workos 0.17.1 → 0.18.0

package/dist/cli.config.d.ts

@@ -5,8 +5,6 @@ export declare const config: {
     readonly workos: {
         readonly clientId: "client_01KFKHSZWK9ADVJV854PDFQCCR";
         readonly authkitDomain: "https://signin.workos.com";
-        readonly llmGatewayUrl: "https://api.workos.com/llm-gateway";
-        readonly telemetryUrl: "https://api.workos.com/cli";
     };
     readonly telemetry: {
         readonly enabled: true;

package/dist/cli.config.js

@@ -3,12 +3,12 @@ export const version = pkg.version;
 export const config = {
     model: 'claude-opus-4-5-20251101',
     doctorModel: 'claude-haiku-4-5-20251001',
-    // Production defaults - override via env vars for local dev
+    // Production defaults - override via env vars for local dev.
+    // The LLM gateway and CLI telemetry endpoints live under the WorkOS API
+    // host, so they're derived from WORKOS_API_URL rather than configured here.
     workos: {
         clientId: 'client_01KFKHSZWK9ADVJV854PDFQCCR',
         authkitDomain: 'https://signin.workos.com',
-        llmGatewayUrl: 'https://api.workos.com/llm-gateway',
-        telemetryUrl: 'https://api.workos.com/cli',
     },
     telemetry: {
         enabled: true,

package/dist/cli.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.config.js","sourceRoot":"","sources":["../src/cli.config.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExD,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;AAEnC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,2BAA2B;IAExC,4DAA4D;IAC5D,MAAM,EAAE;QACN,QAAQ,EAAE,mCAAmC;QAC7C,aAAa,EAAE,2BAA2B;QAC1C,aAAa,EAAE,oCAAoC;QACnD,YAAY,EAAE,4BAA4B;KAC3C;IAED,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,uBAAuB;KACnC;IAED,KAAK,EAAE;QACL,uEAAuE;QACvE,kBAAkB,EAAE,MAAM;KAC3B;IAED,WAAW,EAAE,SAAS;IAEtB,OAAO,EAAE;QACP,SAAS,EAAE,KAAK;KACjB;IAED,aAAa,EAAE;QACb,aAAa,EAAE,iCAAiC;QAChD,YAAY,EAAE,8BAA8B;QAC5C,SAAS,EAAE,sCAAsC;KAClD;IAED,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;QACD,aAAa,EAAE;YACb,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,oBAAoB;SACnC;QACD,WAAW,EAAE;YACX,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,iBAAiB;SAChC;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,GAAG,EAAE;YACH,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,UAAU,EAAE;YACV,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,EAAE,EAAE;YACF,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;KACF;IAED,MAAM,EAAE;QACN,SAAS,EAAE,IAAI;KAChB;IAED,QAAQ,EAAE;QACR,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,4BAA4B;QAC7C,QAAQ,EAAE;;;;;;;;;;;;;;;;wEAgB0D;KACrE;CACiC,CAAC","sourcesContent":["import type { InstallerConfig } from './lib/settings.js';\nimport pkg from '../package.json' with { type: 'json' };\n\nexport const version = pkg.version;\n\nexport const config = {\n  model: 'claude-opus-4-5-20251101',\n  doctorModel: 'claude-haiku-4-5-20251001',\n\n  // Production defaults - override via env vars for local dev\n  workos: {\n    clientId: 'client_01KFKHSZWK9ADVJV854PDFQCCR',\n    authkitDomain: 'https://signin.workos.com',\n    llmGatewayUrl: 'https://api.workos.com/llm-gateway',\n    telemetryUrl: 'https://api.workos.com/cli',\n  },\n\n  telemetry: {\n    enabled: true,\n    eventName: 'installer interaction',\n  },\n\n  proxy: {\n    // Refresh token when it expires within this window (default: 1 minute)\n    refreshThresholdMs: 60_000,\n  },\n\n  nodeVersion: '>=20.20',\n\n  logging: {\n    debugMode: false,\n  },\n\n  documentation: {\n    workosDocsUrl: 'https://workos.com/docs/authkit',\n    dashboardUrl: 'https://dashboard.workos.com',\n    issuesUrl: 'https://github.com/workos/cli/issues',\n  },\n\n  frameworks: {\n    nextjs: {\n      port: 3000,\n      callbackPath: '/auth/callback',\n    },\n    react: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n    tanstackStart: {\n      port: 3000,\n      callbackPath: '/api/auth/callback',\n    },\n    reactRouter: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n    vanillaJs: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n    python: {\n      port: 8000,\n      callbackPath: '/auth/callback/',\n    },\n    ruby: {\n      port: 3000,\n      callbackPath: '/auth/callback',\n    },\n    php: {\n      port: 8000,\n      callbackPath: '/auth/callback',\n    },\n    phpLaravel: {\n      port: 8000,\n      callbackPath: '/auth/callback',\n    },\n    go: {\n      port: 8080,\n      callbackPath: '/auth/callback',\n    },\n    dotnet: {\n      port: 5000,\n      callbackPath: '/auth/callback',\n    },\n    elixir: {\n      port: 4000,\n      callbackPath: '/auth/callback',\n    },\n    kotlin: {\n      port: 8080,\n      callbackPath: '/auth/callback',\n    },\n  },\n\n  legacy: {\n    oauthPort: 8239,\n  },\n\n  branding: {\n    showAsciiArt: true,\n    useCompact: false,\n    compactAsciiArt: `⚡ WorkOS AuthKit Installer`,\n    asciiArt: `░██       ░██                     ░██         ░██████     ░██████\n░██       ░██                     ░██        ░██   ░██   ░██   ░██\n░██  ░██  ░██  ░███████  ░██░████ ░██    ░██░██     ░██ ░██\n░██ ░████ ░██ ░██    ░██ ░███     ░██   ░██ ░██     ░██  ░████████\n░██░██ ░██░██ ░██    ░██ ░██      ░███████  ░██     ░██         ░██\n░████   ░████ ░██    ░██ ░██      ░██   ░██  ░██   ░██   ░██   ░██\n░███     ░███  ░███████  ░██      ░██    ░██  ░██████     ░██████\n\n\n\n   ░███                  ░██    ░██        ░██     ░██ ░██   ░██\n  ░██░██                 ░██    ░██        ░██    ░██        ░██\n ░██  ░██  ░██    ░██ ░████████ ░████████  ░██   ░██   ░██░████████\n░█████████ ░██    ░██    ░██    ░██    ░██ ░███████    ░██   ░██\n░██    ░██ ░██    ░██    ░██    ░██    ░██ ░██   ░██   ░██   ░██\n░██    ░██ ░██   ░███    ░██    ░██    ░██ ░██    ░██  ░██   ░██\n░██    ░██  ░█████░██     ░████ ░██    ░██ ░██     ░██ ░██    ░████    `,\n  },\n} as const satisfies InstallerConfig;\n"]}
+{"version":3,"file":"cli.config.js","sourceRoot":"","sources":["../src/cli.config.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExD,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;AAEnC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,2BAA2B;IAExC,6DAA6D;IAC7D,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,EAAE;QACN,QAAQ,EAAE,mCAAmC;QAC7C,aAAa,EAAE,2BAA2B;KAC3C;IAED,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,uBAAuB;KACnC;IAED,KAAK,EAAE;QACL,uEAAuE;QACvE,kBAAkB,EAAE,MAAM;KAC3B;IAED,WAAW,EAAE,SAAS;IAEtB,OAAO,EAAE;QACP,SAAS,EAAE,KAAK;KACjB;IAED,aAAa,EAAE;QACb,aAAa,EAAE,iCAAiC;QAChD,YAAY,EAAE,8BAA8B;QAC5C,SAAS,EAAE,sCAAsC;KAClD;IAED,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;QACD,aAAa,EAAE;YACb,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,oBAAoB;SACnC;QACD,WAAW,EAAE;YACX,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,WAAW;SAC1B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,iBAAiB;SAChC;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,GAAG,EAAE;YACH,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,UAAU,EAAE;YACV,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,EAAE,EAAE;YACF,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,gBAAgB;SAC/B;KACF;IAED,MAAM,EAAE;QACN,SAAS,EAAE,IAAI;KAChB;IAED,QAAQ,EAAE;QACR,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,4BAA4B;QAC7C,QAAQ,EAAE;;;;;;;;;;;;;;;;wEAgB0D;KACrE;CACiC,CAAC","sourcesContent":["import type { InstallerConfig } from './lib/settings.js';\nimport pkg from '../package.json' with { type: 'json' };\n\nexport const version = pkg.version;\n\nexport const config = {\n  model: 'claude-opus-4-5-20251101',\n  doctorModel: 'claude-haiku-4-5-20251001',\n\n  // Production defaults - override via env vars for local dev.\n  // The LLM gateway and CLI telemetry endpoints live under the WorkOS API\n  // host, so they're derived from WORKOS_API_URL rather than configured here.\n  workos: {\n    clientId: 'client_01KFKHSZWK9ADVJV854PDFQCCR',\n    authkitDomain: 'https://signin.workos.com',\n  },\n\n  telemetry: {\n    enabled: true,\n    eventName: 'installer interaction',\n  },\n\n  proxy: {\n    // Refresh token when it expires within this window (default: 1 minute)\n    refreshThresholdMs: 60_000,\n  },\n\n  nodeVersion: '>=20.20',\n\n  logging: {\n    debugMode: false,\n  },\n\n  documentation: {\n    workosDocsUrl: 'https://workos.com/docs/authkit',\n    dashboardUrl: 'https://dashboard.workos.com',\n    issuesUrl: 'https://github.com/workos/cli/issues',\n  },\n\n  frameworks: {\n    nextjs: {\n      port: 3000,\n      callbackPath: '/auth/callback',\n    },\n    react: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n    tanstackStart: {\n      port: 3000,\n      callbackPath: '/api/auth/callback',\n    },\n    reactRouter: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n    vanillaJs: {\n      port: 5173,\n      callbackPath: '/callback',\n    },\n    python: {\n      port: 8000,\n      callbackPath: '/auth/callback/',\n    },\n    ruby: {\n      port: 3000,\n      callbackPath: '/auth/callback',\n    },\n    php: {\n      port: 8000,\n      callbackPath: '/auth/callback',\n    },\n    phpLaravel: {\n      port: 8000,\n      callbackPath: '/auth/callback',\n    },\n    go: {\n      port: 8080,\n      callbackPath: '/auth/callback',\n    },\n    dotnet: {\n      port: 5000,\n      callbackPath: '/auth/callback',\n    },\n    elixir: {\n      port: 4000,\n      callbackPath: '/auth/callback',\n    },\n    kotlin: {\n      port: 8080,\n      callbackPath: '/auth/callback',\n    },\n  },\n\n  legacy: {\n    oauthPort: 8239,\n  },\n\n  branding: {\n    showAsciiArt: true,\n    useCompact: false,\n    compactAsciiArt: `⚡ WorkOS AuthKit Installer`,\n    asciiArt: `░██       ░██                     ░██         ░██████     ░██████\n░██       ░██                     ░██        ░██   ░██   ░██   ░██\n░██  ░██  ░██  ░███████  ░██░████ ░██    ░██░██     ░██ ░██\n░██ ░████ ░██ ░██    ░██ ░███     ░██   ░██ ░██     ░██  ░████████\n░██░██ ░██░██ ░██    ░██ ░██      ░███████  ░██     ░██         ░██\n░████   ░████ ░██    ░██ ░██      ░██   ░██  ░██   ░██   ░██   ░██\n░███     ░███  ░███████  ░██      ░██    ░██  ░██████     ░██████\n\n\n\n   ░███                  ░██    ░██        ░██     ░██ ░██   ░██\n  ░██░██                 ░██    ░██        ░██    ░██        ░██\n ░██  ░██  ░██    ░██ ░████████ ░████████  ░██   ░██   ░██░████████\n░█████████ ░██    ░██    ░██    ░██    ░██ ░███████    ░██   ░██\n░██    ░██ ░██    ░██    ░██    ░██    ░██ ░██   ░██   ░██   ░██\n░██    ░██ ░██   ░███    ░██    ░██    ░██ ░██    ░██  ░██   ░██\n░██    ░██  ░█████░██     ░████ ░██    ░██ ░██     ░██ ░██    ░████    `,\n  },\n} as const satisfies InstallerConfig;\n"]}

