefix. WORKOS_API_KEY must be server-only (no NEXT_PUBLIC_, VITE_, REACT_APP_, or EXPO_PUBLIC_ prefix).`,\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkWrongCallbackLoader(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'React Router') return [];\n  const callbackPath = ctx.framework.expectedCallbackPath;\n  if (!callbackPath) return [];\n\n  const segments = callbackPath.replace(/^\\//, '').split('/');\n  const flat = segments.join('.');\n  const nested = segments.join('/');\n\n  const possiblePaths: string[] = [];\n  for (const ext of ['tsx', 'jsx', 'ts', 'js']) {\n    possiblePaths.push(join(ctx.installDir, 'app', 'routes', `${flat}.${ext}`));\n    possiblePaths.push(join(ctx.installDir, 'app', 'routes', nested + `.${ext}`));\n  }\n\n  const callbackFile = findFile(possiblePaths);\n  if (!callbackFile) return []; // No callback route to check\n\n  // authkitLoader is for regular routes; authLoader is for the callback\n  if (fileContains(callbackFile, /authkitLoader/) && !fileContains(callbackFile, /authLoader/)) {\n    return [\n      {\n        code: 'WRONG_CALLBACK_LOADER',\n        severity: 'warning',\n        message: 'Callback route uses authkitLoader instead of authLoader',\n        filePath: relative(ctx.installDir, callbackFile),\n        remediation:\n          'Use authLoader (not authkitLoader) for the callback route. authkitLoader is for regular routes that need auth context.',\n      },\n    ];\n  }\n  return [];\n}\n\nfunction checkMissingRootAuthLoader(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'React Router') return [];\n\n  const rootPaths = ['app/root.tsx', 'app/root.jsx', 'app/routes/_index.tsx', 'app/routes/_index.jsx'].map((p) =>\n    join(ctx.installDir, p),\n  );\n\n  const rootFile = findFile(rootPaths);\n  if (!rootFile) return [];\n\n  if (fileContains(rootFile, /authkitLoader/)) return [];\n\n  return [\n    {\n      code: 'MISSING_ROOT_AUTH_LOADER',\n      severity: 'warning',\n      message: 'Root route does not use authkitLoader — child routes will not have auth context',\n      filePath: relative(ctx.installDir, rootFile),\n      remediation: 'Add authkitLoader to your root route so child routes can access auth state.',\n    },\n  ];\n}\n\nfunction checkMissingAuthkitMiddleware(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'TanStack Start') return [];\n\n  const startPaths = ['src/start.ts', 'src/start.tsx', 'app/start.ts', 'app/start.tsx'].map((p) =>\n    join(ctx.installDir, p),\n  );\n\n  const startFile = findFile(startPaths);\n  if (!startFile) return []; // Can't check if start file doesn't exist\n\n  if (fileContains(startFile, /authkitMiddleware/)) return [];\n\n  return [\n    {\n      code: 'MISSING_AUTHKIT_MIDDLEWARE',\n      severity: 'warning',\n      message: 'start.ts does not reference authkitMiddleware — AuthKit session handling requires it',\n      filePath: relative(ctx.installDir, startFile),\n      remediation:\n        'Add authkitMiddleware to requestMiddleware in src/start.ts:\\n' +\n        '  import { authkitMiddleware } from \"@workos/authkit-tanstack-react-start\";\\n' +\n        '  export default createStart({ requestMiddleware: [authkitMiddleware()] });',\n    },\n  ];\n}\n\nfunction checkCookiePasswordTooShort(ctx: CheckContext): AuthPatternFinding[] {\n  if (ctx.framework.name !== 'React Router' && ctx.framework.name !== 'TanStack Start') return [];\n\n  const projectEnv = loadProjectEnvRaw(ctx.installDir);\n  const password = projectEnv.WORKOS_COOKIE_PASSWORD;\n\n  // Only warn if password is set but too short; missing password is a separate concern\n  if (!password || password.length >= 32) return [];\n\n  return [\n    {\n      code: 'COOKIE_PASSWORD_TOO_SHORT',\n      severity: 'warning',\n      message: `WORKOS_COOKIE_PASSWORD is ${password.length} characters — minimum 32 required for secure encryption`,\n      remediation: 'Set WORKOS_COOKIE_PASSWORD to a random string of at least 32 characters.',\n    },\n  ];\n}\n\nconst REACT_SPA_SDKS = new Set(['@workos-inc/authkit-react']);\n\nfunction checkMissingApiHostname(ctx: CheckContext): AuthPatternFinding[] {\n  if (!ctx.sdk.name || !REACT_SPA_SDKS.has(ctx.sdk.name)) return [];\n\n  const sourceFiles = findFilesShallow(ctx.installDir, /\\.(tsx|jsx|ts|js)$/, 4);\n  const providerFiles = sourceFiles.filter((f) => fileContains(f, /AuthKitProvider/));\n  if (providerFiles.length === 0) return [];\n\n  const hasApiHostname = providerFiles.some((f) => fileContains(f, /apiHostname/));\n  if (hasApiHostname) return [];\n\n  return [\n    {\n      code: 'MISSING_API_HOSTNAME',\n      severity: 'warning',\n      message: 'AuthKitProvider does not specify apiHostname — authorize requests will route through api.workos.com',\n      filePath: relative(ctx.installDir, providerFiles[0]),\n      remediation:\n        'Set the apiHostname prop on AuthKitProvider to your custom Authentication API domain (e.g. auth.example.com) to avoid routing through api.workos.com.',\n      docsUrl: 'https://workos.com/docs/custom-domains',\n    },\n  ];\n}\n\n// --- Cross-language checks (run for ALL projects, not just JS/AuthKit) ---\n\nconst SOURCE_EXTENSIONS = /\\.(ts|tsx|js|jsx|py|rb|go|java|kt|php|cs|swift|dart)$/;\nconst SECRET_SOURCE_IGNORED_SEGMENTS = new Set(['__fixtures__', '__tests__', 'evals', 'fixtures', 'test', 'tests']);\n\nfunction isIgnoredSecretSourcePath(relativePath: string): boolean {\n  const normalized = relativePath.replace(/\\\\/g, '/');\n  const parts = normalized.split('/');\n  if (parts.some((part) => SECRET_SOURCE_IGNORED_SEGMENTS.has(part))) return true;\n  return /\\.(spec|test)\\.[^.]+$/.test(normalized);\n}\n\nfunction checkApiKeyInSource(ctx: CheckContext): AuthPatternFinding[] {\n  const API_KEY_PATTERN = /sk_(test|live)_[A-Za-z0-9]{10,}/;\n  const sourceFiles = findFilesShallow(ctx.installDir, SOURCE_EXTENSIONS, 4);\n  const findings: AuthPatternFinding[] = [];\n\n  for (const file of sourceFiles) {\n    const relativePath = relative(ctx.installDir, file);\n    if (isIgnoredSecretSourcePath(relativePath)) continue;\n    const content = readFileSafe(file);\n    if (!content) continue;\n    if (API_KEY_PATTERN.test(content)) {\n      findings.push({\n        code: 'API_KEY_IN_SOURCE',\n        severity: 'error',\n        message: `WorkOS API key hardcoded in source file`,\n        filePath: relativePath,\n        remediation:\n          'Move the API key to an environment variable (WORKOS_API_KEY) and load it from .env or your secret manager.',\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkEnvFileNotGitignored(ctx: CheckContext): AuthPatternFinding[] {\n  const envFiles = ['.env', '.env.local'].filter((f) => existsSync(join(ctx.installDir, f)));\n  if (envFiles.length === 0) return [];\n\n  const gitignorePath = join(ctx.installDir, '.gitignore');\n  const gitignore = readFileSafe(gitignorePath);\n\n  const findings: AuthPatternFinding[] = [];\n  for (const envFile of envFiles) {\n    const isIgnored =\n      gitignore !== null &&\n      gitignore.split(/\\r?\\n/).some((line) => {\n        const trimmed = line.trim();\n        if (trimmed.startsWith('#') || trimmed === '') return false;\n        return trimmed === envFile || trimmed === '.env*' || trimmed === '.env.*' || trimmed === '.env';\n      });\n\n    if (!isIgnored) {\n      findings.push({\n        code: 'ENV_FILE_NOT_GITIGNORED',\n        severity: 'warning',\n        message: `${envFile} is not in .gitignore — secrets may be committed to version control`,\n        filePath: envFile,\n        remediation: `Add ${envFile} to your .gitignore file.