workos 0.18.0 → 0.19.0

package/dist/lib/config-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/lib/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAqBrD;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,OAAO,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;AAClC,CAAC;AAOD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC1D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;gBACnC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,sBAAsB;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACtD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACrD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YACxD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;gBACpC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;gBACzC,KAAK,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,+DAA+D,EAC/D,uCAAuC,EACvC,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC;IACxC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,qEAAqE,CAAC,CAAC;QAC/E,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpC,0DAA0D;QAC1D,IAAI,MAAM,GAAG,SAAS,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,MAAM,CAAC,CAAC,kDAAkD;QACrE,CAAC;QAED,MAAM,OAAO,GAA6B;YACxC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;SAChD,CAAC;QAEF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAElC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["/**\n * CLI config storage abstraction with keyring support and file fallback.\n *\n * Stores environment configurations (names, API keys, endpoints) separately\n * from OAuth credentials. Uses a second keyring entry under the same service.\n *\n * Storage priority:\n * 1. If insecure storage forced: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\nimport { observeHostFailure } from './host-probe.js';\n\ninterface BaseEnvironmentConfig {\n  name: string;\n  apiKey: string;\n  endpoint?: string;\n}\n\nexport interface ClaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'production' | 'sandbox';\n  clientId?: string;\n}\n\nexport interface UnclaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'unclaimed';\n  clientId: string;\n  claimToken: string;\n}\n\nexport type EnvironmentConfig = ClaimedEnvironmentConfig | UnclaimedEnvironmentConfig;\n\n/**\n * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.\n */\nexport function isUnclaimedEnvironment(env: EnvironmentConfig): env is UnclaimedEnvironmentConfig {\n  return env.type === 'unclaimed';\n}\n\nexport interface CliConfig {\n  activeEnvironment?: string;\n  environments: Record<string, EnvironmentConfig>;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'config';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureConfigStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getConfigDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getConfigFilePath(): string {\n  return path.join(getConfigDir(), 'config.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getConfigFilePath());\n}\n\nfunction readFromFile(): CliConfig | null {\n  if (!fileExists()) return null;\n  const filePath = getConfigFilePath();\n  try {\n    const content = fs.readFileSync(filePath, 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'read',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    logWarn('Failed to read config file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(config: CliConfig): void {\n  const dir = getConfigDir();\n  const filePath = getConfigFilePath();\n  try {\n    if (!fs.existsSync(dir)) {\n      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    fs.writeFileSync(filePath, JSON.stringify(config, null, 2), {\n      mode: 0o600,\n    });\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'write',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    throw error;\n  }\n}\n\nfunction deleteFile(): void {\n  const filePath = getConfigFilePath();\n  if (fileExists()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch (error) {\n      observeHostFailure('home-fs', error, {\n        operation: 'delete',\n        target: filePath,\n        label: 'config fallback file',\n      });\n      throw error;\n    }\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): CliConfig | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) return null;\n    return JSON.parse(data);\n  } catch (error) {\n    logWarn('Failed to read config from keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'read',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return null;\n  }\n}\n\nfunction writeToKeyring(config: CliConfig): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(config));\n    return true;\n  } catch (error) {\n    logWarn('Failed to write config to keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'write',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete config from keyring:', error);\n      observeHostFailure('keychain', error, {\n        operation: 'delete',\n        target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n        label: 'config keychain entry',\n      });\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store config in system keyring. Using file storage.',\n    'Config saved to ~/.workos/config.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function getConfig(): CliConfig | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringConfig = readFromKeyring();\n  if (keyringConfig) return keyringConfig;\n\n  const fileConfig = readFromFile();\n  if (fileConfig) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileConfig);\n    }\n    return fileConfig;\n  }\n\n  return null;\n}\n\nexport function saveConfig(config: CliConfig): void {\n  if (forceInsecureStorage) return writeToFile(config);\n\n  if (!writeToKeyring(config)) {\n    showFallbackWarning();\n    writeToFile(config);\n    return;\n  }\n\n  // Verify the keyring write is readable (guards against silent keyring failures\n  // where setPassword succeeds but getPassword returns null in the same process)\n  if (!readFromKeyring()) {\n    logWarn('Keyring write succeeded but read-back failed — falling back to file');\n    writeToFile(config);\n  }\n}\n\nexport function clearConfig(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function getActiveEnvironment(): EnvironmentConfig | null {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return null;\n  return config.environments[config.activeEnvironment] ?? null;\n}\n\nexport function getConfigPath(): string {\n  return getConfigFilePath();\n}\n\n/**\n * Diagnostic info about config storage state — for debugging config persistence failures.