package/dist/commands/debug.d.ts

@@ -13,5 +13,16 @@ export declare function runDebugSimulate({ expiredToken, noKeyring, unclaimed, n
     noAuth: boolean;
     crash?: boolean;
 }): Promise<void>;
+/**
+ * Catalog of WORKOS_-prefixed environment variables the CLI reads.
+ *
+ * This is the single source of truth for `workos debug env`. A unit test
+ * (env-var-catalog.spec.ts) scans the source for `process.env.WORKOS_*` reads
+ * and fails if any are missing here, so this list can't silently drift.
+ */
+export declare const ENV_VAR_CATALOG: {
+    name: string;
+    effect: string;
+}[];
 export declare function runDebugEnv(): Promise<void>;
 export declare function runDebugToken(): Promise<void>;

package/dist/commands/debug.js

@@ -291,20 +291,36 @@ export async function runDebugSimulate({ expiredToken, noKeyring, unclaimed, noA
         }
     }
 }
-const ENV_VAR_CATALOG = [
-    { name: 'WORKOS_DEBUG', effect: 'Set to "1" to enable verbose debug logging for all commands' },
+/**
+ * Catalog of WORKOS_-prefixed environment variables the CLI reads.
+ *
+ * This is the single source of truth for `workos debug env`. A unit test
+ * (env-var-catalog.spec.ts) scans the source for `process.env.WORKOS_*` reads
+ * and fails if any are missing here, so this list can't silently drift.
+ */
+export const ENV_VAR_CATALOG = [
+    // Credentials
     { name: 'WORKOS_API_KEY', effect: 'Bypasses credential resolution — used directly for API calls' },
+    { name: 'WORKOS_CLIENT_ID', effect: 'WorkOS client ID used during credential resolution' },
+    // Interaction & output
     { name: 'WORKOS_MODE', effect: 'Controls interaction behavior: human, agent, or CI' },
+    { name: 'WORKOS_AGENT', effect: 'Set to "1" to force agent interaction mode' },
     { name: 'WORKOS_FORCE_TTY', effect: 'Forces human (non-JSON) output mode, even when piped' },
-    { name: 'WORKOS_NO_PROMPT', effect: 'Legacy compatibility alias for agent interaction behavior and JSON output' },
+    { name: 'WORKOS_DEBUG', effect: 'Set to "1" to enable verbose debug logging for all commands' },
     { name: 'WORKOS_TELEMETRY', effect: 'Set to "false" to disable telemetry' },
-    { name: 'WORKOS_API_URL', effect: 'Overrides API base URL (default: https://api.workos.com)' },
+    // URLs (WORKOS_API_URL is the single base; gateway + telemetry derive from it)
+    {
+        name: 'WORKOS_API_URL',
+        effect: 'Overrides API base URL; also reroutes the LLM gateway and CLI telemetry endpoints',
+    },
     { name: 'WORKOS_DASHBOARD_URL', effect: 'Overrides dashboard URL (default: https://dashboard.workos.com)' },
     { name: 'WORKOS_AUTHKIT_DOMAIN', effect: 'Overrides AuthKit domain from settings' },
-    { name: 'WORKOS_LLM_GATEWAY_URL', effect: 'Overrides LLM gateway URL from settings' },
-    { name: 'WORKOS_TELEMETRY_URL', effect: 'Overrides CLI telemetry URL from settings' },
-    { name: 'INSTALLER_DEV', effect: 'Enables dev mode — loads .env.local at startup' },
-    { name: 'INSTALLER_DISABLE_PROXY', effect: 'Disables the credential proxy for gateway auth' },
+    { name: 'WORKOS_BASE_URL', effect: 'AuthKit base URL, read during doctor environment checks' },
+    { name: 'WORKOS_REDIRECT_URI', effect: 'OAuth redirect URI, read during doctor environment checks' },
+    { name: 'WORKOS_COOKIE_DOMAIN', effect: 'Session cookie domain, read during doctor environment checks' },
+    // Development
+    { name: 'WORKOS_DEV', effect: 'Enables dev mode — loads .env.local at startup' },
+    { name: 'WORKOS_DISABLE_PROXY', effect: 'Disables the credential proxy for gateway auth' },
 ];
 export async function runDebugEnv() {
     const vars = ENV_VAR_CATALOG.map(({ name, effect }) => ({