`,\n      });\n    }\n  }\n  return findings;\n}\n\nfunction checkMixedEnvironmentCredentials(ctx: CheckContext): AuthPatternFinding[] {\n  const projectEnv = loadProjectEnvRaw(ctx.installDir);\n  const apiKey = projectEnv.WORKOS_API_KEY;\n  const redirectUri = projectEnv.WORKOS_REDIRECT_URI ?? projectEnv.NEXT_PUBLIC_WORKOS_REDIRECT_URI;\n\n  if (!apiKey || !redirectUri) return [];\n\n  const isTestKey = apiKey.startsWith('sk_test_');\n  const isLiveKey = apiKey.startsWith('sk_live_');\n\n  let isProductionUri = false;\n  try {\n    const url = new URL(redirectUri);\n    isProductionUri = url.hostname !== 'localhost' && !url.hostname.startsWith('127.0.0.');\n  } catch {\n    return [];\n  }\n\n  if (isTestKey && isProductionUri) {\n    return [\n      {\n        code: 'MIXED_ENVIRONMENT',\n        severity: 'warning',\n        message: 'Staging API key (sk_test_) used with a production redirect URI',\n        remediation:\n          'Use sk_live_ API key for production redirect URIs, or change the redirect URI to localhost for staging.',\n      },\n    ];\n  }\n\n  if (isLiveKey && !isProductionUri) {\n    return [\n      {\n        code: 'MIXED_ENVIRONMENT',\n        severity: 'warning',\n        message: 'Production API key (sk_live_) used with a localhost redirect URI',\n        remediation:\n          'Use sk_test_ API key for localhost development, or update the redirect URI to your production domain.',\n      },\n    ];\n  }\n\n  return [];\n}\n\n// --- Main Entry Point ---\n\ntype CheckFn = (ctx: CheckContext) => AuthPatternFinding[];\n\nconst CROSS_FRAMEWORK_CHECKS: CheckFn[] = [\n  checkApiKeyLeakedToClient,\n  checkApiKeyInSource,\n  checkEnvFileNotGitignored,\n  checkMixedEnvironmentCredentials,\n  checkMissingApiHostname,\n];\n\nconst NEXTJS_CHECKS: CheckFn[] = [\n  checkSignoutGetHandler,\n  checkSignoutLinkPrefetch,\n  checkMissingMiddleware,\n  checkMiddlewareWrongLocation,\n  checkMissingAuthKitProvider,\n  checkCallbackRouteMissing,\n];\n\nconst REACT_ROUTER_CHECKS: CheckFn[] = [\n  checkWrongCallbackLoader,\n  checkMissingRootAuthLoader,\n  checkMissingAuthKitProvider,\n  checkCallbackRouteMissing,\n  checkCookiePasswordTooShort,\n];\n\nconst TANSTACK_CHECKS: CheckFn[] = [\n  checkMissingAuthkitMiddleware,\n  checkCallbackRouteMissing,\n  checkCookiePasswordTooShort,\n];\n\nexport async function checkAuthPatterns(\n  options: DoctorOptions,\n  framework: FrameworkInfo,\n  environment: EnvironmentInfo,\n  sdk: SdkInfo,\n): Promise<AuthPatternInfo> {\n  const ctx: CheckContext = {\n    framework,\n    environment,\n    sdk,\n    installDir: options.installDir,\n  };\n\n  const checks: CheckFn[] = [...CROSS_FRAMEWORK_CHECKS];\n\n  switch (framework.name) {\n    case 'Next.js':\n      checks.push(...NEXTJS_CHECKS);\n      break;\n    case 'React Router':\n      checks.push(...REACT_ROUTER_CHECKS);\n      break;\n    case 'TanStack Start':\n      checks.push(...TANSTACK_CHECKS);\n      break;\n  }\n\n  const findings: AuthPatternFinding[] = [];\n  for (const check of checks) {\n    findings.push(...check(ctx));\n  }\n\n  return {\n    checksRun: checks.length,\n    findings,\n  };\n}\n"]}

package/dist/doctor/checks/mcp.d.ts

@@ -0,0 +1,15 @@
+import type { McpInfo } from '../types.js';
+/**
+ * Report the WorkOS MCP server status across detected coding agents.
+ *
+ * Mirrors checkSkills: per-detected-agent loop, typed `*Info` return, null when
+ * no agents are detected (so doctor renders no MCP section for users with no
+ * coding agent installed). Report-only — never mutates config (`--fix` does not
+ * touch MCP in this phase).
+ *
+ * Absent MCP is deliberately NOT an issue: the user may have declined the
+ * offer. Only Cursor exposes a readable config, so URL drift ("misconfigured")
+ * is detected for Cursor alone; issues.ts derives a warning from it. Per-agent
+ * shell-outs carry the 10s timeout from the client library, keeping doctor fast.
+ */
+export declare function checkMcp(): Promise<McpInfo | null>;

package/dist/doctor/checks/mcp.js

@@ -0,0 +1,34 @@
+import { detectMcpClients, getCursorConfiguredUrl } from '../../lib/mcp-clients.js';
+import { MCP_SERVER_URL } from '../../lib/constants.js';
+/**
+ * Report the WorkOS MCP server status across detected coding agents.
+ *
+ * Mirrors checkSkills: per-detected-agent loop, typed `*Info` return, null when
+ * no agents are detected (so doctor renders no MCP section for users with no
+ * coding agent installed). Report-only — never mutates config (`--fix` does not
+ * touch MCP in this phase).
+ *
+ * Absent MCP is deliberately NOT an issue: the user may have declined the
+ * offer. Only Cursor exposes a readable config, so URL drift ("misconfigured")
+ * is detected for Cursor alone; issues.ts derives a warning from it. Per-agent
+ * shell-outs carry the 10s timeout from the client library, keeping doctor fast.
+ */
+export async function checkMcp() {
+    const clients = await detectMcpClients();
+    if (clients.length === 0)
+        return null;
+    const agents = await Promise.all(clients.map(async (client) => {
+        const installed = await client.isInstalled();
+        const status = { agent: client.displayName, available: true, installed };
+        // Cursor is the only client whose config we can read, so it's the only
+        // one we can flag for URL drift. A missing/unreadable URL (null) is not
+        // "unexpected" — only a present-but-different URL counts.
+        if (client.key === 'cursor' && installed) {
+            const url = await getCursorConfiguredUrl();
+            status.misconfigured = url !== null && url !== MCP_SERVER_URL;
+        }
+        return status;
+    }));
+    return { serverUrl: MCP_SERVER_URL, agents };
+}
+//# sourceMappingURL=mcp.js.map

package/dist/doctor/checks/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/doctor/checks/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAA8B,EAAE;QACvD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5F,uEAAuE;QACvE,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,sBAAsB,EAAE,CAAC;YAC3C,MAAM,CAAC,aAAa,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,cAAc,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { detectMcpClients, getCursorConfiguredUrl } from '../../lib/mcp-clients.js';\nimport { MCP_SERVER_URL } from '../../lib/constants.js';\nimport type { McpInfo, McpAgentMcpStatus } from '../types.js';\n\n/**\n * Report the WorkOS MCP server status across detected coding agents.\n *\n * Mirrors checkSkills: per-detected-agent loop, typed `*Info` return, null when\n * no agents are detected (so doctor renders no MCP section for users with no\n * coding agent installed). Report-only — never mutates config (`--fix` does not\n * touch MCP in this phase).\n *\n * Absent MCP is deliberately NOT an issue: the user may have declined the\n * offer. Only Cursor exposes a readable config, so URL drift (\"misconfigured\")\n * is detected for Cursor alone; issues.ts derives a warning from it. Per-agent\n * shell-outs carry the 10s timeout from the client library, keeping doctor fast.\n */\nexport async function checkMcp(): Promise<McpInfo | null> {\n  const clients = await detectMcpClients();\n  if (clients.length === 0) return null;\n\n  const agents = await Promise.all(\n    clients.map(async (client): Promise<McpAgentMcpStatus> => {\n      const installed = await client.isInstalled();\n      const status: McpAgentMcpStatus = { agent: client.displayName, available: true, installed };\n      // Cursor is the only client whose config we can read, so it's the only\n      // one we can flag for URL drift. A missing/unreadable URL (null) is not\n      // \"unexpected\" — only a present-but-different URL counts.\n      if (client.key === 'cursor' && installed) {\n        const url = await getCursorConfiguredUrl();\n        status.misconfigured = url !== null && url !== MCP_SERVER_URL;\n      }\n      return status;\n    }),\n  );\n\n  return { serverUrl: MCP_SERVER_URL, agents };\n}\n"]}

package/dist/doctor/index.js

@@ -9,6 +9,7 @@ import { checkDashboardSettings, compareRedirectUris } from './checks/dashboard.