package/dist/commands/debug.js.map

@@ -1 +1 @@
-{"version":3,"file":"debug.js","sourceRoot":"","sources":["../../src/commands/debug.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,UAAU,EACV,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,EAAU;IACrC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACnD,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACvD,OAAO,GAAG,OAAO,GAAG,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,WAAqB;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAE/E,IAAI,UAAU;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,UAAU;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sBAAsB;AAEtB,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAE,WAAW,EAA4B;IAC3E,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAE5E,MAAM,iBAAiB,GAA4B,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE5F,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACvD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,OAAO;gBAChB,CAAC,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM;gBACtD,CAAC,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE;YAC9C,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,iBAAiB,CAAC,OAAO,GAAG;gBAC1B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;gBAChC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAA4B,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAEpE,IAAI,MAAM,EAAE,CAAC;QACX,YAAY,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC;QAClE,YAAY,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YACtD,GAAG;YACH;gBACE,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC/B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;aAC7E;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,cAAc,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;IAClE,YAAY,CAAC,MAAM,GAAG,YAAY,CAAC;IAEnC,MAAM,eAAe,GAAG;QACtB,OAAO,EAAE,kBAAkB,EAAE;QAC7B,QAAQ,EAAE,mBAAmB,EAAE;QAC/B,MAAM,EAAE,kBAAkB,EAAE;QAC5B,WAAW,EAAE,aAAa,EAAE;KAC7B,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,eAAe;QAC1B,OAAO,EAAE;YACP,eAAe,EAAE,kBAAkB,EAAE;YACrC,UAAU,EAAE,aAAa,EAAE;YAC3B,eAAe,EAAE,kBAAkB,EAAE;YACrC,qBAAqB,EAAE,WAAW;YAClC,iBAAiB;SAClB;KACF,CAAC;IAEF,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,cAAc,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CACpJ,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,OAAO,CAAC,QAAQ,WAAW,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,cAAc,YAAY,EAAE,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,iBAAiB,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,WAAW,GAAG,CAAC,IAAI,WAAW,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjF,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAE7F,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,WAAW,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,aAAa,EAAE,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,WAAW,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,sBAAsB;AAEtB,uEAAuE;AACvE,SAAS,UAAU,CAAC,KAAe;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,KAAK,EACL,eAAe,EACf,UAAU,GAKX;IACC,4CAA4C;IAC5C,MAAM,UAAU,GAAG,CAAC,UAAU,IAAI,eAAe,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,eAAe,IAAI,UAAU,CAAC;IACjD,8EAA8E;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,UAAU,GAAG,SAAS,CAAC;IAE7B,MAAM,OAAO,GAAG,UAAU,CACxB,CAAC,UAAU,IAAI,aAAa,EAAE,SAAS,IAAI,QAAQ,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAC9G,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACvB,aAAa,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,0CAA0C;aACpD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;YACpC,OAAO,EAAE,aAAa,OAAO,0BAA0B;SACxD,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACpC,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,UAAU;QAAE,gBAAgB,EAAE,CAAC;IACnC,IAAI,SAAS;QAAE,WAAW,EAAE,CAAC;IAC7B,IAAI,UAAU;QAAE,gBAAgB,EAAE,CAAC;IAEnC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,yBAAyB;AAEzB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,YAAY,EACZ,SAAS,EACT,SAAS,EACT,MAAM,EACN,KAAK,GAAG,KAAK,GAOd;IACC,wEAAwE;IACxE,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzD,aAAa,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;QAC3B,aAAa,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,uFAAuF;IAEvF,IAAI,SAAS,EAAE,CAAC;QACd,wCAAwC;QACxC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAE3B,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,KAAK;YAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAE/B,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,aAAa,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,gBAAgB,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,qBAAqB,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG;YAC7B,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,0CAA0C;YAClD,QAAQ,EAAE,kBAAkB;YAC5B,UAAU,EAAE,oCAAoC;SACjD,CAAC;QACF,MAAM,CAAC,iBAAiB,GAAG,OAAO,CAAC;QACnC,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,kCAAkC,OAAO,qBAAqB,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAUD,MAAM,eAAe,GAAuC;IAC1D,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6DAA6D,EAAE;IAC/F,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,8DAA8D,EAAE;IAClG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE;IACrF,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,sDAAsD,EAAE;IAC5F,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,2EAA2E,EAAE;IACjH,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE;IAC3E,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,0DAA0D,EAAE;IAC9F,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iEAAiE,EAAE;IAC3G,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,wCAAwC,EAAE;IACnF,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,yCAAyC,EAAE;IACrF,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,2CAA2C,EAAE;IACrF,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,gDAAgD,EAAE;IACnF,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,gDAAgD,EAAE;CAC9F,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,IAAI,GAAiB,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM;KACP,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAE5D,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC;YACT,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACtG,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/B,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACpC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,sBAAsB;AAEtB,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEnD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC;YACT,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;YACjC,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,OAAO;gBAChB,CAAC,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM;gBACtD,CAAC,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE;YAC9C,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CACpJ,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAE,KAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CACpJ,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC","sourcesContent":["import chalk from 'chalk';\nimport clack from '../utils/clack.js';\nimport {\n  getCredentials,\n  saveCredentials,\n  clearCredentials,\n  isTokenExpired,\n  diagnoseCredentials,\n  getCredentialsPath,\n  setInsecureStorage,\n} from '../lib/credentials.js';\nimport {\n  getConfig,\n  saveConfig,\n  clearConfig,\n  getConfigPath,\n  setInsecureConfigStorage,\n  diagnoseConfig,\n} from '../lib/config-store.js';\nimport {\n  clearPreferences,\n  getPreferencesPath,\n  getTelemetrySource,\n  isNoticeShown,\n  isTelemetryEnabled,\n  isTelemetryOptedOut,\n} from '../lib/preferences.js';\nimport { isJsonMode, outputJson, exitWithError } from '../utils/output.js';\nimport { isPromptAllowed } from '../utils/interaction-mode.js';\n\nfunction maskSecret(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  if (value.length <= 8) return '****';\n  return value.slice(0, 4) + '****' + value.slice(-4);\n}\n\nfunction formatTimeRemaining(ms: number): string {\n  if (ms <= 0) return 'expired';\n  const seconds = Math.floor(ms / 1000);\n  const minutes = Math.floor(seconds / 60);\n  const hours = Math.floor(minutes / 60);\n  if (hours > 0) return `${hours}h ${minutes % 60}m`;\n  if (minutes > 0) return `${minutes}m ${seconds % 60}s`;\n  return `${seconds}s`;\n}\n\nfunction parseJwt(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));\n  } catch {\n    return null;\n  }\n}\n\nfunction determineCredentialSource(diagnostics: string[]): 'keyring' | 'file' | 'none' {\n  const hasKeyring = diagnostics.some((l) => l.startsWith('keyring: found'));\n  const hasFile = diagnostics.some((l) => l.includes('exists=true'));\n  const isInsecure = diagnostics.some((l) => l.includes('insecureStorage=true'));\n\n  if (isInsecure) return hasFile ? 'file' : 'none';\n  if (hasKeyring) return 'keyring';\n  if (hasFile) return 'file';\n  return 'none';\n}\n\n// --- debug state ---\n\nexport async function runDebugState({ showSecrets }: { showSecrets: boolean }): Promise<void> {\n  const creds = getCredentials();\n  const config = getConfig();\n  const diagnostics = diagnoseCredentials();\n  const credSource = determineCredentialSource(diagnostics);\n  const maybeRedact = showSecrets ? (v: string | undefined) => v : maskSecret;\n\n  const credentialsOutput: Record<string, unknown> = { present: !!creds, source: credSource };\n\n  if (creds) {\n    const timeRemaining = creds.expiresAt - Date.now();\n    const expired = isTokenExpired(creds);\n    Object.assign(credentialsOutput, {\n      userId: creds.userId,\n      email: creds.email ?? null,\n      accessToken: maybeRedact(creds.accessToken),\n      refreshToken: creds.refreshToken ? 'present' : 'absent',\n      expiresAt: creds.expiresAt,\n      expiresIn: expired\n        ? `expired ${formatTimeRemaining(-timeRemaining)} ago`\n        : `in ${formatTimeRemaining(timeRemaining)}`,\n      isExpired: expired,\n    });\n    if (creds.staging) {\n      credentialsOutput.staging = {\n        clientId: creds.staging.clientId,\n        apiKey: maybeRedact(creds.staging.apiKey),\n        fetchedAt: creds.staging.fetchedAt,\n      };\n    }\n  }\n\n  const configOutput: Record<string, unknown> = { present: !!config };\n\n  if (config) {\n    configOutput.activeEnvironment = config.activeEnvironment ?? null;\n    configOutput.environments = Object.fromEntries(\n      Object.entries(config.environments).map(([key, env]) => [\n        key,\n        {\n          name: env.name,\n          type: env.type,\n          apiKey: maybeRedact(env.apiKey),\n          clientId: env.clientId ?? null,\n          endpoint: env.endpoint ?? null,\n          ...(env.type === 'unclaimed' && { claimToken: maybeRedact(env.claimToken) }),\n        },\n      ]),\n    );\n  }\n\n  const configDiagnostics = diagnoseConfig();\n  const configSource = determineCredentialSource(configDiagnostics);\n  configOutput.source = configSource;\n\n  const telemetryOutput = {\n    enabled: isTelemetryEnabled(),\n    optedOut: isTelemetryOptedOut(),\n    source: getTelemetrySource(),\n    noticeShown: isNoticeShown(),\n  };\n\n  const result = {\n    credentials: credentialsOutput,\n    config: configOutput,\n    telemetry: telemetryOutput,\n    storage: {\n      credentialsPath: getCredentialsPath(),\n      configPath: getConfigPath(),\n      preferencesPath: getPreferencesPath(),\n      credentialDiagnostics: diagnostics,\n      configDiagnostics,\n    },\n  };\n\n  if (isJsonMode()) {\n    outputJson(result);\n    return;\n  }\n\n  console.log(chalk.bold('Credentials'));\n  console.log(`  present: ${creds ? chalk.green('true') : chalk.yellow('false')}`);\n  console.log(`  source:  ${credSource}`);\n  if (creds) {\n    console.log(`  userId:  ${creds.userId}`);\n    console.log(`  email:   ${creds.email ?? chalk.dim('none')}`);\n    console.log(`  token:   ${maybeRedact(creds.accessToken)}`);\n    console.log(`  refresh: ${creds.refreshToken ? 'present' : 'absent'}`);\n    const expired = isTokenExpired(creds);\n    const timeRemaining = creds.expiresAt - Date.now();\n    console.log(\n      `  expires: ${expired ? chalk.red(`expired ${formatTimeRemaining(-timeRemaining)} ago`) : chalk.green(`in ${formatTimeRemaining(timeRemaining)}`)}`,\n    );\n    if (creds.staging) {\n      console.log(`  staging: clientId=${creds.staging.clientId} apiKey=${maybeRedact(creds.staging.apiKey)}`);\n    }\n  }\n\n  console.log();\n  console.log(chalk.bold('Config'));\n  console.log(`  present: ${config ? chalk.green('true') : chalk.yellow('false')}`);\n  console.log(`  source:  ${configSource}`);\n  if (config) {\n    console.log(`  active:  ${config.activeEnvironment ?? chalk.dim('none')}`);\n    for (const [key, env] of Object.entries(config.environments)) {\n      console.log(`  env[${key}]: type=${env.type} apiKey=${maybeRedact(env.apiKey)}`);\n      if (env.type === 'unclaimed') console.log(`    claimToken=${maybeRedact(env.claimToken)}`);\n    }\n  }\n\n  console.log();\n  console.log(chalk.bold('Telemetry'));\n  console.log(`  enabled:  ${telemetryOutput.enabled ? chalk.green('true') : chalk.yellow('false')}`);\n  console.log(`  optedOut: ${telemetryOutput.optedOut ? chalk.yellow('true') : 'false'}`);\n  console.log(`  source:   ${telemetryOutput.source}`);\n  console.log(`  notice:   ${telemetryOutput.noticeShown ? 'shown' : chalk.dim('not shown')}`);\n\n  console.log();\n  console.log(chalk.bold('Storage — Credentials'));\n  console.log(`  path: ${getCredentialsPath()}`);\n  for (const line of diagnostics) {\n    console.log(`  ${chalk.dim(line)}`);\n  }\n\n  console.log();\n  console.log(chalk.bold('Storage — Config'));\n  console.log(`  path: ${getConfigPath()}`);\n  for (const line of configDiagnostics) {\n    console.log(`  ${chalk.dim(line)}`);\n  }\n\n  console.log();\n  console.log(chalk.bold('Storage — Preferences'));\n  console.log(`  path: ${getPreferencesPath()}`);\n}\n\n// --- debug reset ---\n\n/** Join names with an Oxford comma: [\"a\",\"b\",\"c\"] => \"a, b, and c\". */\nfunction formatList(items: string[]): string {\n  if (items.length <= 1) return items.join('');\n  if (items.length === 2) return `${items[0]} and ${items[1]}`;\n  return `${items.slice(0, -1).join(', ')}, and ${items[items.length - 1]}`;\n}\n\nexport async function runDebugReset({\n  force,\n  credentialsOnly,\n  configOnly,\n}: {\n  force: boolean;\n  credentialsOnly: boolean;\n  configOnly: boolean;\n}): Promise<void> {\n  // Both flags = clear both (same as neither)\n  const clearCreds = !configOnly || credentialsOnly;\n  const clearConf = !credentialsOnly || configOnly;\n  // Preferences (~/.workos/preferences.json) are non-secret local CLI state, so\n  // they ride with the config target. Clearing config returns the CLI to a\n  // fresh-install state, which includes resetting the telemetry preference.\n  const clearPrefs = clearConf;\n\n  const targets = formatList(\n    [clearCreds && 'credentials', clearConf && 'config', clearPrefs && 'preferences'].filter(Boolean) as string[],\n  );\n\n  if (!force) {\n    if (!isPromptAllowed()) {\n      exitWithError({\n        code: 'non_interactive_reset',\n        message: 'Use --force to reset in agent or CI mode',\n      });\n    }\n\n    const confirmed = await clack.confirm({\n      message: `Clear all ${targets}? This cannot be undone.