 import { checkAuthPatterns } from './checks/auth-patterns.js';
 import { checkAiAnalysis } from './checks/ai-analysis.js';
 import { checkSkills } from './checks/skills.js';
+import { checkMcp } from './checks/mcp.js';
 import { refreshWorkOSSkills } from '../commands/install-skill.js';
 import { detectIssues } from './issues.js';
 import { formatReport } from './output.js';
@@ -61,14 +62,17 @@ export async function runDoctor(options) {
     // Must run before connectivity so the resolved base URL is available
     const { info: environment, raw: envRaw } = checkEnvironment(options);
     // Run remaining checks concurrently
-    const [sdk, framework, runtime, connectivity, language, hostExecution] = await Promise.all([
+    const [sdk, framework, runtime, connectivity, language, hostExecution, mcpResult] = await Promise.all([
         checkSdk(options),
         checkFramework(options),
         checkRuntime(options),
         checkConnectivity(options, environment.baseUrl ?? 'https://api.workos.com'),
         checkLanguage(options.installDir),
         checkHostExecution(),
+        checkMcp(),
     ]);
+    // Normalize the check's null (no agents detected) to undefined for the report.
+    const mcp = mcpResult ?? undefined;
     let skills = (await checkSkills()) ?? undefined;
     // `--fix`: refresh stale WorkOS skills BEFORE earlyIssues + AI analysis so
     // every downstream consumer (issue detection, AI prompt context) sees the
@@ -92,6 +96,7 @@ export async function runDoctor(options) {
         hostExecution,
         connectivity,
         skills,
+        mcp,
     });
     const [dashboardResult, authPatterns, aiAnalysis] = await Promise.all([
         checkDashboardSettings(options, environment.apiKeyType, envRaw),
@@ -132,6 +137,7 @@ export async function runDoctor(options) {
         aiAnalysis,
         skills,
         skillsRefresh,
+        mcp,
     };
     // Detect issues based on (post-refresh) data.
     const issues = detectIssues(partialReport);

package/dist/doctor/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/doctor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAU,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAmC,EACnC,MAA8B;IAK9B,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE/C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC;IACvF,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAEhC,OAAO;QACL,aAAa,EAAE;YACb,MAAM,EAAE,OAAO,CAAC,cAAc;YAC9B,KAAK,EAAE,OAAO,CAAC,aAAa;YAC5B,eAAe,EAAE,OAAO,CAAC,MAAM;SAChC;QACD,MAAM,EAAE,CAAC,MAAM,WAAW,EAAE,CAAC,IAAI,SAAS;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAE7C,kEAAkE;IAClE,qEAAqE;IACrE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAErE,oCAAoC;IACpC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzF,QAAQ,CAAC,OAAO,CAAC;QACjB,cAAc,CAAC,OAAO,CAAC;QACvB,YAAY,CAAC,OAAO,CAAC;QACrB,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,wBAAwB,CAAC;QAC3E,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;QACjC,kBAAkB,EAAE;KACrB,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC;IAEhD,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,0BAA0B;IAC1B,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,CAAC;IACnD,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;IAE/B,8FAA8F;IAC9F,yEAAyE;IACzE,MAAM,WAAW,GAAG,YAAY,CAAC;QAC/B,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,EAAE;QACb,eAAe;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;QAC7E,GAAG;QACH,QAAQ;QACR,OAAO;QACP,SAAS;QACT,WAAW;QACX,aAAa;QACb,YAAY;QACZ,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC;QAC/D,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC;QACvD,eAAe,CACb,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,EACtG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAC3B;KACF,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,iBAAiB,GAAuB,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3F,MAAM,mBAAmB,GACvB,WAAW,CAAC,WAAW;QACvB,CAAC,SAAS,CAAC,oBAAoB,IAAI,SAAS,CAAC,YAAY;YACvD,CAAC,CAAC,oBAAoB,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC,oBAAoB,EAAE;YAC/E,CAAC,CAAC,IAAI,CAAC,CAAC;IAEZ,kDAAkD;IAClD,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ;QAC3C,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;QACpG,CAAC,CAAC,SAAS,CAAC;IAEd,uBAAuB;IACvB,MAAM,aAAa,GAAG;QACpB,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,eAAe;QACf,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,UAAU;YACxB,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC;QACD,GAAG;QACH,QAAQ;QACR,OAAO;QACP,SAAS;QACT,WAAW;QACX,aAAa;QACb,YAAY;QACZ,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;QAC1D,iBAAiB,EAAE,eAAe,CAAC,QAAQ,IAAI,SAAS;QACxD,cAAc,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK;QAC5E,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,MAAM;QACN,aAAa;KACd,CAAC;IAEF,8CAA8C;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAE3C,oBAAoB;IACpB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEvE,MAAM,MAAM,GAAiB;QAC3B,GAAG,aAAa;QAChB,MAAM;QACN,OAAO,EAAE;YACP,MAAM;YACN,QAAQ;YACR,OAAO,EAAE,MAAM,KAAK,CAAC;SACtB;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAoB,EAAE,OAAsB;IAC7E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["import { checkSdk } from './checks/sdk.js';\nimport { checkFramework } from './checks/framework.js';\nimport { checkRuntime } from './checks/runtime.js';\nimport { checkLanguage } from './checks/language.js';\nimport { checkEnvironment } from './checks/environment.js';\nimport { checkConnectivity } from './checks/connectivity.js';\nimport { checkHostExecution } from './checks/host-execution.js';\nimport { checkDashboardSettings, compareRedirectUris } from './checks/dashboard.js';\nimport { checkAuthPatterns } from './checks/auth-patterns.js';\nimport { checkAiAnalysis } from './checks/ai-analysis.js';\nimport { checkSkills } from './checks/skills.js';\nimport { refreshWorkOSSkills } from '../commands/install-skill.js';\nimport { detectIssues } from './issues.js';\nimport { formatReport } from './output.js';\nimport { formatReportAsJson } from './json-output.js';\nimport { copyToClipboard } from './clipboard.js';\nimport { getInteractionMode } from '../utils/interaction-mode.js';\nimport Chalk from 'chalk';\nimport type { DoctorOptions, DoctorReport, SkillsRefreshResult } from './types.js';\n\nconst DOCTOR_VERSION = '1.0.0';\n\n/**\n * Skills `--fix` is allowed to refresh. Hardcoded — NOT derived from\n * discoverSkills — so future bundled skills require an explicit opt-in here\n * before doctor will write to their target directory. This is the contract's\n * promise that `--fix` only ever touches `workos/` and `workos-widgets/`.\n */\nexport const FIXABLE_SKILLS = ['workos', 'workos-widgets'] as const;\n\n/**\n * Refresh stale WorkOS skills if `--fix` is set and at least one agent is\n * stale or has no marker. Always re-reads `checkSkills()` after a successful\n * refresh so detectIssues sees the post-refresh state and we don't ship a\n * doctor report that simultaneously claims \"fixed\" and \"still stale\".\n *\n * Extracted from runDoctor for unit testability — runDoctor itself depends on\n * eight upstream checks that are expensive to mock.\n */\nexport async function maybeRefreshSkills(\n  options: Pick<DoctorOptions, 'fix'>,\n  skills: DoctorReport['skills'],\n): Promise<{\n  skillsRefresh?: SkillsRefreshResult;\n  skills: DoctorReport['skills'];\n}> {\n  if (!options.fix || !skills) return { skills };\n\n  const stalePresent = skills.agents.some((a) => a.stale || a.installedVersion === null);\n  if (!stalePresent) return { skills };\n\n  const refresh = await refreshWorkOSSkills({\n    // Explicit allowlist — NOT discoverSkills — so the contract's\n    // workos/+workos-widgets-only constraint can't drift.\n    skills: [...FIXABLE_SKILLS],\n  });\n  if (!refresh) return { skills };\n\n  return {\n    skillsRefresh: {\n      before: refresh.perAgentBefore,\n      after: refresh.perAgentAfter,\n      skillsInstalled: refresh.skills,\n    },\n    skills: (await checkSkills()) ?? undefined,\n  };\n}\n\nexport async function runDoctor(options: DoctorOptions): Promise<DoctorReport> {\n  const interactionMode = getInteractionMode();\n\n  // Environment check first - loads project's .env/.env.local files\n  // Must run before connectivity so the resolved base URL is available\n  const { info: environment, raw: envRaw } = checkEnvironment(options);\n\n  // Run remaining checks concurrently\n  const [sdk, framework, runtime, connectivity, language, hostExecution] = await Promise.all([\n    checkSdk(options),\n    checkFramework(options),\n    checkRuntime(options),\n    checkConnectivity(options, environment.baseUrl ?? 'https://api.workos.com'),\n    checkLanguage(options.installDir),\n    checkHostExecution(),\n  ]);\n\n  let skills = (await checkSkills()) ?? undefined;\n\n  // `--fix`: refresh stale WorkOS skills BEFORE earlyIssues + AI analysis so\n  // every downstream consumer (issue detection, AI prompt context) sees the\n  // post-refresh skill state and doesn't reference a SKILLS_OUTDATED warning\n  // that was just resolved.\n  const refreshOutcome = await maybeRefreshSkills(options, skills);\n  const skillsRefresh = refreshOutcome.skillsRefresh;\n  skills = refreshOutcome.skills;\n\n  // Dashboard settings + auth patterns + AI analysis (parallel, all need sdk/framework results)\n  // AI analysis also receives early issues as context to avoid duplication\n  const earlyIssues = detectIssues({\n    version: DOCTOR_VERSION,\n    timestamp: '',\n    interactionMode,\n    project: { path: options.installDir, packageManager: runtime.packageManager },\n    sdk,\n    language,\n    runtime,\n    framework,\n    environment,\n    hostExecution,\n    connectivity,\n    skills,\n  });\n\n  const [dashboardResult, authPatterns, aiAnalysis] = await Promise.all([\n    checkDashboardSettings(options, environment.apiKeyType, envRaw),\n    checkAuthPatterns(options, framework, environment, sdk),\n    checkAiAnalysis(\n      { installDir: options.installDir, language, framework, sdk, environment, existingIssues: earlyIssues },\n      { skipAi: options.skipAi },\n    ),\n  ]);\n\n  // Compute expected redirect URI from framework detection if not set in env\n  const redirectUriSource: 'env' | 'inferred' = environment.redirectUri ? 'env' : 'inferred';\n  const expectedRedirectUri =\n    environment.redirectUri ??\n    (framework.expectedCallbackPath && framework.detectedPort\n      ? `http://localhost:${framework.detectedPort}${framework.expectedCallbackPath}`\n      : null);\n\n  // Compare redirect URIs if we have dashboard data\n  const redirectUris = dashboardResult.settings\n    ? compareRedirectUris(expectedRedirectUri, dashboardResult.settings.redirectUris, redirectUriSource)\n    : undefined;\n\n  // Build partial report\n  const partialReport = {\n    version: DOCTOR_VERSION,\n    timestamp: new Date().toISOString(),\n    interactionMode,\n    project: {\n      path: options.installDir,\n      packageManager: runtime.packageManager,\n    },\n    sdk,\n    language,\n    runtime,\n    framework,\n    environment,\n    hostExecution,\n    connectivity,\n    credentialValidation: dashboardResult.credentialValidation,\n    dashboardSettings: dashboardResult.settings ?? undefined,\n    dashboardError: dashboardResult.settings ? undefined : dashboardResult.error,\n    redirectUris,\n    authPatterns,\n    aiAnalysis,\n    skills,\n    skillsRefresh,\n  };\n\n  // Detect issues based on (post-refresh) data.\n  const issues = detectIssues(partialReport);\n\n  // Calculate summary\n  const errors = issues.filter((i) => i.severity === 'error').length;\n  const warnings = issues.filter((i) => i.severity === 'warning').length;\n\n  const report: DoctorReport = {\n    ...partialReport,\n    issues,\n    summary: {\n      errors,\n      warnings,\n      healthy: errors === 0,\n    },\n  };\n\n  return report;\n}\n\nexport async function outputReport(report: DoctorReport, options: DoctorOptions): Promise<void> {\n  if (options.json) {\n    const json = formatReportAsJson(report);\n    console.log(json);\n\n    if (options.copy) {\n      const success = await copyToClipboard(json);\n      if (success) {\n        console.error('(Copied to clipboard)');\n      }\n    }\n  } else {\n    formatReport(report, { verbose: options.verbose });\n\n    if (options.copy) {\n      const json = formatReportAsJson(report);\n      const success = await copyToClipboard(json);\n      if (success) {\n        console.log(Chalk.dim('Report copied to clipboard'));\n      }\n    }\n  }\n}\n\nexport { formatReport } from './output.js';\nexport { formatReportAsJson } from './json-output.js';\nexport type { DoctorReport, DoctorOptions } from './types.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/doctor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAU,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAmC,EACnC,MAA8B;IAK9B,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE/C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC;IACvF,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAEhC,OAAO;QACL,aAAa,EAAE;YACb,MAAM,EAAE,OAAO,CAAC,cAAc;YAC9B,KAAK,EAAE,OAAO,CAAC,aAAa;YAC5B,eAAe,EAAE,OAAO,CAAC,MAAM;SAChC;QACD,MAAM,EAAE,CAAC,MAAM,WAAW,EAAE,CAAC,IAAI,SAAS;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAE7C,kEAAkE;IAClE,qEAAqE;IACrE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAErE,oCAAoC;IACpC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpG,QAAQ,CAAC,OAAO,CAAC;QACjB,cAAc,CAAC,OAAO,CAAC;QACvB,YAAY,CAAC,OAAO,CAAC;QACrB,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,wBAAwB,CAAC;QAC3E,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;QACjC,kBAAkB,EAAE;QACpB,QAAQ,EAAE;KACX,CAAC,CAAC;IACH,+EAA+E;IAC/E,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,CAAC;IAEnC,IAAI,MAAM,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC;IAEhD,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,0BAA0B;IAC1B,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,CAAC;IACnD,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;IAE/B,8FAA8F;IAC9F,yEAAyE;IACzE,MAAM,WAAW,GAAG,YAAY,CAAC;QAC/B,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,EAAE;QACb,eAAe;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;QAC7E,GAAG;QACH,QAAQ;QACR,OAAO;QACP,SAAS;QACT,WAAW;QACX,aAAa;QACb,YAAY;QACZ,MAAM;QACN,GAAG;KACJ,CAAC,CAAC;IAEH,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC;QAC/D,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC;QACvD,eAAe,CACb,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,EACtG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAC3B;KACF,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,iBAAiB,GAAuB,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3F,MAAM,mBAAmB,GACvB,WAAW,CAAC,WAAW;QACvB,CAAC,SAAS,CAAC,oBAAoB,IAAI,SAAS,CAAC,YAAY;YACvD,CAAC,CAAC,oBAAoB,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC,oBAAoB,EAAE;YAC/E,CAAC,CAAC,IAAI,CAAC,CAAC;IAEZ,kDAAkD;IAClD,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ;QAC3C,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;QACpG,CAAC,CAAC,SAAS,CAAC;IAEd,uBAAuB;IACvB,MAAM,aAAa,GAAG;QACpB,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,eAAe;QACf,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,UAAU;YACxB,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC;QACD,GAAG;QACH,QAAQ;QACR,OAAO;QACP,SAAS;QACT,WAAW;QACX,aAAa;QACb,YAAY;QACZ,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;QAC1D,iBAAiB,EAAE,eAAe,CAAC,QAAQ,IAAI,SAAS;QACxD,cAAc,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK;QAC5E,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,MAAM;QACN,aAAa;QACb,GAAG;KACJ,CAAC;IAEF,8CAA8C;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAE3C,oBAAoB;IACpB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEvE,MAAM,MAAM,GAAiB;QAC3B,GAAG,aAAa;QAChB,MAAM;QACN,OAAO,EAAE;YACP,MAAM;YACN,QAAQ;YACR,OAAO,EAAE,MAAM,KAAK,CAAC;SACtB;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAoB,EAAE,OAAsB;IAC7E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC","sourcesContent":["import { checkSdk } from './checks/sdk.js';\nimport { checkFramework } from './checks/framework.js';\nimport { checkRuntime } from './checks/runtime.js';\nimport { checkLanguage } from './checks/language.js';\nimport { checkEnvironment } from './checks/environment.js';\nimport { checkConnectivity } from './checks/connectivity.js';\nimport { checkHostExecution } from './checks/host-execution.js';\nimport { checkDashboardSettings, compareRedirectUris } from './checks/dashboard.js';\nimport { checkAuthPatterns } from './checks/auth-patterns.js';\nimport { checkAiAnalysis } from './checks/ai-analysis.js';\nimport { checkSkills } from './checks/skills.js';\nimport { checkMcp } from './checks/mcp.js';\nimport { refreshWorkOSSkills } from '../commands/install-skill.js';\nimport { detectIssues } from './issues.js';\nimport { formatReport } from './output.js';\nimport { formatReportAsJson } from './json-output.js';\nimport { copyToClipboard } from './clipboard.js';\nimport { getInteractionMode } from '../utils/interaction-mode.js';\nimport Chalk from 'chalk';\nimport type { DoctorOptions, DoctorReport, SkillsRefreshResult } from './types.js';\n\nconst DOCTOR_VERSION = '1.0.0';\n\n/**\n * Skills `--fix` is allowed to refresh. Hardcoded — NOT derived from\n * discoverSkills — so future bundled skills require an explicit opt-in here\n * before doctor will write to their target directory. This is the contract's\n * promise that `--fix` only ever touches `workos/` and `workos-widgets/`.\n */\nexport const FIXABLE_SKILLS = ['workos', 'workos-widgets'] as const;\n\n/**\n * Refresh stale WorkOS skills if `--fix` is set and at least one agent is\n * stale or has no marker. Always re-reads `checkSkills()` after a successful\n * refresh so detectIssues sees the post-refresh state and we don't ship a\n * doctor report that simultaneously claims \"fixed\" and \"still stale\".\n *\n * Extracted from runDoctor for unit testability — runDoctor itself depends on\n * eight upstream checks that are expensive to mock.\n */\nexport async function maybeRefreshSkills(\n  options: Pick<DoctorOptions, 'fix'>,\n  skills: DoctorReport['skills'],\n): Promise<{\n  skillsRefresh?: SkillsRefreshResult;\n  skills: DoctorReport['skills'];\n}> {\n  if (!options.fix || !skills) return { skills };\n\n  const stalePresent = skills.agents.some((a) => a.stale || a.installedVersion === null);\n  if (!stalePresent) return { skills };\n\n  const refresh = await refreshWorkOSSkills({\n    // Explicit allowlist — NOT discoverSkills — so the contract's\n    // workos/+workos-widgets-only constraint can't drift.\n    skills: [...FIXABLE_SKILLS],\n  });\n  if (!refresh) return { skills };\n\n  return {\n    skillsRefresh: {\n      before: refresh.perAgentBefore,\n      after: refresh.perAgentAfter,\n      skillsInstalled: refresh.skills,\n    },\n    skills: (await checkSkills()) ?? undefined,\n  };\n}\n\nexport async function runDoctor(options: DoctorOptions): Promise<DoctorReport> {\n  const interactionMode = getInteractionMode();\n\n  // Environment check first - loads project's .env/.env.local files\n  // Must run before connectivity so the resolved base URL is available\n  const { info: environment, raw: envRaw } = checkEnvironment(options);\n\n  // Run remaining checks concurrently\n  const [sdk, framework, runtime, connectivity, language, hostExecution, mcpResult] = await Promise.all([\n    checkSdk(options),\n    checkFramework(options),\n    checkRuntime(options),\n    checkConnectivity(options, environment.baseUrl ?? 'https://api.workos.com'),\n    checkLanguage(options.installDir),\n    checkHostExecution(),\n    checkMcp(),\n  ]);\n  // Normalize the check's null (no agents detected) to undefined for the report.\n  const mcp = mcpResult ?? undefined;\n\n  let skills = (await checkSkills()) ?? undefined;\n\n  // `--fix`: refresh stale WorkOS skills BEFORE earlyIssues + AI analysis so\n  // every downstream consumer (issue detection, AI prompt context) sees the\n  // post-refresh skill state and doesn't reference a SKILLS_OUTDATED warning\n  // that was just resolved.\n  const refreshOutcome = await maybeRefreshSkills(options, skills);\n  const skillsRefresh = refreshOutcome.skillsRefresh;\n  skills = refreshOutcome.skills;\n\n  // Dashboard settings + auth patterns + AI analysis (parallel, all need sdk/framework results)\n  // AI analysis also receives early issues as context to avoid duplication\n  const earlyIssues = detectIssues({\n    version: DOCTOR_VERSION,\n    timestamp: '',\n    interactionMode,\n    project: { path: options.installDir, packageManager: runtime.packageManager },\n    sdk,\n    language,\n    runtime,\n    framework,\n    environment,\n    hostExecution,\n    connectivity,\n    skills,\n    mcp,\n  });\n\n  const [dashboardResult, authPatterns, aiAnalysis] = await Promise.all([\n    checkDashboardSettings(options, environment.apiKeyType, envRaw),\n    checkAuthPatterns(options, framework, environment, sdk),\n    checkAiAnalysis(\n      { installDir: options.installDir, language, framework, sdk, environment, existingIssues: earlyIssues },\n      { skipAi: options.skipAi },\n    ),\n  ]);\n\n  // Compute expected redirect URI from framework detection if not set in env\n  const redirectUriSource: 'env' | 'inferred' = environment.redirectUri ? 'env' : 'inferred';\n  const expectedRedirectUri =\n    environment.redirectUri ??\n    (framework.expectedCallbackPath && framework.detectedPort\n      ? `http://localhost:${framework.detectedPort}${framework.expectedCallbackPath}`\n      : null);\n\n  // Compare redirect URIs if we have dashboard data\n  const redirectUris = dashboardResult.settings\n    ? compareRedirectUris(expectedRedirectUri, dashboardResult.settings.redirectUris, redirectUriSource)\n    : undefined;\n\n  // Build partial report\n  const partialReport = {\n    version: DOCTOR_VERSION,\n    timestamp: new Date().toISOString(),\n    interactionMode,\n    project: {\n      path: options.installDir,\n      packageManager: runtime.packageManager,\n    },\n    sdk,\n    language,\n    runtime,\n    framework,\n    environment,\n    hostExecution,\n    connectivity,\n    credentialValidation: dashboardResult.credentialValidation,\n    dashboardSettings: dashboardResult.settings ?? undefined,\n    dashboardError: dashboardResult.settings ? undefined : dashboardResult.error,\n    redirectUris,\n    authPatterns,\n    aiAnalysis,\n    skills,\n    skillsRefresh,\n    mcp,\n  };\n\n  // Detect issues based on (post-refresh) data.\n  const issues = detectIssues(partialReport);\n\n  // Calculate summary\n  const errors = issues.filter((i) => i.severity === 'error').length;\n  const warnings = issues.filter((i) => i.severity === 'warning').length;\n\n  const report: DoctorReport = {\n    ...partialReport,\n    issues,\n    summary: {\n      errors,\n      warnings,\n      healthy: errors === 0,\n    },\n  };\n\n  return report;\n}\n\nexport async function outputReport(report: DoctorReport, options: DoctorOptions): Promise<void> {\n  if (options.json) {\n    const json = formatReportAsJson(report);\n    console.log(json);\n\n    if (options.copy) {\n      const success = await copyToClipboard(json);\n      if (success) {\n        console.error('(Copied to clipboard)');\n      }\n    }\n  } else {\n    formatReport(report, { verbose: options.verbose });\n\n    if (options.copy) {\n      const json = formatReportAsJson(report);\n      const success = await copyToClipboard(json);\n      if (success) {\n        console.log(Chalk.dim('Report copied to clipboard'));\n      }\n    }\n  }\n}\n\nexport { formatReport } from './output.js';\nexport { formatReportAsJson } from './json-output.js';\nexport type { DoctorReport, DoctorOptions } from './types.js';\n"]}

package/dist/doctor/issues.js

@@ -164,6 +164,22 @@ export function detectIssues(report) {
             });
         }
     }
+    // MCP server URL drift — warn ONLY when a configured entry points at an
+    // unexpected URL. Absent MCP is never an issue: the user may have declined
+    // the offer, and doctor reports state without judging.