`,\n    });\n\n    if (clack.isCancel(confirmed) || !confirmed) {\n      if (isJsonMode()) {\n        outputJson({ cleared: false, cancelled: true });\n      } else {\n        clack.log.info('Reset cancelled');\n      }\n      return;\n    }\n  }\n\n  if (clearCreds) clearCredentials();\n  if (clearConf) clearConfig();\n  if (clearPrefs) clearPreferences();\n\n  if (isJsonMode()) {\n    outputJson({ cleared: true, credentials: clearCreds, config: clearConf, preferences: clearPrefs });\n  } else {\n    clack.log.success(`Cleared ${targets}`);\n  }\n}\n\n// --- debug simulate ---\n\nexport async function runDebugSimulate({\n  expiredToken,\n  noKeyring,\n  unclaimed,\n  noAuth,\n  crash = false,\n}: {\n  expiredToken: boolean;\n  noKeyring: boolean;\n  unclaimed: boolean;\n  noAuth: boolean;\n  crash?: boolean;\n}): Promise<void> {\n  // Simulate an unexpected crash to exercise the crash-telemetry pipeline\n  // end-to-end. Throws a plain Error (not CliExit) so the bin.ts lifecycle\n  // records a `crash` event with a sanitized stack rather than a handled exit.\n  if (crash) {\n    throw new Error('Simulated crash for telemetry verification');\n  }\n\n  // Validate: at least one flag\n  if (!expiredToken && !noKeyring && !unclaimed && !noAuth) {\n    exitWithError({\n      code: 'no_simulation_flags',\n      message: 'Specify at least one simulation flag: --expired-token, --no-keyring, --unclaimed, --no-auth',\n    });\n  }\n\n  // Validate: contradictory\n  if (expiredToken && noAuth) {\n    exitWithError({\n      code: 'contradictory_flags',\n      message: \"Cannot combine --expired-token and --no-auth (can't expire a cleared token)\",\n    });\n  }\n\n  const actions: string[] = [];\n\n  // Apply in order: storage tier first, then credential mutations, then config mutations\n\n  if (noKeyring) {\n    // Migrate current state to file storage\n    const creds = getCredentials();\n    const config = getConfig();\n\n    setInsecureStorage(true);\n    setInsecureConfigStorage(true);\n\n    if (creds) saveCredentials(creds);\n    if (config) saveConfig(config);\n\n    actions.push('Forced file-only storage (keyring bypassed)');\n  }\n\n  if (expiredToken) {\n    const creds = getCredentials();\n    if (!creds) {\n      exitWithError({\n        code: 'no_credentials',\n        message: 'Cannot simulate expired token — no credentials found. Log in first.',\n      });\n    }\n    saveCredentials({ ...creds, expiresAt: Date.now() - 60_000 });\n    actions.push('Set token expiresAt to 1 minute ago');\n  }\n\n  if (noAuth) {\n    clearCredentials();\n    actions.push('Cleared credentials (config preserved)');\n  }\n\n  if (unclaimed) {\n    const config = getConfig() ?? { environments: {} };\n    const envName = 'simulated-unclaimed';\n    config.environments[envName] = {\n      name: envName,\n      type: 'unclaimed',\n      apiKey: 'sk_test_simulated_unclaimed_000000000000',\n      clientId: 'client_simulated',\n      claimToken: 'claim_simulated_token_000000000000',\n    };\n    config.activeEnvironment = envName;\n    saveConfig(config);\n    actions.push(`Created unclaimed environment \"${envName}\" and set as active`);\n  }\n\n  if (isJsonMode()) {\n    outputJson({ simulated: true, actions });\n  } else {\n    for (const action of actions) {\n      clack.log.success(action);\n    }\n  }\n}\n\n// --- debug env ---\n\ninterface EnvVarInfo {\n  name: string;\n  value: string | undefined;\n  effect: string;\n}\n\nconst ENV_VAR_CATALOG: { name: string; effect: string }[] = [\n  { name: 'WORKOS_DEBUG', effect: 'Set to \"1\" to enable verbose debug logging for all commands' },\n  { name: 'WORKOS_API_KEY', effect: 'Bypasses credential resolution — used directly for API calls' },\n  { name: 'WORKOS_MODE', effect: 'Controls interaction behavior: human, agent, or CI' },\n  { name: 'WORKOS_FORCE_TTY', effect: 'Forces human (non-JSON) output mode, even when piped' },\n  { name: 'WORKOS_NO_PROMPT', effect: 'Legacy compatibility alias for agent interaction behavior and JSON output' },\n  { name: 'WORKOS_TELEMETRY', effect: 'Set to \"false\" to disable telemetry' },\n  { name: 'WORKOS_API_URL', effect: 'Overrides API base URL (default: https://api.workos.com)' },\n  { name: 'WORKOS_DASHBOARD_URL', effect: 'Overrides dashboard URL (default: https://dashboard.workos.com)' },\n  { name: 'WORKOS_AUTHKIT_DOMAIN', effect: 'Overrides AuthKit domain from settings' },\n  { name: 'WORKOS_LLM_GATEWAY_URL', effect: 'Overrides LLM gateway URL from settings' },\n  { name: 'WORKOS_TELEMETRY_URL', effect: 'Overrides CLI telemetry URL from settings' },\n  { name: 'INSTALLER_DEV', effect: 'Enables dev mode — loads .env.local at startup' },\n  { name: 'INSTALLER_DISABLE_PROXY', effect: 'Disables the credential proxy for gateway auth' },\n];\n\nexport async function runDebugEnv(): Promise<void> {\n  const vars: EnvVarInfo[] = ENV_VAR_CATALOG.map(({ name, effect }) => ({\n    name,\n    value: process.env[name],\n    effect,\n  }));\n\n  const setVars = vars.filter((v) => v.value !== undefined);\n  const unsetVars = vars.filter((v) => v.value === undefined);\n\n  if (isJsonMode()) {\n    outputJson({\n      variables: Object.fromEntries(vars.map((v) => [v.name, { value: v.value ?? null, effect: v.effect }])),\n      set: setVars.map((v) => v.name),\n      unset: unsetVars.map((v) => v.name),\n    });\n    return;\n  }\n\n  if (setVars.length > 0) {\n    console.log(chalk.bold('Set'));\n    for (const v of setVars) {\n      console.log(`  ${chalk.green(v.name)}=${v.value}`);\n      console.log(`    ${chalk.dim(v.effect)}`);\n    }\n    console.log();\n  }\n\n  console.log(chalk.bold(`Unset${setVars.length > 0 ? '' : ' (none active)'}`));\n  for (const v of unsetVars) {\n    console.log(`  ${chalk.dim(v.name)} — ${chalk.dim(v.effect)}`);\n  }\n}\n\n// --- debug token ---\n\nexport async function runDebugToken(): Promise<void> {\n  const creds = getCredentials();\n\n  if (!creds) {\n    if (isJsonMode()) {\n      outputJson({ present: false });\n    } else {\n      console.log(chalk.yellow('No credentials found'));\n    }\n    return;\n  }\n\n  const claims = parseJwt(creds.accessToken);\n  const expired = isTokenExpired(creds);\n  const timeRemaining = creds.expiresAt - Date.now();\n\n  if (isJsonMode()) {\n    outputJson({\n      present: true,\n      format: claims ? 'jwt' : 'opaque',\n      expired,\n      expiresAt: creds.expiresAt,\n      expiresIn: expired\n        ? `expired ${formatTimeRemaining(-timeRemaining)} ago`\n        : `in ${formatTimeRemaining(timeRemaining)}`,\n      claims: claims ?? null,\n      refreshToken: { present: !!creds.refreshToken },\n    });\n    return;\n  }\n\n  if (claims) {\n    console.log(chalk.bold('JWT Token'));\n    console.log(\n      `  expires: ${expired ? chalk.red(`expired ${formatTimeRemaining(-timeRemaining)} ago`) : chalk.green(`in ${formatTimeRemaining(timeRemaining)}`)}`,\n    );\n    console.log();\n    console.log(chalk.bold('Claims'));\n    for (const [key, value] of Object.entries(claims)) {\n      if (key === 'exp' || key === 'iat' || key === 'nbf') {\n        const date = new Date((value as number) * 1000).toISOString();\n        console.log(`  ${key}: ${value} (${date})`);\n      } else {\n        console.log(`  ${key}: ${JSON.stringify(value)}`);\n      }\n    }\n  } else {\n    console.log(chalk.bold('Opaque Token'));\n    console.log(chalk.dim('  Token is not a JWT — cannot decode claims'));\n    console.log(\n      `  expires: ${expired ? chalk.red(`expired ${formatTimeRemaining(-timeRemaining)} ago`) : chalk.green(`in ${formatTimeRemaining(timeRemaining)}`)}`,\n    );\n  }\n\n  console.log();\n  console.log(`  refresh token: ${creds.refreshToken ? chalk.green('present') : chalk.yellow('absent')}`);\n}\n"]}
+{"version":3,"file":"debug.js","sourceRoot":"","sources":["../../src/commands/debug.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,UAAU,EACV,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,EAAU;IACrC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACnD,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,GAAG,CAAC;IACvD,OAAO,GAAG,OAAO,GAAG,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,WAAqB;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAE/E,IAAI,UAAU;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,UAAU;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sBAAsB;AAEtB,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAE,WAAW,EAA4B;IAC3E,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAE5E,MAAM,iBAAiB,GAA4B,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE5F,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACvD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,OAAO;gBAChB,CAAC,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM;gBACtD,CAAC,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE;YAC9C,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,iBAAiB,CAAC,OAAO,GAAG;gBAC1B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;gBAChC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAA4B,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAEpE,IAAI,MAAM,EAAE,CAAC;QACX,YAAY,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC;QAClE,YAAY,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YACtD,GAAG;YACH;gBACE,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC/B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;aAC7E;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,cAAc,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;IAClE,YAAY,CAAC,MAAM,GAAG,YAAY,CAAC;IAEnC,MAAM,eAAe,GAAG;QACtB,OAAO,EAAE,kBAAkB,EAAE;QAC7B,QAAQ,EAAE,mBAAmB,EAAE;QAC/B,MAAM,EAAE,kBAAkB,EAAE;QAC5B,WAAW,EAAE,aAAa,EAAE;KAC7B,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,eAAe;QAC1B,OAAO,EAAE;YACP,eAAe,EAAE,kBAAkB,EAAE;YACrC,UAAU,EAAE,aAAa,EAAE;YAC3B,eAAe,EAAE,kBAAkB,EAAE;YACrC,qBAAqB,EAAE,WAAW;YAClC,iBAAiB;SAClB;KACF,CAAC;IAEF,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,cAAc,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CACpJ,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,OAAO,CAAC,QAAQ,WAAW,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,cAAc,YAAY,EAAE,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,iBAAiB,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,WAAW,GAAG,CAAC,IAAI,WAAW,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjF,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAE7F,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,WAAW,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,aAAa,EAAE,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,WAAW,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,sBAAsB;AAEtB,uEAAuE;AACvE,SAAS,UAAU,CAAC,KAAe;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,KAAK,EACL,eAAe,EACf,UAAU,GAKX;IACC,4CAA4C;IAC5C,MAAM,UAAU,GAAG,CAAC,UAAU,IAAI,eAAe,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,eAAe,IAAI,UAAU,CAAC;IACjD,8EAA8E;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,UAAU,GAAG,SAAS,CAAC;IAE7B,MAAM,OAAO,GAAG,UAAU,CACxB,CAAC,UAAU,IAAI,aAAa,EAAE,SAAS,IAAI,QAAQ,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAC9G,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACvB,aAAa,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,0CAA0C;aACpD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;YACpC,OAAO,EAAE,aAAa,OAAO,0BAA0B;SACxD,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACpC,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,UAAU;QAAE,gBAAgB,EAAE,CAAC;IACnC,IAAI,SAAS;QAAE,WAAW,EAAE,CAAC;IAC7B,IAAI,UAAU;QAAE,gBAAgB,EAAE,CAAC;IAEnC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,yBAAyB;AAEzB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,YAAY,EACZ,SAAS,EACT,SAAS,EACT,MAAM,EACN,KAAK,GAAG,KAAK,GAOd;IACC,wEAAwE;IACxE,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzD,aAAa,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;QAC3B,aAAa,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,uFAAuF;IAEvF,IAAI,SAAS,EAAE,CAAC;QACd,wCAAwC;QACxC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAE3B,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,KAAK;YAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAE/B,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,aAAa,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,gBAAgB,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,qBAAqB,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG;YAC7B,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,0CAA0C;YAClD,QAAQ,EAAE,kBAAkB;YAC5B,UAAU,EAAE,oCAAoC;SACjD,CAAC;QACF,MAAM,CAAC,iBAAiB,GAAG,OAAO,CAAC;QACnC,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,kCAAkC,OAAO,qBAAqB,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,cAAc;IACd,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,8DAA8D,EAAE;IAClG,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,oDAAoD,EAAE;IAC1F,uBAAuB;IACvB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE;IACrF,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,4CAA4C,EAAE;IAC9E,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,sDAAsD,EAAE;IAC5F,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6DAA6D,EAAE;IAC/F,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE;IAC3E,+EAA+E;IAC/E;QACE,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,mFAAmF;KAC5F;IACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iEAAiE,EAAE;IAC3G,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,wCAAwC,EAAE;IACnF,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,yDAAyD,EAAE;IAC9F,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,2DAA2D,EAAE;IACpG,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,8DAA8D,EAAE;IACxG,cAAc;IACd,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gDAAgD,EAAE;IAChF,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,gDAAgD,EAAE;CAC3F,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,IAAI,GAAiB,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM;KACP,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAE5D,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC;YACT,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACtG,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/B,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACpC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,sBAAsB;AAEtB,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEnD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC;YACT,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;YACjC,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,OAAO;gBAChB,CAAC,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM;gBACtD,CAAC,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE;YAC9C,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CACpJ,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAE,KAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CACpJ,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC","sourcesContent":["import chalk from 'chalk';\nimport clack from '../utils/clack.js';\nimport {\n  getCredentials,\n  saveCredentials,\n  clearCredentials,\n  isTokenExpired,\n  diagnoseCredentials,\n  getCredentialsPath,\n  setInsecureStorage,\n} from '../lib/credentials.js';\nimport {\n  getConfig,\n  saveConfig,\n  clearConfig,\n  getConfigPath,\n  setInsecureConfigStorage,\n  diagnoseConfig,\n} from '../lib/config-store.js';\nimport {\n  clearPreferences,\n  getPreferencesPath,\n  getTelemetrySource,\n  isNoticeShown,\n  isTelemetryEnabled,\n  isTelemetryOptedOut,\n} from '../lib/preferences.js';\nimport { isJsonMode, outputJson, exitWithError } from '../utils/output.js';\nimport { isPromptAllowed } from '../utils/interaction-mode.js';\n\nfunction maskSecret(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  if (value.length <= 8) return '****';\n  return value.slice(0, 4) + '****' + value.slice(-4);\n}\n\nfunction formatTimeRemaining(ms: number): string {\n  if (ms <= 0) return 'expired';\n  const seconds = Math.floor(ms / 1000);\n  const minutes = Math.floor(seconds / 60);\n  const hours = Math.floor(minutes / 60);\n  if (hours > 0) return `${hours}h ${minutes % 60}m`;\n  if (minutes > 0) return `${minutes}m ${seconds % 60}s`;\n  return `${seconds}s`;\n}\n\nfunction parseJwt(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));\n  } catch {\n    return null;\n  }\n}\n\nfunction determineCredentialSource(diagnostics: string[]): 'keyring' | 'file' | 'none' {\n  const hasKeyring = diagnostics.some((l) => l.startsWith('keyring: found'));\n  const hasFile = diagnostics.some((l) => l.includes('exists=true'));\n  const isInsecure = diagnostics.some((l) => l.includes('insecureStorage=true'));\n\n  if (isInsecure) return hasFile ? 'file' : 'none';\n  if (hasKeyring) return 'keyring';\n  if (hasFile) return 'file';\n  return 'none';\n}\n\n// --- debug state ---\n\nexport async function runDebugState({ showSecrets }: { showSecrets: boolean }): Promise<void> {\n  const creds = getCredentials();\n  const config = getConfig();\n  const diagnostics = diagnoseCredentials();\n  const credSource = determineCredentialSource(diagnostics);\n  const maybeRedact = showSecrets ? (v: string | undefined) => v : maskSecret;\n\n  const credentialsOutput: Record<string, unknown> = { present: !!creds, source: credSource };\n\n  if (creds) {\n    const timeRemaining = creds.expiresAt - Date.now();\n    const expired = isTokenExpired(creds);\n    Object.assign(credentialsOutput, {\n      userId: creds.userId,\n      email: creds.email ?? null,\n      accessToken: maybeRedact(creds.accessToken),\n      refreshToken: creds.refreshToken ? 'present' : 'absent',\n      expiresAt: creds.expiresAt,\n      expiresIn: expired\n        ? `expired ${formatTimeRemaining(-timeRemaining)} ago`\n        : `in ${formatTimeRemaining(timeRemaining)}`,\n      isExpired: expired,\n    });\n    if (creds.staging) {\n      credentialsOutput.staging = {\n        clientId: creds.staging.clientId,\n        apiKey: maybeRedact(creds.staging.apiKey),\n        fetchedAt: creds.staging.fetchedAt,\n      };\n    }\n  }\n\n  const configOutput: Record<string, unknown> = { present: !!config };\n\n  if (config) {\n    configOutput.activeEnvironment = config.activeEnvironment ?? null;\n    configOutput.environments = Object.fromEntries(\n      Object.entries(config.environments).map(([key, env]) => [\n        key,\n        {\n          name: env.name,\n          type: env.type,\n          apiKey: maybeRedact(env.apiKey),\n          clientId: env.clientId ?? null,\n          endpoint: env.endpoint ?? null,\n          ...(env.type === 'unclaimed' && { claimToken: maybeRedact(env.claimToken) }),\n        },\n      ]),\n    );\n  }\n\n  const configDiagnostics = diagnoseConfig();\n  const configSource = determineCredentialSource(configDiagnostics);\n  configOutput.source = configSource;\n\n  const telemetryOutput = {\n    enabled: isTelemetryEnabled(),\n    optedOut: isTelemetryOptedOut(),\n    source: getTelemetrySource(),\n    noticeShown: isNoticeShown(),\n  };\n\n  const result = {\n    credentials: credentialsOutput,\n    config: configOutput,\n    telemetry: telemetryOutput,\n    storage: {\n      credentialsPath: getCredentialsPath(),\n      configPath: getConfigPath(),\n      preferencesPath: getPreferencesPath(),\n      credentialDiagnostics: diagnostics,\n      configDiagnostics,\n    },\n  };\n\n  if (isJsonMode()) {\n    outputJson(result);\n    return;\n  }\n\n  console.log(chalk.bold('Credentials'));\n  console.log(`  present: ${creds ? chalk.green('true') : chalk.yellow('false')}`);\n  console.log(`  source:  ${credSource}`);\n  if (creds) {\n    console.log(`  userId:  ${creds.userId}`);\n    console.log(`  email:   ${creds.email ?? chalk.dim('none')}`);\n    console.log(`  token:   ${maybeRedact(creds.accessToken)}`);\n    console.log(`  refresh: ${creds.refreshToken ? 'present' : 'absent'}`);\n    const expired = isTokenExpired(creds);\n    const timeRemaining = creds.expiresAt - Date.now();\n    console.log(\n      `  expires: ${expired ? chalk.red(`expired ${formatTimeRemaining(-timeRemaining)} ago`) : chalk.green(`in ${formatTimeRemaining(timeRemaining)}`)}`,\n    );\n    if (creds.staging) {\n      console.log(`  staging: clientId=${creds.staging.clientId} apiKey=${maybeRedact(creds.staging.apiKey)}`);\n    }\n  }\n\n  console.log();\n  console.log(chalk.bold('Config'));\n  console.log(`  present: ${config ? chalk.green('true') : chalk.yellow('false')}`);\n  console.log(`  source:  ${configSource}`);\n  if (config) {\n    console.log(`  active:  ${config.activeEnvironment ?? chalk.dim('none')}`);\n    for (const [key, env] of Object.entries(config.environments)) {\n      console.log(`  env[${key}]: type=${env.type} apiKey=${maybeRedact(env.apiKey)}`);\n      if (env.type === 'unclaimed') console.log(`    claimToken=${maybeRedact(env.claimToken)}`);\n    }\n  }\n\n  console.log();\n  console.log(chalk.bold('Telemetry'));\n  console.log(`  enabled:  ${telemetryOutput.enabled ? chalk.green('true') : chalk.yellow('false')}`);\n  console.log(`  optedOut: ${telemetryOutput.optedOut ? chalk.yellow('true') : 'false'}`);\n  console.log(`  source:   ${telemetryOutput.source}`);\n  console.log(`  notice:   ${telemetryOutput.noticeShown ? 'shown' : chalk.dim('not shown')}`);\n\n  console.log();\n  console.log(chalk.bold('Storage — Credentials'));\n  console.log(`  path: ${getCredentialsPath()}`);\n  for (const line of diagnostics) {\n    console.log(`  ${chalk.dim(line)}`);\n  }\n\n  console.log();\n  console.log(chalk.bold('Storage — Config'));\n  console.log(`  path: ${getConfigPath()}`);\n  for (const line of configDiagnostics) {\n    console.log(`  ${chalk.dim(line)}`);\n  }\n\n  console.log();\n  console.log(chalk.bold('Storage — Preferences'));\n  console.log(`  path: ${getPreferencesPath()}`);\n}\n\n// --- debug reset ---\n\n/** Join names with an Oxford comma: [\"a\",\"b\",\"c\"] => \"a, b, and c\". */\nfunction formatList(items: string[]): string {\n  if (items.length <= 1) return items.join('');\n  if (items.length === 2) return `${items[0]} and ${items[1]}`;\n  return `${items.slice(0, -1).join(', ')}, and ${items[items.length - 1]}`;\n}\n\nexport async function runDebugReset({\n  force,\n  credentialsOnly,\n  configOnly,\n}: {\n  force: boolean;\n  credentialsOnly: boolean;\n  configOnly: boolean;\n}): Promise<void> {\n  // Both flags = clear both (same as neither)\n  const clearCreds = !configOnly || credentialsOnly;\n  const clearConf = !credentialsOnly || configOnly;\n  // Preferences (~/.workos/preferences.json) are non-secret local CLI state, so\n  // they ride with the config target. Clearing config returns the CLI to a\n  // fresh-install state, which includes resetting the telemetry preference.\n  const clearPrefs = clearConf;\n\n  const targets = formatList(\n    [clearCreds && 'credentials', clearConf && 'config', clearPrefs && 'preferences'].filter(Boolean) as string[],\n  );\n\n  if (!force) {\n    if (!isPromptAllowed()) {\n      exitWithError({\n        code: 'non_interactive_reset',\n        message: 'Use --force to reset in agent or CI mode',\n      });\n    }\n\n    const confirmed = await clack.confirm({\n      message: `Clear all ${targets}? This cannot be undone.`,\n    });\n\n    if (clack.isCancel(confirmed) || !confirmed) {\n      if (isJsonMode()) {\n        outputJson({ cleared: false, cancelled: true });\n      } else {\n        clack.log.info('Reset cancelled');\n      }\n      return;\n    }\n  }\n\n  if (clearCreds) clearCredentials();\n  if (clearConf) clearConfig();\n  if (clearPrefs) clearPreferences();\n\n  if (isJsonMode()) {\n    outputJson({ cleared: true, credentials: clearCreds, config: clearConf, preferences: clearPrefs });\n  } else {\n    clack.log.success(`Cleared ${targets}`);\n  }\n}\n\n// --- debug simulate ---\n\nexport async function runDebugSimulate({\n  expiredToken,\n  noKeyring,\n  unclaimed,\n  noAuth,\n  crash = false,\n}: {\n  expiredToken: boolean;\n  noKeyring: boolean;\n  unclaimed: boolean;\n  noAuth: boolean;\n  crash?: boolean;\n}): Promise<void> {\n  // Simulate an unexpected crash to exercise the crash-telemetry pipeline\n  // end-to-end. Throws a plain Error (not CliExit) so the bin.ts lifecycle\n  // records a `crash` event with a sanitized stack rather than a handled exit.\n  if (crash) {\n    throw new Error('Simulated crash for telemetry verification');\n  }\n\n  // Validate: at least one flag\n  if (!expiredToken && !noKeyring && !unclaimed && !noAuth) {\n    exitWithError({\n      code: 'no_simulation_flags',\n      message: 'Specify at least one simulation flag: --expired-token, --no-keyring, --unclaimed, --no-auth',\n    });\n  }\n\n  // Validate: contradictory\n  if (expiredToken && noAuth) {\n    exitWithError({\n      code: 'contradictory_flags',\n      message: \"Cannot combine --expired-token and --no-auth (can't expire a cleared token)\",\n    });\n  }\n\n  const actions: string[] = [];\n\n  // Apply in order: storage tier first, then credential mutations, then config mutations\n\n  if (noKeyring) {\n    // Migrate current state to file storage\n    const creds = getCredentials();\n    const config = getConfig();\n\n    setInsecureStorage(true);\n    setInsecureConfigStorage(true);\n\n    if (creds) saveCredentials(creds);\n    if (config) saveConfig(config);\n\n    actions.push('Forced file-only storage (keyring bypassed)');\n  }\n\n  if (expiredToken) {\n    const creds = getCredentials();\n    if (!creds) {\n      exitWithError({\n        code: 'no_credentials',\n        message: 'Cannot simulate expired token — no credentials found. Log in first.',\n      });\n    }\n    saveCredentials({ ...creds, expiresAt: Date.now() - 60_000 });\n    actions.push('Set token expiresAt to 1 minute ago');\n  }\n\n  if (noAuth) {\n    clearCredentials();\n    actions.push('Cleared credentials (config preserved)');\n  }\n\n  if (unclaimed) {\n    const config = getConfig() ?? { environments: {} };\n    const envName = 'simulated-unclaimed';\n    config.environments[envName] = {\n      name: envName,\n      type: 'unclaimed',\n      apiKey: 'sk_test_simulated_unclaimed_000000000000',\n      clientId: 'client_simulated',\n      claimToken: 'claim_simulated_token_000000000000',\n    };\n    config.activeEnvironment = envName;\n    saveConfig(config);\n    actions.push(`Created unclaimed environment \"${envName}\" and set as active`);\n  }\n\n  if (isJsonMode()) {\n    outputJson({ simulated: true, actions });\n  } else {\n    for (const action of actions) {\n      clack.log.success(action);\n    }\n  }\n}\n\n// --- debug env ---\n\ninterface EnvVarInfo {\n  name: string;\n  value: string | undefined;\n  effect: string;\n}\n\n/**\n * Catalog of WORKOS_-prefixed environment variables the CLI reads.\n *\n * This is the single source of truth for `workos debug env`. A unit test\n * (env-var-catalog.spec.ts) scans the source for `process.env.WORKOS_*` reads\n * and fails if any are missing here, so this list can't silently drift.\n */\nexport const ENV_VAR_CATALOG: { name: string; effect: string }[] = [\n  // Credentials\n  { name: 'WORKOS_API_KEY', effect: 'Bypasses credential resolution — used directly for API calls' },\n  { name: 'WORKOS_CLIENT_ID', effect: 'WorkOS client ID used during credential resolution' },\n  // Interaction & output\n  { name: 'WORKOS_MODE', effect: 'Controls interaction behavior: human, agent, or CI' },\n  { name: 'WORKOS_AGENT', effect: 'Set to \"1\" to force agent interaction mode' },\n  { name: 'WORKOS_FORCE_TTY', effect: 'Forces human (non-JSON) output mode, even when piped' },\n  { name: 'WORKOS_DEBUG', effect: 'Set to \"1\" to enable verbose debug logging for all commands' },\n  { name: 'WORKOS_TELEMETRY', effect: 'Set to \"false\" to disable telemetry' },\n  // URLs (WORKOS_API_URL is the single base; gateway + telemetry derive from it)\n  {\n    name: 'WORKOS_API_URL',\n    effect: 'Overrides API base URL; also reroutes the LLM gateway and CLI telemetry endpoints',\n  },\n  { name: 'WORKOS_DASHBOARD_URL', effect: 'Overrides dashboard URL (default: https://dashboard.workos.com)' },\n  { name: 'WORKOS_AUTHKIT_DOMAIN', effect: 'Overrides AuthKit domain from settings' },\n  { name: 'WORKOS_BASE_URL', effect: 'AuthKit base URL, read during doctor environment checks' },\n  { name: 'WORKOS_REDIRECT_URI', effect: 'OAuth redirect URI, read during doctor environment checks' },\n  { name: 'WORKOS_COOKIE_DOMAIN', effect: 'Session cookie domain, read during doctor environment checks' },\n  // Development\n  { name: 'WORKOS_DEV', effect: 'Enables dev mode — loads .env.local at startup' },\n  { name: 'WORKOS_DISABLE_PROXY', effect: 'Disables the credential proxy for gateway auth' },\n];\n\nexport async function runDebugEnv(): Promise<void> {\n  const vars: EnvVarInfo[] = ENV_VAR_CATALOG.map(({ name, effect }) => ({\n    name,\n    value: process.env[name],\n    effect,\n  }));\n\n  const setVars = vars.filter((v) => v.value !== undefined);\n  const unsetVars = vars.filter((v) => v.value === undefined);\n\n  if (isJsonMode()) {\n    outputJson({\n      variables: Object.fromEntries(vars.map((v) => [v.name, { value: v.value ?? null, effect: v.effect }])),\n      set: setVars.map((v) => v.name),\n      unset: unsetVars.map((v) => v.name),\n    });\n    return;\n  }\n\n  if (setVars.length > 0) {\n    console.log(chalk.bold('Set'));\n    for (const v of setVars) {\n      console.log(`  ${chalk.green(v.name)}=${v.value}`);\n      console.log(`    ${chalk.dim(v.effect)}`);\n    }\n    console.log();\n  }\n\n  console.log(chalk.bold(`Unset${setVars.length > 0 ? '' : ' (none active)'}`));\n  for (const v of unsetVars) {\n    console.log(`  ${chalk.dim(v.name)} — ${chalk.dim(v.effect)}`);\n  }\n}\n\n// --- debug token ---\n\nexport async function runDebugToken(): Promise<void> {\n  const creds = getCredentials();\n\n  if (!creds) {\n    if (isJsonMode()) {\n      outputJson({ present: false });\n    } else {\n      console.log(chalk.yellow('No credentials found'));\n    }\n    return;\n  }\n\n  const claims = parseJwt(creds.accessToken);\n  const expired = isTokenExpired(creds);\n  const timeRemaining = creds.expiresAt - Date.now();\n\n  if (isJsonMode()) {\n    outputJson({\n      present: true,\n      format: claims ? 'jwt' : 'opaque',\n      expired,\n      expiresAt: creds.expiresAt,\n      expiresIn: expired\n        ? `expired ${formatTimeRemaining(-timeRemaining)} ago`\n        : `in ${formatTimeRemaining(timeRemaining)}`,\n      claims: claims ?? null,\n      refreshToken: { present: !!creds.refreshToken },\n    });\n    return;\n  }\n\n  if (claims) {\n    console.log(chalk.bold('JWT Token'));\n    console.log(\n      `  expires: ${expired ? chalk.red(`expired ${formatTimeRemaining(-timeRemaining)} ago`) : chalk.green(`in ${formatTimeRemaining(timeRemaining)}`)}`,\n    );\n    console.log();\n    console.log(chalk.bold('Claims'));\n    for (const [key, value] of Object.entries(claims)) {\n      if (key === 'exp' || key === 'iat' || key === 'nbf') {\n        const date = new Date((value as number) * 1000).toISOString();\n        console.log(`  ${key}: ${value} (${date})`);\n      } else {\n        console.log(`  ${key}: ${JSON.stringify(value)}`);\n      }\n    }\n  } else {\n    console.log(chalk.bold('Opaque Token'));\n    console.log(chalk.dim('  Token is not a JWT — cannot decode claims'));\n    console.log(\n      `  expires: ${expired ? chalk.red(`expired ${formatTimeRemaining(-timeRemaining)} ago`) : chalk.green(`in ${formatTimeRemaining(timeRemaining)}`)}`,\n    );\n  }\n\n  console.log();\n  console.log(`  refresh token: ${creds.refreshToken ? chalk.green('present') : chalk.yellow('absent')}`);\n}\n"]}