+    if (report.mcp) {
+        const misconfigured = report.mcp.agents.filter((a) => a.misconfigured);
+        if (misconfigured.length > 0) {
+            const agentList = misconfigured.map((a) => a.agent).join(', ');
+            issues.push({
+                code: 'MCP_MISCONFIGURED',
+                severity: 'warning',
+                message: `WorkOS MCP server configured with an unexpected URL for ${agentList} — expected ${report.mcp.serverUrl}`,
+                remediation: 'Run: workos mcp install',
+                details: { agents: misconfigured.map((a) => a.agent), expectedUrl: report.mcp.serverUrl },
+            });
+        }
+    }
     return issues;
 }
 function getUpdateCommand(packageManager, sdkName) {

package/dist/doctor/issues.js.map

@@ -1 +1 @@
-{"version":3,"file":"issues.js","sourceRoot":"","sources":["../../src/doctor/issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,eAAe,EAAE;QACf,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,uCAAuC;KACjD;IACD,iBAAiB,EAAE;QACjB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,4CAA4C;KACtD;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yBAAyB;QAClC,oCAAoC;KACrC;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,+CAA+C;KACzD;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,8DAA8D;QAC3E,OAAO,EAAE,yBAAyB;KACnC;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yBAAyB;QAClC,mDAAmD;KACpD;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,8CAA8C;KACxD;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,mDAAmD;KACjE;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,uCAAuC;KACjD;IACD,kBAAkB,EAAE;QAClB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,4CAA4C;KACtD;IACD,wBAAwB,EAAE;QACxB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,4HAA4H;KAC/H;CACF,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,MAAgD;IAC3E,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,aAAa;IACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,qCAAqC;YAC9C,WAAW,EAAE,yBAAyB,IAAI,EAAE;YAC5C,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG;YAC9E,WAAW,EAAE,QAAQ,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACvF,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,GAAG,iBAAiB,CAAC,wBAAwB;YAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,4BAA4B,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;YAChE,WAAW,EAAE,qDAAqD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IAEtE,6CAA6C;IAC7C,IAAI,MAAM,CAAC,WAAW,CAAC,UAAU,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,GAAG,iBAAiB,CAAC,qBAAqB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,GAAG,iBAAiB,CAAC,eAAe;gBACpC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,GAAG,iBAAiB,CAAC,kBAAkB;gBACvC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,gBAAgB,IAAI,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjG,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,8BAA8B,SAAS,eAAe,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE;gBAC7F,WAAW,EAAE,4BAA4B;gBACzC,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,cAA6B,EAAE,OAAe;IACtE,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,eAAe,OAAO,EAAE,CAAC;QAClC,KAAK,SAAS,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,gBAAgB,OAAO,EAAE,CAAC;QACnC,KAAK,KAAK;YACR,OAAO,cAAc,OAAO,EAAE,CAAC;QACjC;YACE,OAAO,cAAc,OAAO,EAAE,CAAC;IACnC,CAAC;AACH,CAAC","sourcesContent":["import type { Issue, DoctorReport } from './types.js';\nimport { getInstallHint, languageToSdkLanguage } from './checks/language.js';\n\nexport const ISSUE_DEFINITIONS = {\n  MISSING_API_KEY: {\n    severity: 'error' as const,\n    message: 'WORKOS_API_KEY environment variable not set',\n    remediation: 'Set WORKOS_API_KEY in your .env.local file',\n    docsUrl: 'https://dashboard.workos.com/api-keys',\n  },\n  MISSING_CLIENT_ID: {\n    severity: 'error' as const,\n    message: 'WORKOS_CLIENT_ID environment variable not set',\n    remediation: 'Set WORKOS_CLIENT_ID in your .env.local file',\n    docsUrl: 'https://dashboard.workos.com/configuration',\n  },\n  SDK_OUTDATED: {\n    severity: 'warning' as const,\n    message: 'SDK version is outdated',\n    // remediation generated dynamically\n  },\n  COOKIE_DOMAIN_NOT_SET: {\n    severity: 'warning' as const,\n    message: 'Cookie domain not explicitly set',\n    remediation: 'Consider setting WORKOS_COOKIE_DOMAIN for cross-subdomain auth',\n    docsUrl: 'https://workos.com/docs/authkit/cookie-domain',\n  },\n  NO_SDK_FOUND: {\n    severity: 'error' as const,\n    message: 'No WorkOS SDK found in dependencies',\n    remediation: 'Install a WorkOS SDK: npm install @workos-inc/authkit-nextjs',\n    docsUrl: 'https://workos.com/docs',\n  },\n  API_UNREACHABLE: {\n    severity: 'warning' as const,\n    message: 'Cannot reach WorkOS API',\n    // remediation generated dynamically based on error\n  },\n  REDIRECT_URI_MISMATCH: {\n    severity: 'warning' as const,\n    message: 'Redirect URI not found in dashboard configuration',\n    docsUrl: 'https://workos.com/docs/authkit/redirect-uri',\n  },\n  PROD_API_CALL_BLOCKED: {\n    severity: 'warning' as const,\n    message: 'Dashboard settings not fetched (production API key)',\n    remediation: 'Use a staging API key to fetch dashboard settings',\n  },\n  INVALID_API_KEY: {\n    severity: 'error' as const,\n    message: 'API key is invalid or expired',\n    remediation: 'Check your WORKOS_API_KEY in the WorkOS dashboard',\n    docsUrl: 'https://dashboard.workos.com/api-keys',\n  },\n  CLIENT_ID_MISMATCH: {\n    severity: 'error' as const,\n    message: 'Client ID does not match the API key environment',\n    remediation: 'Ensure WORKOS_CLIENT_ID matches the environment for your API key',\n    docsUrl: 'https://dashboard.workos.com/configuration',\n  },\n  HOST_EXECUTION_UNTRUSTED: {\n    severity: 'warning' as const,\n    message: 'Host-only WorkOS state may be unavailable in this shell',\n    remediation:\n      'Agent/CI host execution is untrusted. Re-run this command on the host shell before trusting auth, config, or API failures.',\n  },\n};\n\nexport function detectIssues(report: Omit<DoctorReport, 'issues' | 'summary'>): Issue[] {\n  const issues: Issue[] = [];\n\n  // SDK issues\n  if (!report.sdk.name) {\n    const lang = languageToSdkLanguage(report.language.name);\n    const hint = getInstallHint(lang);\n    issues.push({\n      code: 'NO_SDK_FOUND',\n      severity: 'error',\n      message: 'No WorkOS SDK found in dependencies',\n      remediation: `Install a WorkOS SDK: ${hint}`,\n      docsUrl: 'https://workos.com/docs',\n    });\n  } else if (report.sdk.outdated && report.sdk.version && report.sdk.latest) {\n    issues.push({\n      code: 'SDK_OUTDATED',\n      severity: 'warning',\n      message: `SDK version outdated (${report.sdk.version} → ${report.sdk.latest})`,\n      remediation: `Run: ${getUpdateCommand(report.runtime.packageManager, report.sdk.name)}`,\n      details: { installed: report.sdk.version, latest: report.sdk.latest },\n    });\n  }\n\n  // Environment issues\n  if (!report.environment.apiKeyConfigured) {\n    issues.push({ code: 'MISSING_API_KEY', ...ISSUE_DEFINITIONS.MISSING_API_KEY });\n  }\n\n  if (!report.environment.clientId) {\n    issues.push({ code: 'MISSING_CLIENT_ID', ...ISSUE_DEFINITIONS.MISSING_CLIENT_ID });\n  }\n\n  if (report.sdk.isAuthKit && !report.environment.cookieDomain) {\n    issues.push({ code: 'COOKIE_DOMAIN_NOT_SET', ...ISSUE_DEFINITIONS.COOKIE_DOMAIN_NOT_SET });\n  }\n\n  if (!report.hostExecution.ok) {\n    issues.push({\n      code: 'HOST_EXECUTION_UNTRUSTED',\n      ...ISSUE_DEFINITIONS.HOST_EXECUTION_UNTRUSTED,\n      details: { failures: report.hostExecution.failures },\n    });\n  }\n\n  // Connectivity issues\n  if (!report.connectivity.apiReachable && !report.connectivity.error?.includes('Skipped')) {\n    issues.push({\n      code: 'API_UNREACHABLE',\n      severity: 'warning',\n      message: `Cannot reach WorkOS API: ${report.connectivity.error}`,\n      remediation: 'Check your network connection and firewall settings',\n    });\n  }\n\n  // Note: Redirect URI mismatch detection disabled - WorkOS API doesn't expose\n  // a public endpoint to list configured redirect URIs for verification\n\n  // Production key warning (no dashboard data)\n  if (report.environment.apiKeyType === 'production' && !report.dashboardSettings) {\n    issues.push({\n      code: 'PROD_API_CALL_BLOCKED',\n      ...ISSUE_DEFINITIONS.PROD_API_CALL_BLOCKED,\n    });\n  }\n\n  // Credential validation issues\n  if (report.credentialValidation) {\n    if (!report.credentialValidation.valid) {\n      issues.push({\n        code: 'INVALID_API_KEY',\n        ...ISSUE_DEFINITIONS.INVALID_API_KEY,\n        details: { error: report.credentialValidation.error },\n      });\n    } else if (!report.credentialValidation.clientIdMatch) {\n      issues.push({\n        code: 'CLIENT_ID_MISMATCH',\n        ...ISSUE_DEFINITIONS.CLIENT_ID_MISMATCH,\n        details: { error: report.credentialValidation.error },\n      });\n    }\n  }\n\n  // Auth pattern findings — map directly to issues\n  if (report.authPatterns) {\n    for (const finding of report.authPatterns.findings) {\n      issues.push({\n        code: finding.code,\n        severity: finding.severity,\n        message: finding.message,\n        remediation: finding.remediation,\n        docsUrl: finding.docsUrl,\n      });\n    }\n  }\n\n  // Skill freshness — warn when agent-installed skills trail the bundled version.\n  // Surfaced so users know their coding agent is using older WorkOS guidance.\n  if (report.skills?.bundledVersion) {\n    const stale = report.skills.agents.filter((a) => a.stale);\n    if (stale.length > 0) {\n      const agentList = stale.map((a) => `${a.agent} (${a.installedVersion ?? 'unknown'})`).join(', ');\n      issues.push({\n        code: 'SKILLS_OUTDATED',\n        severity: 'warning',\n        message: `WorkOS skills outdated for ${agentList} — bundled: ${report.skills.bundledVersion}`,\n        remediation: 'Run: workos skills install',\n        details: { bundledVersion: report.skills.bundledVersion, stale: stale.map((a) => a.agent) },\n      });\n    }\n  }\n\n  return issues;\n}\n\nfunction getUpdateCommand(packageManager: string | null, sdkName: string): string {\n  switch (packageManager) {\n    case 'pnpm':\n      return `pnpm update ${sdkName}`;\n    case 'Yarn V1':\n    case 'Yarn V2/3/4':\n      return `yarn upgrade ${sdkName}`;\n    case 'Bun':\n      return `bun update ${sdkName}`;\n    default:\n      return `npm update ${sdkName}`;\n  }\n}\n"]}
+{"version":3,"file":"issues.js","sourceRoot":"","sources":["../../src/doctor/issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,eAAe,EAAE;QACf,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,uCAAuC;KACjD;IACD,iBAAiB,EAAE;QACjB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,4CAA4C;KACtD;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yBAAyB;QAClC,oCAAoC;KACrC;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,+CAA+C;KACzD;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,8DAA8D;QAC3E,OAAO,EAAE,yBAAyB;KACnC;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yBAAyB;QAClC,mDAAmD;KACpD;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,8CAA8C;KACxD;IACD,qBAAqB,EAAE;QACrB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,mDAAmD;KACjE;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,uCAAuC;KACjD;IACD,kBAAkB,EAAE;QAClB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,4CAA4C;KACtD;IACD,wBAAwB,EAAE;QACxB,QAAQ,EAAE,SAAkB;QAC5B,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,4HAA4H;KAC/H;CACF,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,MAAgD;IAC3E,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,aAAa;IACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,qCAAqC;YAC9C,WAAW,EAAE,yBAAyB,IAAI,EAAE;YAC5C,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG;YAC9E,WAAW,EAAE,QAAQ,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACvF,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,GAAG,iBAAiB,CAAC,wBAAwB;YAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,4BAA4B,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;YAChE,WAAW,EAAE,qDAAqD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IAEtE,6CAA6C;IAC7C,IAAI,MAAM,CAAC,WAAW,CAAC,UAAU,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,GAAG,iBAAiB,CAAC,qBAAqB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,GAAG,iBAAiB,CAAC,eAAe;gBACpC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,GAAG,iBAAiB,CAAC,kBAAkB;gBACvC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,gBAAgB,IAAI,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjG,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,8BAA8B,SAAS,eAAe,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE;gBAC7F,WAAW,EAAE,4BAA4B;gBACzC,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,uDAAuD;IACvD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,2DAA2D,SAAS,eAAe,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBAClH,WAAW,EAAE,yBAAyB;gBACtC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;aAC1F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,cAA6B,EAAE,OAAe;IACtE,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,OAAO,eAAe,OAAO,EAAE,CAAC;QAClC,KAAK,SAAS,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,gBAAgB,OAAO,EAAE,CAAC;QACnC,KAAK,KAAK;YACR,OAAO,cAAc,OAAO,EAAE,CAAC;QACjC;YACE,OAAO,cAAc,OAAO,EAAE,CAAC;IACnC,CAAC;AACH,CAAC","sourcesContent":["import type { Issue, DoctorReport } from './types.js';\nimport { getInstallHint, languageToSdkLanguage } from './checks/language.js';\n\nexport const ISSUE_DEFINITIONS = {\n  MISSING_API_KEY: {\n    severity: 'error' as const,\n    message: 'WORKOS_API_KEY environment variable not set',\n    remediation: 'Set WORKOS_API_KEY in your .env.local file',\n    docsUrl: 'https://dashboard.workos.com/api-keys',\n  },\n  MISSING_CLIENT_ID: {\n    severity: 'error' as const,\n    message: 'WORKOS_CLIENT_ID environment variable not set',\n    remediation: 'Set WORKOS_CLIENT_ID in your .env.local file',\n    docsUrl: 'https://dashboard.workos.com/configuration',\n  },\n  SDK_OUTDATED: {\n    severity: 'warning' as const,\n    message: 'SDK version is outdated',\n    // remediation generated dynamically\n  },\n  COOKIE_DOMAIN_NOT_SET: {\n    severity: 'warning' as const,\n    message: 'Cookie domain not explicitly set',\n    remediation: 'Consider setting WORKOS_COOKIE_DOMAIN for cross-subdomain auth',\n    docsUrl: 'https://workos.com/docs/authkit/cookie-domain',\n  },\n  NO_SDK_FOUND: {\n    severity: 'error' as const,\n    message: 'No WorkOS SDK found in dependencies',\n    remediation: 'Install a WorkOS SDK: npm install @workos-inc/authkit-nextjs',\n    docsUrl: 'https://workos.com/docs',\n  },\n  API_UNREACHABLE: {\n    severity: 'warning' as const,\n    message: 'Cannot reach WorkOS API',\n    // remediation generated dynamically based on error\n  },\n  REDIRECT_URI_MISMATCH: {\n    severity: 'warning' as const,\n    message: 'Redirect URI not found in dashboard configuration',\n    docsUrl: 'https://workos.com/docs/authkit/redirect-uri',\n  },\n  PROD_API_CALL_BLOCKED: {\n    severity: 'warning' as const,\n    message: 'Dashboard settings not fetched (production API key)',\n    remediation: 'Use a staging API key to fetch dashboard settings',\n  },\n  INVALID_API_KEY: {\n    severity: 'error' as const,\n    message: 'API key is invalid or expired',\n    remediation: 'Check your WORKOS_API_KEY in the WorkOS dashboard',\n    docsUrl: 'https://dashboard.workos.com/api-keys',\n  },\n  CLIENT_ID_MISMATCH: {\n    severity: 'error' as const,\n    message: 'Client ID does not match the API key environment',\n    remediation: 'Ensure WORKOS_CLIENT_ID matches the environment for your API key',\n    docsUrl: 'https://dashboard.workos.com/configuration',\n  },\n  HOST_EXECUTION_UNTRUSTED: {\n    severity: 'warning' as const,\n    message: 'Host-only WorkOS state may be unavailable in this shell',\n    remediation:\n      'Agent/CI host execution is untrusted. Re-run this command on the host shell before trusting auth, config, or API failures.',\n  },\n};\n\nexport function detectIssues(report: Omit<DoctorReport, 'issues' | 'summary'>): Issue[] {\n  const issues: Issue[] = [];\n\n  // SDK issues\n  if (!report.sdk.name) {\n    const lang = languageToSdkLanguage(report.language.name);\n    const hint = getInstallHint(lang);\n    issues.push({\n      code: 'NO_SDK_FOUND',\n      severity: 'error',\n      message: 'No WorkOS SDK found in dependencies',\n      remediation: `Install a WorkOS SDK: ${hint}`,\n      docsUrl: 'https://workos.com/docs',\n    });\n  } else if (report.sdk.outdated && report.sdk.version && report.sdk.latest) {\n    issues.push({\n      code: 'SDK_OUTDATED',\n      severity: 'warning',\n      message: `SDK version outdated (${report.sdk.version} → ${report.sdk.latest})`,\n      remediation: `Run: ${getUpdateCommand(report.runtime.packageManager, report.sdk.name)}`,\n      details: { installed: report.sdk.version, latest: report.sdk.latest },\n    });\n  }\n\n  // Environment issues\n  if (!report.environment.apiKeyConfigured) {\n    issues.push({ code: 'MISSING_API_KEY', ...ISSUE_DEFINITIONS.MISSING_API_KEY });\n  }\n\n  if (!report.environment.clientId) {\n    issues.push({ code: 'MISSING_CLIENT_ID', ...ISSUE_DEFINITIONS.MISSING_CLIENT_ID });\n  }\n\n  if (report.sdk.isAuthKit && !report.environment.cookieDomain) {\n    issues.push({ code: 'COOKIE_DOMAIN_NOT_SET', ...ISSUE_DEFINITIONS.COOKIE_DOMAIN_NOT_SET });\n  }\n\n  if (!report.hostExecution.ok) {\n    issues.push({\n      code: 'HOST_EXECUTION_UNTRUSTED',\n      ...ISSUE_DEFINITIONS.HOST_EXECUTION_UNTRUSTED,\n      details: { failures: report.hostExecution.failures },\n    });\n  }\n\n  // Connectivity issues\n  if (!report.connectivity.apiReachable && !report.connectivity.error?.includes('Skipped')) {\n    issues.push({\n      code: 'API_UNREACHABLE',\n      severity: 'warning',\n      message: `Cannot reach WorkOS API: ${report.connectivity.error}`,\n      remediation: 'Check your network connection and firewall settings',\n    });\n  }\n\n  // Note: Redirect URI mismatch detection disabled - WorkOS API doesn't expose\n  // a public endpoint to list configured redirect URIs for verification\n\n  // Production key warning (no dashboard data)\n  if (report.environment.apiKeyType === 'production' && !report.dashboardSettings) {\n    issues.push({\n      code: 'PROD_API_CALL_BLOCKED',\n      ...ISSUE_DEFINITIONS.PROD_API_CALL_BLOCKED,\n    });\n  }\n\n  // Credential validation issues\n  if (report.credentialValidation) {\n    if (!report.credentialValidation.valid) {\n      issues.push({\n        code: 'INVALID_API_KEY',\n        ...ISSUE_DEFINITIONS.INVALID_API_KEY,\n        details: { error: report.credentialValidation.error },\n      });\n    } else if (!report.credentialValidation.clientIdMatch) {\n      issues.push({\n        code: 'CLIENT_ID_MISMATCH',\n        ...ISSUE_DEFINITIONS.CLIENT_ID_MISMATCH,\n        details: { error: report.credentialValidation.error },\n      });\n    }\n  }\n\n  // Auth pattern findings — map directly to issues\n  if (report.authPatterns) {\n    for (const finding of report.authPatterns.findings) {\n      issues.push({\n        code: finding.code,\n        severity: finding.severity,\n        message: finding.message,\n        remediation: finding.remediation,\n        docsUrl: finding.docsUrl,\n      });\n    }\n  }\n\n  // Skill freshness — warn when agent-installed skills trail the bundled version.\n  // Surfaced so users know their coding agent is using older WorkOS guidance.\n  if (report.skills?.bundledVersion) {\n    const stale = report.skills.agents.filter((a) => a.stale);\n    if (stale.length > 0) {\n      const agentList = stale.map((a) => `${a.agent} (${a.installedVersion ?? 'unknown'})`).join(', ');\n      issues.push({\n        code: 'SKILLS_OUTDATED',\n        severity: 'warning',\n        message: `WorkOS skills outdated for ${agentList} — bundled: ${report.skills.bundledVersion}`,\n        remediation: 'Run: workos skills install',\n        details: { bundledVersion: report.skills.bundledVersion, stale: stale.map((a) => a.agent) },\n      });\n    }\n  }\n\n  // MCP server URL drift — warn ONLY when a configured entry points at an\n  // unexpected URL. Absent MCP is never an issue: the user may have declined\n  // the offer, and doctor reports state without judging.\n  if (report.mcp) {\n    const misconfigured = report.mcp.agents.filter((a) => a.misconfigured);\n    if (misconfigured.length > 0) {\n      const agentList = misconfigured.map((a) => a.agent).join(', ');\n      issues.push({\n        code: 'MCP_MISCONFIGURED',\n        severity: 'warning',\n        message: `WorkOS MCP server configured with an unexpected URL for ${agentList} — expected ${report.mcp.serverUrl}`,\n        remediation: 'Run: workos mcp install',\n        details: { agents: misconfigured.map((a) => a.agent), expectedUrl: report.mcp.serverUrl },\n      });\n    }\n  }\n\n  return issues;\n}\n\nfunction getUpdateCommand(packageManager: string | null, sdkName: string): string {\n  switch (packageManager) {\n    case 'pnpm':\n      return `pnpm update ${sdkName}`;\n    case 'Yarn V1':\n    case 'Yarn V2/3/4':\n      return `yarn upgrade ${sdkName}`;\n    case 'Bun':\n      return `bun update ${sdkName}`;\n    default:\n      return `npm update ${sdkName}`;\n  }\n}\n"]}

package/dist/doctor/output.js

@@ -175,6 +175,22 @@ export function formatReport(report, options) {
             console.log(`   ${Chalk.green('✓')} Updated WorkOS skills for ${displayName(slug)}: ${before} → ${after}`);
         }
     }
+    // MCP Server (per detected coding agent)
+    if (report.mcp) {
+        console.log('');
+        console.log('MCP Server');
+        for (const agent of report.mcp.agents) {
+            if (agent.misconfigured) {
+                console.log(`   ${Chalk.yellow('!')} ${agent.agent}: configured with an unexpected URL`);
+            }
+            else if (agent.installed) {
+                console.log(`   ${Chalk.green('✓')} ${agent.agent}: installed`);
+            }
+            else {
+                console.log(`   ${agent.agent}: ${Chalk.dim('not installed')}`);
+            }
+        }
+    }
     // Verbose mode additions
     if (options?.verbose) {
         console.log('');
@@ -235,8 +251,6 @@ export function formatInteractionModeSource(source) {
             return '--mode';
         case 'env':
             return 'WORKOS_MODE';
-        case 'workos_no_prompt':
-            return 'WORKOS_NO_PROMPT';
         case 'ci_env':
             return 'CI environment';
         case 'agent_env':