package/dist/commands/install.js

@@ -3,6 +3,7 @@ import clack from '../utils/clack.js';
 import { exitWithError, isJsonMode } from '../utils/output.js';
 import { ExitCode, exitWithCode } from '../utils/exit-codes.js';
 import { autoInstallSkills } from './install-skill.js';
+import { maybeOfferMcpInstall } from '../lib/mcp-notice.js';
 /**
  * Handle install command execution.
  */
@@ -30,6 +31,9 @@ export async function handleInstall(argv) {
             const skillWord = skillResult.skills.length === 1 ? 'skill' : 'skills';
             clack.log.info(`Installed ${skillResult.skills.length} WorkOS ${skillWord} for ${skillResult.agents.join(', ')}. Your coding agent now has up-to-date WorkOS guidance.`);
         }
+        // Offer to connect the user's coding agent to WorkOS via MCP. Self-gating
+        // (human/TTY-only, decline-respecting) and best-effort — never fails install.
+        await maybeOfferMcpInstall({ entryPoint: 'install-flow' });
     }
     catch (err) {
         const { getLogFilePath } = await import('../utils/debug.js');

package/dist/commands/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuC;IACzE,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAE5B,qBAAqB;IACrB,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,aAAa,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yEAAyE;aACnF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC9C,IAAI,WAAW,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvE,KAAK,CAAC,GAAG,CAAC,IAAI,CACZ,aAAa,WAAW,CAAC,MAAM,CAAC,MAAM,WAAW,SAAS,QAAQ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,CACzJ,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QAEjC,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,aAAa,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import { runInstaller } from '../run.js';\nimport type { InstallerArgs } from '../run.js';\nimport clack from '../utils/clack.js';\nimport { exitWithError, isJsonMode } from '../utils/output.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\nimport type { ArgumentsCamelCase } from 'yargs';\nimport { autoInstallSkills } from './install-skill.js';\n\n/**\n * Handle install command execution.\n */\nexport async function handleInstall(argv: ArgumentsCamelCase<InstallerArgs>): Promise<void> {\n  const options = { ...argv };\n\n  // CI mode validation\n  if (options.ci) {\n    if (!options.apiKey) {\n      exitWithError({ code: 'missing_args', message: 'CI mode requires --api-key (WorkOS API key sk_xxx)' });\n    }\n    if (!options.clientId) {\n      exitWithError({ code: 'missing_args', message: 'CI mode requires --client-id (WorkOS Client ID client_xxx)' });\n    }\n    if (!options.installDir) {\n      exitWithError({\n        code: 'missing_args',\n        message: 'CI mode requires --install-dir (directory to install WorkOS AuthKit in)',\n      });\n    }\n  }\n\n  try {\n    await runInstaller(options);\n    const skillResult = await autoInstallSkills();\n    if (skillResult && !isJsonMode()) {\n      const skillWord = skillResult.skills.length === 1 ? 'skill' : 'skills';\n      clack.log.info(\n        `Installed ${skillResult.skills.length} WorkOS ${skillWord} for ${skillResult.agents.join(', ')}. Your coding agent now has up-to-date WorkOS guidance.`,\n      );\n    }\n  } catch (err) {\n    const { getLogFilePath } = await import('../utils/debug.js');\n    const logPath = getLogFilePath();\n\n    if (isJsonMode()) {\n      exitWithError({\n        code: 'installer_error',\n        message: err instanceof Error ? err.message : 'Unknown error',\n      });\n    }\n\n    if (options.debug && err instanceof Error && err.stack) {\n      console.error(err.stack);\n    }\n    if (logPath) {\n      clack.log.info(`Debug logs: ${logPath}`);\n    }\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n"]}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuC;IACzE,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAE5B,qBAAqB;IACrB,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,aAAa,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yEAAyE;aACnF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC9C,IAAI,WAAW,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvE,KAAK,CAAC,GAAG,CAAC,IAAI,CACZ,aAAa,WAAW,CAAC,MAAM,CAAC,MAAM,WAAW,SAAS,QAAQ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,CACzJ,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QAEjC,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,aAAa,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import { runInstaller } from '../run.js';\nimport type { InstallerArgs } from '../run.js';\nimport clack from '../utils/clack.js';\nimport { exitWithError, isJsonMode } from '../utils/output.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\nimport type { ArgumentsCamelCase } from 'yargs';\nimport { autoInstallSkills } from './install-skill.js';\nimport { maybeOfferMcpInstall } from '../lib/mcp-notice.js';\n\n/**\n * Handle install command execution.\n */\nexport async function handleInstall(argv: ArgumentsCamelCase<InstallerArgs>): Promise<void> {\n  const options = { ...argv };\n\n  // CI mode validation\n  if (options.ci) {\n    if (!options.apiKey) {\n      exitWithError({ code: 'missing_args', message: 'CI mode requires --api-key (WorkOS API key sk_xxx)' });\n    }\n    if (!options.clientId) {\n      exitWithError({ code: 'missing_args', message: 'CI mode requires --client-id (WorkOS Client ID client_xxx)' });\n    }\n    if (!options.installDir) {\n      exitWithError({\n        code: 'missing_args',\n        message: 'CI mode requires --install-dir (directory to install WorkOS AuthKit in)',\n      });\n    }\n  }\n\n  try {\n    await runInstaller(options);\n    const skillResult = await autoInstallSkills();\n    if (skillResult && !isJsonMode()) {\n      const skillWord = skillResult.skills.length === 1 ? 'skill' : 'skills';\n      clack.log.info(\n        `Installed ${skillResult.skills.length} WorkOS ${skillWord} for ${skillResult.agents.join(', ')}. Your coding agent now has up-to-date WorkOS guidance.`,\n      );\n    }\n\n    // Offer to connect the user's coding agent to WorkOS via MCP. Self-gating\n    // (human/TTY-only, decline-respecting) and best-effort — never fails install.\n    await maybeOfferMcpInstall({ entryPoint: 'install-flow' });\n  } catch (err) {\n    const { getLogFilePath } = await import('../utils/debug.js');\n    const logPath = getLogFilePath();\n\n    if (isJsonMode()) {\n      exitWithError({\n        code: 'installer_error',\n        message: err instanceof Error ? err.message : 'Unknown error',\n      });\n    }\n\n    if (options.debug && err instanceof Error && err.stack) {\n      console.error(err.stack);\n    }\n    if (logPath) {\n      clack.log.info(`Debug logs: ${logPath}`);\n    }\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n"]}

package/dist/commands/mcp.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `workos mcp install | remove | status` handlers.
+ *
+ * Thin callers over `lib/mcp-clients.ts`: detect the clients, run the
+ * operation, and format the per-agent matrix in both output modes. No prompts
+ * (non-TTY-safe by construction) and no auth guard — the WorkOS MCP server is
+ * secret-free, so configuring it never needs an API key.
+ */
+export interface McpCommandOptions {
+    agent?: string[];
+}
+export declare function runMcpInstall(options?: McpCommandOptions): Promise<void>;
+export declare function runMcpRemove(options?: McpCommandOptions): Promise<void>;
+export declare function runMcpStatus(): Promise<void>;

package/dist/commands/mcp.js

@@ -0,0 +1,108 @@
+import clack from '../utils/clack.js';
+import { outputSuccess, outputJson, outputTable, exitWithError, isJsonMode } from '../utils/output.js';
+import { ExitCode, exitWithCode } from '../utils/exit-codes.js';
+import { createMcpClients, detectMcpClients, MCP_AGENT_KEYS, } from '../lib/mcp-clients.js';
+/** Human phrasing for each outcome (JSON mode emits the raw `outcome` value). */
+const OUTCOME_LABEL = {
+    installed: 'installed',
+    'already-installed': 'already installed',
+    removed: 'removed',
+    'not-installed': 'not installed',
+    skipped: 'skipped',
+    failed: 'failed',
+};
+/**
+ * Validate `--agent` values against known keys. Unknown values exit with a
+ * structured `unknown_agent` error. Returns undefined (no filter) when none
+ * were passed, so callers act on all detected agents.
+ */
+function resolveAgentFilter(agent) {
+    if (!agent || agent.length === 0)
+        return undefined;
+    const unknown = agent.filter((a) => !MCP_AGENT_KEYS.includes(a));
+    if (unknown.length > 0) {
+        exitWithError({
+            code: 'unknown_agent',
+            message: `Unknown agent(s): ${unknown.join(', ')}. Supported: ${MCP_AGENT_KEYS.join(', ')}.`,
+        });
+    }
+    return agent;
+}
+/** Zero detected agents: same message + exit 0 for both install and remove. */
+function reportNoAgents() {
+    if (isJsonMode()) {
+        outputSuccess('No supported coding agents detected', { agents: [] });
+    }
+    else {
+        clack.log.info('No supported coding agents detected (looked for Claude Code, Codex, Cursor).');
+    }
+}
+/**
+ * Emit the per-agent matrix, then exit non-zero if any agent failed. The full
+ * matrix is always emitted first so partial success is still fully reported.
+ */
+function reportResults(message, results) {
+    if (isJsonMode()) {
+        outputSuccess(message, { agents: results });
+    }
+    else {
+        for (const r of results) {
+            const line = `${r.displayName}: ${OUTCOME_LABEL[r.outcome]}`;
+            if (r.outcome === 'failed') {
+                clack.log.error(r.error ? `${line} — ${r.error}` : line);
+            }
+            else if (r.outcome === 'installed' || r.outcome === 'removed' || r.outcome === 'already-installed') {
+                clack.log.success(line);
+            }
+            else {
+                clack.log.info(line);
+            }
+        }
+    }
+    if (results.some((r) => r.outcome === 'failed')) {
+        exitWithCode(ExitCode.GENERAL_ERROR);
+    }
+}
+export async function runMcpInstall(options = {}) {
+    const filter = resolveAgentFilter(options.agent);
+    const clients = await detectMcpClients(filter);
+    if (clients.length === 0) {
+        reportNoAgents();
+        return;
+    }
+    const results = [];
+    for (const client of clients) {
+        results.push(await client.add());
+    }
+    reportResults('Configured WorkOS MCP server', results);
+}
+export async function runMcpRemove(options = {}) {
+    const filter = resolveAgentFilter(options.agent);
+    const clients = await detectMcpClients(filter);
+    if (clients.length === 0) {
+        reportNoAgents();
+        return;
+    }
+    const results = [];
+    for (const client of clients) {
+        results.push(await client.remove());
+    }
+    reportResults('Removed WorkOS MCP server', results);
+}
+export async function runMcpStatus() {
+    // Status lists every known agent (not just available ones) with its
+    // availability + install flags, so `createMcpClients()` — not
+    // `detectMcpClients()` — is the right source here.
+    const clients = createMcpClients();
+    const agents = await Promise.all(clients.map(async (client) => {
+        const available = await client.isAvailable();
+        const installed = available ? await client.isInstalled() : false;
+        return { agent: client.key, displayName: client.displayName, available, installed };
+    }));
+    if (isJsonMode()) {
+        outputJson({ data: { agents } });
+        return;
+    }
+    outputTable([{ header: 'Agent' }, { header: 'Available' }, { header: 'Installed' }], agents.map((a) => [a.displayName, a.available ? 'yes' : 'no', a.installed ? 'yes' : 'no']));
+}
+//# sourceMappingURL=mcp.js.map

package/dist/commands/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAe/B,iFAAiF;AACjF,MAAM,aAAa,GAA+C;IAChE,SAAS,EAAE,WAAW;IACtB,mBAAmB,EAAE,mBAAmB;IACxC,OAAO,EAAE,SAAS;IAClB,eAAe,EAAE,eAAe;IAChC,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAgB,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,aAAa,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC7F,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAsB,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc;IACrB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,aAAa,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,OAA0B;IAChE,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,aAAa,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBACrG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAA6B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,cAAc,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,aAAa,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA6B,EAAE;IAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,cAAc,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,aAAa,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,oEAAoE;IACpE,8DAA8D;IAC9D,mDAAmD;IACnD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACtF,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,WAAW,CACT,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EACvE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC3F,CAAC;AACJ,CAAC","sourcesContent":["import clack from '../utils/clack.js';\nimport { outputSuccess, outputJson, outputTable, exitWithError, isJsonMode } from '../utils/output.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\nimport {\n  createMcpClients,\n  detectMcpClients,\n  MCP_AGENT_KEYS,\n  type McpAgentKey,\n  type McpClientResult,\n} from '../lib/mcp-clients.js';\n\n/**\n * `workos mcp install | remove | status` handlers.\n *\n * Thin callers over `lib/mcp-clients.ts`: detect the clients, run the\n * operation, and format the per-agent matrix in both output modes. No prompts\n * (non-TTY-safe by construction) and no auth guard — the WorkOS MCP server is\n * secret-free, so configuring it never needs an API key.\n */\n\nexport interface McpCommandOptions {\n  agent?: string[];\n}\n\n/** Human phrasing for each outcome (JSON mode emits the raw `outcome` value). */\nconst OUTCOME_LABEL: Record<McpClientResult['outcome'], string> = {\n  installed: 'installed',\n  'already-installed': 'already installed',\n  removed: 'removed',\n  'not-installed': 'not installed',\n  skipped: 'skipped',\n  failed: 'failed',\n};\n\n/**\n * Validate `--agent` values against known keys. Unknown values exit with a\n * structured `unknown_agent` error. Returns undefined (no filter) when none\n * were passed, so callers act on all detected agents.\n */\nfunction resolveAgentFilter(agent?: string[]): McpAgentKey[] | undefined {\n  if (!agent || agent.length === 0) return undefined;\n  const unknown = agent.filter((a) => !MCP_AGENT_KEYS.includes(a as McpAgentKey));\n  if (unknown.length > 0) {\n    exitWithError({\n      code: 'unknown_agent',\n      message: `Unknown agent(s): ${unknown.join(', ')}. Supported: ${MCP_AGENT_KEYS.join(', ')}.`,\n    });\n  }\n  return agent as McpAgentKey[];\n}\n\n/** Zero detected agents: same message + exit 0 for both install and remove. */\nfunction reportNoAgents(): void {\n  if (isJsonMode()) {\n    outputSuccess('No supported coding agents detected', { agents: [] });\n  } else {\n    clack.log.info('No supported coding agents detected (looked for Claude Code, Codex, Cursor).');\n  }\n}\n\n/**\n * Emit the per-agent matrix, then exit non-zero if any agent failed. The full\n * matrix is always emitted first so partial success is still fully reported.\n */\nfunction reportResults(message: string, results: McpClientResult[]): void {\n  if (isJsonMode()) {\n    outputSuccess(message, { agents: results });\n  } else {\n    for (const r of results) {\n      const line = `${r.displayName}: ${OUTCOME_LABEL[r.outcome]}`;\n      if (r.outcome === 'failed') {\n        clack.log.error(r.error ? `${line} — ${r.error}` : line);\n      } else if (r.outcome === 'installed' || r.outcome === 'removed' || r.outcome === 'already-installed') {\n        clack.log.success(line);\n      } else {\n        clack.log.info(line);\n      }\n    }\n  }\n\n  if (results.some((r) => r.outcome === 'failed')) {\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n\nexport async function runMcpInstall(options: McpCommandOptions = {}): Promise<void> {\n  const filter = resolveAgentFilter(options.agent);\n  const clients = await detectMcpClients(filter);\n  if (clients.length === 0) {\n    reportNoAgents();\n    return;\n  }\n  const results: McpClientResult[] = [];\n  for (const client of clients) {\n    results.push(await client.add());\n  }\n  reportResults('Configured WorkOS MCP server', results);\n}\n\nexport async function runMcpRemove(options: McpCommandOptions = {}): Promise<void> {\n  const filter = resolveAgentFilter(options.agent);\n  const clients = await detectMcpClients(filter);\n  if (clients.length === 0) {\n    reportNoAgents();\n    return;\n  }\n  const results: McpClientResult[] = [];\n  for (const client of clients) {\n    results.push(await client.remove());\n  }\n  reportResults('Removed WorkOS MCP server', results);\n}\n\nexport async function runMcpStatus(): Promise<void> {\n  // Status lists every known agent (not just available ones) with its\n  // availability + install flags, so `createMcpClients()` — not\n  // `detectMcpClients()` — is the right source here.\n  const clients = createMcpClients();\n  const agents = await Promise.all(\n    clients.map(async (client) => {\n      const available = await client.isAvailable();\n      const installed = available ? await client.isInstalled() : false;\n      return { agent: client.key, displayName: client.displayName, available, installed };\n    }),\n  );\n\n  if (isJsonMode()) {\n    outputJson({ data: { agents } });\n    return;\n  }\n\n  outputTable(\n    [{ header: 'Agent' }, { header: 'Available' }, { header: 'Installed' }],\n    agents.map((a) => [a.displayName, a.available ? 'yes' : 'no', a.installed ? 'yes' : 'no']),\n  );\n}\n"]}

package/dist/doctor/checks/ai-analysis.js

@@ -1,5 +1,6 @@
 import Anthropic from '@anthropic-ai/sdk';
-import { getLlmGatewayUrl, getAuthkitDomain, getCliAuthClientId, getConfig } from '../../lib/settings.js';
+import { getAuthkitDomain, getCliAuthClientId, getConfig } from '../../lib/settings.js';
+import { getLlmGatewayUrl } from '../../utils/urls.js';
 import { getCredentials, isTokenExpired, updateTokens, diagnoseCredentials } from '../../lib/credentials.js';
 import { refreshAccessToken } from '../../lib/token-refresh-client.js';
 import { buildDoctorPrompt } from '../agent-prompt.js';

package/dist/doctor/checks/ai-analysis.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-analysis.js","sourceRoot":"","sources":["../../../src/doctor/checks/ai-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,OAAO;QACL,IAAI,EAAE,GAAG,EAAE;YACT,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAGlF;gBACV,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC9B,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBACxC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;aACtD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxC,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;iBACtC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,KAAa;IACpD,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAEjD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,YAAY;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,mBAAmB,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,2BAA2B,mBAAmB,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;QACvG,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACxE,KAAK,GAAG,cAAc,EAAG,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,OAAO,EAAE,gBAAgB,EAAE;QAC3B,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE;KACjE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5C,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC3C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB,EAAE,OAA6B;IAC3F,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;IAEtC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;QACrD,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,KAAK;QACL,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,MAAM;KACnB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,aAAa,CAAC,0BAA0B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,aAAa,CAAC,6BAA6B,mBAAmB,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC1C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACxE,OAAO,EAAE,GAAG,aAAa,CAAC,oBAAoB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import Anthropic from '@anthropic-ai/sdk';\nimport { getLlmGatewayUrl, getAuthkitDomain, getCliAuthClientId, getConfig } from '../../lib/settings.js';\nimport { getCredentials, isTokenExpired, updateTokens, diagnoseCredentials } from '../../lib/credentials.js';\nimport { refreshAccessToken } from '../../lib/token-refresh-client.js';\nimport { buildDoctorPrompt, type AnalysisContext } from '../agent-prompt.js';\nimport type { AiAnalysis, AiFinding } from '../types.js';\nimport { formatWorkOSCommand } from '../../utils/command-invocation.js';\n\nconst SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];\n\nfunction startSpinner(message: string): { stop: () => void } {\n  let i = 0;\n  const interval = setInterval(() => {\n    process.stderr.write(`\\r  ${SPINNER_FRAMES[i++ % SPINNER_FRAMES.length]} ${message}`);\n  }, 80);\n  return {\n    stop: () => {\n      clearInterval(interval);\n      process.stderr.write(`\\r${' '.repeat(message.length + 6)}\\r`);\n    },\n  };\n}\n\nexport function parseAiResponse(text: string): { findings: AiFinding[]; summary: string } {\n  const codeBlockMatch = text.match(/```(?:json)?\\s*\\n?([\\s\\S]*?)\\n?\\s*```/);\n  const jsonStr = codeBlockMatch ? codeBlockMatch[1] : text;\n\n  try {\n    const parsed = JSON.parse(jsonStr.trim());\n    const findings = Array.isArray(parsed.findings)\n      ? parsed.findings.map((f: Record<string, unknown>) => ({\n          severity: (['error', 'warning', 'info'].includes(f.severity as string) ? f.severity : 'info') as\n            | 'error'\n            | 'warning'\n            | 'info',\n          title: String(f.title ?? ''),\n          detail: String(f.detail ?? ''),\n          remediation: String(f.remediation ?? ''),\n          filePath: f.filePath ? String(f.filePath) : undefined,\n        }))\n      : [];\n    return { findings, summary: String(parsed.summary ?? '') };\n  } catch {\n    const jsonMatch = text.match(/\\{[\\s\\S]*\"findings\"[\\s\\S]*\\}/);\n    if (jsonMatch) {\n      try {\n        const parsed = JSON.parse(jsonMatch[0]);\n        return {\n          findings: Array.isArray(parsed.findings) ? parsed.findings : [],\n          summary: String(parsed.summary ?? ''),\n        };\n      } catch {\n        // give up\n      }\n    }\n    return { findings: [], summary: text.slice(0, 500) };\n  }\n}\n\nasync function callModel(prompt: string, model: string): Promise<string> {\n  let creds = getCredentials();\n  if (!creds) throw new Error('Not authenticated');\n\n  if (isTokenExpired(creds)) {\n    if (!creds.refreshToken)\n      throw new Error(`Session expired — run \\`${formatWorkOSCommand('auth login')}\\` to re-authenticate`);\n    const result = await refreshAccessToken(getAuthkitDomain(), getCliAuthClientId());\n    if (!result.success || !result.accessToken || !result.expiresAt) {\n      throw new Error(`Session expired — run \\`${formatWorkOSCommand('auth login')}\\` to re-authenticate`);\n    }\n    updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n    creds = getCredentials()!;\n  }\n\n  const client = new Anthropic({\n    baseURL: getLlmGatewayUrl(),\n    apiKey: 'gateway',\n    defaultHeaders: { Authorization: `Bearer ${creds.accessToken}` },\n  });\n\n  const response = await client.messages.create({\n    model,\n    max_tokens: 2048,\n    messages: [{ role: 'user', content: prompt }],\n  });\n\n  const text = response.content[0];\n  if (text.type === 'text') return text.text;\n  throw new Error('Unexpected response format');\n}\n\nexport async function checkAiAnalysis(context: AnalysisContext, options: { skipAi?: boolean }): Promise<AiAnalysis> {\n  const model = getConfig().doctorModel;\n\n  const skippedResult = (reason: string): AiAnalysis => ({\n    findings: [],\n    summary: '',\n    model,\n    durationMs: 0,\n    skipped: true,\n    skipReason: reason,\n  });\n\n  if (options.skipAi) {\n    return skippedResult('Skipped (--skip-ai flag)');\n  }\n\n  const creds = getCredentials();\n  if (!creds) {\n    const diag = diagnoseCredentials();\n    process.stderr.write('\\n  [credential-debug]\\n');\n    for (const line of diag) {\n      process.stderr.write(`    ${line}\\n`);\n    }\n    process.stderr.write('\\n');\n    return skippedResult(`Not authenticated — run \\`${formatWorkOSCommand('auth login')}\\` for AI-powered analysis`);\n  }\n\n  const startTime = Date.now();\n  const spinner = startSpinner('Analyzing project with AI...');\n\n  try {\n    const prompt = await buildDoctorPrompt(context);\n    const responseText = await callModel(prompt, model);\n    const durationMs = Date.now() - startTime;\n    const { findings, summary } = parseAiResponse(responseText);\n    return { findings, summary, model, durationMs };\n  } catch (error) {\n    const durationMs = Date.now() - startTime;\n    const errMsg = error instanceof Error ? error.message : 'Unknown error';\n    return { ...skippedResult(`Analysis failed: ${errMsg}`), durationMs };\n  } finally {\n    spinner.stop();\n  }\n}\n"]}
+{"version":3,"file":"ai-analysis.js","sourceRoot":"","sources":["../../../src/doctor/checks/ai-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,OAAO;QACL,IAAI,EAAE,GAAG,EAAE;YACT,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAGlF;gBACV,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC9B,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBACxC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;aACtD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxC,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;iBACtC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,KAAa;IACpD,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAEjD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,YAAY;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,mBAAmB,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,2BAA2B,mBAAmB,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;QACvG,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACxE,KAAK,GAAG,cAAc,EAAG,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,OAAO,EAAE,gBAAgB,EAAE;QAC3B,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE;KACjE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5C,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC3C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB,EAAE,OAA6B;IAC3F,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;IAEtC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;QACrD,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,KAAK;QACL,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,MAAM;KACnB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,aAAa,CAAC,0BAA0B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,aAAa,CAAC,6BAA6B,mBAAmB,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC1C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACxE,OAAO,EAAE,GAAG,aAAa,CAAC,oBAAoB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import Anthropic from '@anthropic-ai/sdk';\nimport { getAuthkitDomain, getCliAuthClientId, getConfig } from '../../lib/settings.js';\nimport { getLlmGatewayUrl } from '../../utils/urls.js';\nimport { getCredentials, isTokenExpired, updateTokens, diagnoseCredentials } from '../../lib/credentials.js';\nimport { refreshAccessToken } from '../../lib/token-refresh-client.js';\nimport { buildDoctorPrompt, type AnalysisContext } from '../agent-prompt.js';\nimport type { AiAnalysis, AiFinding } from '../types.js';\nimport { formatWorkOSCommand } from '../../utils/command-invocation.js';\n\nconst SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];\n\nfunction startSpinner(message: string): { stop: () => void } {\n  let i = 0;\n  const interval = setInterval(() => {\n    process.stderr.write(`\\r  ${SPINNER_FRAMES[i++ % SPINNER_FRAMES.length]} ${message}`);\n  }, 80);\n  return {\n    stop: () => {\n      clearInterval(interval);\n      process.stderr.write(`\\r${' '.repeat(message.length + 6)}\\r`);\n    },\n  };\n}\n\nexport function parseAiResponse(text: string): { findings: AiFinding[]; summary: string } {\n  const codeBlockMatch = text.match(/```(?:json)?\\s*\\n?([\\s\\S]*?)\\n?\\s*```/);\n  const jsonStr = codeBlockMatch ? codeBlockMatch[1] : text;\n\n  try {\n    const parsed = JSON.parse(jsonStr.trim());\n    const findings = Array.isArray(parsed.findings)\n      ? parsed.findings.map((f: Record<string, unknown>) => ({\n          severity: (['error', 'warning', 'info'].includes(f.severity as string) ? f.severity : 'info') as\n            | 'error'\n            | 'warning'\n            | 'info',\n          title: String(f.title ?? ''),\n          detail: String(f.detail ?? ''),\n          remediation: String(f.remediation ?? ''),\n          filePath: f.filePath ? String(f.filePath) : undefined,\n        }))\n      : [];\n    return { findings, summary: String(parsed.summary ?? '') };\n  } catch {\n    const jsonMatch = text.match(/\\{[\\s\\S]*\"findings\"[\\s\\S]*\\}/);\n    if (jsonMatch) {\n      try {\n        const parsed = JSON.parse(jsonMatch[0]);\n        return {\n          findings: Array.isArray(parsed.findings) ? parsed.findings : [],\n          summary: String(parsed.summary ?? ''),\n        };\n      } catch {\n        // give up\n      }\n    }\n    return { findings: [], summary: text.slice(0, 500) };\n  }\n}\n\nasync function callModel(prompt: string, model: string): Promise<string> {\n  let creds = getCredentials();\n  if (!creds) throw new Error('Not authenticated');\n\n  if (isTokenExpired(creds)) {\n    if (!creds.refreshToken)\n      throw new Error(`Session expired — run \\`${formatWorkOSCommand('auth login')}\\` to re-authenticate`);\n    const result = await refreshAccessToken(getAuthkitDomain(), getCliAuthClientId());\n    if (!result.success || !result.accessToken || !result.expiresAt) {\n      throw new Error(`Session expired — run \\`${formatWorkOSCommand('auth login')}\\` to re-authenticate`);\n    }\n    updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n    creds = getCredentials()!;\n  }\n\n  const client = new Anthropic({\n    baseURL: getLlmGatewayUrl(),\n    apiKey: 'gateway',\n    defaultHeaders: { Authorization: `Bearer ${creds.accessToken}` },\n  });\n\n  const response = await client.messages.create({\n    model,\n    max_tokens: 2048,\n    messages: [{ role: 'user', content: prompt }],\n  });\n\n  const text = response.content[0];\n  if (text.type === 'text') return text.text;\n  throw new Error('Unexpected response format');\n}\n\nexport async function checkAiAnalysis(context: AnalysisContext, options: { skipAi?: boolean }): Promise<AiAnalysis> {\n  const model = getConfig().doctorModel;\n\n  const skippedResult = (reason: string): AiAnalysis => ({\n    findings: [],\n    summary: '',\n    model,\n    durationMs: 0,\n    skipped: true,\n    skipReason: reason,\n  });\n\n  if (options.skipAi) {\n    return skippedResult('Skipped (--skip-ai flag)');\n  }\n\n  const creds = getCredentials();\n  if (!creds) {\n    const diag = diagnoseCredentials();\n    process.stderr.write('\\n  [credential-debug]\\n');\n    for (const line of diag) {\n      process.stderr.write(`    ${line}\\n`);\n    }\n    process.stderr.write('\\n');\n    return skippedResult(`Not authenticated — run \\`${formatWorkOSCommand('auth login')}\\` for AI-powered analysis`);\n  }\n\n  const startTime = Date.now();\n  const spinner = startSpinner('Analyzing project with AI...');\n\n  try {\n    const prompt = await buildDoctorPrompt(context);\n    const responseText = await callModel(prompt, model);\n    const durationMs = Date.now() - startTime;\n    const { findings, summary } = parseAiResponse(responseText);\n    return { findings, summary, model, durationMs };\n  } catch (error) {\n    const durationMs = Date.now() - startTime;\n    const errMsg = error instanceof Error ? error.message : 'Unknown error';\n    return { ...skippedResult(`Analysis failed: ${errMsg}`), durationMs };\n  } finally {\n    spinner.stop();\n  }\n}\n"]}

package/dist/doctor/checks/mcp.d.ts

@@ -0,0 +1,15 @@
+import type { McpInfo } from '../types.js';
+/**
+ * Report the WorkOS MCP server status across detected coding agents.
+ *
+ * Mirrors checkSkills: per-detected-agent loop, typed `*Info` return, null when
+ * no agents are detected (so doctor renders no MCP section for users with no
+ * coding agent installed). Report-only — never mutates config (`--fix` does not
+ * touch MCP in this phase).
+ *
+ * Absent MCP is deliberately NOT an issue: the user may have declined the
+ * offer. Only Cursor exposes a readable config, so URL drift ("misconfigured")
+ * is detected for Cursor alone; issues.ts derives a warning from it. Per-agent
+ * shell-outs carry the 10s timeout from the client library, keeping doctor fast.
+ */
+export declare function checkMcp(): Promise<McpInfo | null>;

package/dist/doctor/checks/mcp.js

@@ -0,0 +1,34 @@
+import { detectMcpClients, getCursorConfiguredUrl } from '../../lib/mcp-clients.js';
+import { MCP_SERVER_URL } from '../../lib/constants.js';
+/**
+ * Report the WorkOS MCP server status across detected coding agents.
+ *
+ * Mirrors checkSkills: per-detected-agent loop, typed `*Info` return, null when
+ * no agents are detected (so doctor renders no MCP section for users with no
+ * coding agent installed). Report-only — never mutates config (`--fix` does not
+ * touch MCP in this phase).
+ *
+ * Absent MCP is deliberately NOT an issue: the user may have declined the
+ * offer. Only Cursor exposes a readable config, so URL drift ("misconfigured")
+ * is detected for Cursor alone; issues.ts derives a warning from it. Per-agent
+ * shell-outs carry the 10s timeout from the client library, keeping doctor fast.
+ */
+export async function checkMcp() {
+    const clients = await detectMcpClients();
+    if (clients.length === 0)
+        return null;
+    const agents = await Promise.all(clients.map(async (client) => {
+        const installed = await client.isInstalled();
+        const status = { agent: client.displayName, available: true, installed };
+        // Cursor is the only client whose config we can read, so it's the only
+        // one we can flag for URL drift. A missing/unreadable URL (null) is not
+        // "unexpected" — only a present-but-different URL counts.
+        if (client.key === 'cursor' && installed) {
+            const url = await getCursorConfiguredUrl();
+            status.misconfigured = url !== null && url !== MCP_SERVER_URL;
+        }
+        return status;
+    }));
+    return { serverUrl: MCP_SERVER_URL, agents };
+}
+//# sourceMappingURL=mcp.js.map

package/dist/doctor/checks/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/doctor/checks/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAA8B,EAAE;QACvD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5F,uEAAuE;QACvE,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,sBAAsB,EAAE,CAAC;YAC3C,MAAM,CAAC,aAAa,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,cAAc,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { detectMcpClients, getCursorConfiguredUrl } from '../../lib/mcp-clients.js';\nimport { MCP_SERVER_URL } from '../../lib/constants.js';\nimport type { McpInfo, McpAgentMcpStatus } from '../types.js';\n\n/**\n * Report the WorkOS MCP server status across detected coding agents.\n *\n * Mirrors checkSkills: per-detected-agent loop, typed `*Info` return, null when\n * no agents are detected (so doctor renders no MCP section for users with no\n * coding agent installed). Report-only — never mutates config (`--fix` does not\n * touch MCP in this phase).\n *\n * Absent MCP is deliberately NOT an issue: the user may have declined the\n * offer. Only Cursor exposes a readable config, so URL drift (\"misconfigured\")\n * is detected for Cursor alone; issues.ts derives a warning from it. Per-agent\n * shell-outs carry the 10s timeout from the client library, keeping doctor fast.\n */\nexport async function checkMcp(): Promise<McpInfo | null> {\n  const clients = await detectMcpClients();\n  if (clients.length === 0) return null;\n\n  const agents = await Promise.all(\n    clients.map(async (client): Promise<McpAgentMcpStatus> => {\n      const installed = await client.isInstalled();\n      const status: McpAgentMcpStatus = { agent: client.displayName, available: true, installed };\n      // Cursor is the only client whose config we can read, so it's the only\n      // one we can flag for URL drift. A missing/unreadable URL (null) is not\n      // \"unexpected\" — only a present-but-different URL counts.\n      if (client.key === 'cursor' && installed) {\n        const url = await getCursorConfiguredUrl();\n        status.misconfigured = url !== null && url !== MCP_SERVER_URL;\n      }\n      return status;\n    }),\n  );\n\n  return { serverUrl: MCP_SERVER_URL, agents };\n}\n"]}