\n */\nexport function diagnoseConfig(): string[] {\n  const lines: string[] = [];\n  const filePath = getConfigFilePath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`file config: active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } catch (e) {\n      lines.push(`file config: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`keyring: found, active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\n/**\n * Mark the active unclaimed environment as claimed.\n * Updates type to 'sandbox', removes the claim token, and renames\n * the environment key from 'unclaimed' to 'sandbox'.\n */\nexport function markEnvironmentClaimed(): void {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return;\n  const oldKey = config.activeEnvironment;\n  const env = config.environments[oldKey];\n  if (env && env.type === 'unclaimed') {\n    // Pick a key that won't overwrite an existing environment\n    let newKey = 'sandbox';\n    if (oldKey !== newKey && config.environments[newKey]) {\n      newKey = oldKey; // keep existing key if 'sandbox' is already taken\n    }\n\n    const claimed: ClaimedEnvironmentConfig = {\n      name: newKey,\n      type: 'sandbox',\n      apiKey: env.apiKey,\n      clientId: env.clientId,\n      ...(env.endpoint && { endpoint: env.endpoint }),\n    };\n\n    if (oldKey !== newKey) {\n      delete config.environments[oldKey];\n    }\n    config.environments[newKey] = claimed;\n    config.activeEnvironment = newKey;\n\n    saveConfig(config);\n  }\n}\n"]}
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/lib/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAyBrD;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,OAAO,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;AAClC,CAAC;AAOD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC1D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;gBACnC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,sBAAsB;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACtD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACrD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YACxD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;gBACpC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;gBACzC,KAAK,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,+DAA+D,EAC/D,uCAAuC,EACvC,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC;IACxC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,qEAAqE,CAAC,CAAC;QAC/E,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO;IAClD,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAChC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,MAAiB,EAAE,IAAY;IACzD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IAChD,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpC,0DAA0D;QAC1D,IAAI,MAAM,GAAG,SAAS,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,MAAM,CAAC,CAAC,kDAAkD;QACrE,CAAC;QAED,MAAM,OAAO,GAA6B;YACxC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;SACzD,CAAC;QAEF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAElC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["/**\n * CLI config storage abstraction with keyring support and file fallback.\n *\n * Stores environment configurations (names, API keys, endpoints) separately\n * from OAuth credentials. Uses a second keyring entry under the same service.\n *\n * Storage priority:\n * 1. If insecure storage forced: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\nimport { observeHostFailure } from './host-probe.js';\n\ninterface BaseEnvironmentConfig {\n  name: string;\n  apiKey: string;\n  endpoint?: string;\n  /** Email of the account that owns this environment. Stamped when `auth login` provisions Staging for a known account; undefined for unclaimed/manually-added envs. */\n  ownerEmail?: string;\n  /** User ID of the account that owns this environment. Stamped alongside ownerEmail. */\n  ownerUserId?: string;\n}\n\nexport interface ClaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'production' | 'sandbox';\n  clientId?: string;\n}\n\nexport interface UnclaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'unclaimed';\n  clientId: string;\n  claimToken: string;\n}\n\nexport type EnvironmentConfig = ClaimedEnvironmentConfig | UnclaimedEnvironmentConfig;\n\n/**\n * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.\n */\nexport function isUnclaimedEnvironment(env: EnvironmentConfig): env is UnclaimedEnvironmentConfig {\n  return env.type === 'unclaimed';\n}\n\nexport interface CliConfig {\n  activeEnvironment?: string;\n  environments: Record<string, EnvironmentConfig>;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'config';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureConfigStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getConfigDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getConfigFilePath(): string {\n  return path.join(getConfigDir(), 'config.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getConfigFilePath());\n}\n\nfunction readFromFile(): CliConfig | null {\n  if (!fileExists()) return null;\n  const filePath = getConfigFilePath();\n  try {\n    const content = fs.readFileSync(filePath, 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'read',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    logWarn('Failed to read config file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(config: CliConfig): void {\n  const dir = getConfigDir();\n  const filePath = getConfigFilePath();\n  try {\n    if (!fs.existsSync(dir)) {\n      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    fs.writeFileSync(filePath, JSON.stringify(config, null, 2), {\n      mode: 0o600,\n    });\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'write',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    throw error;\n  }\n}\n\nfunction deleteFile(): void {\n  const filePath = getConfigFilePath();\n  if (fileExists()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch (error) {\n      observeHostFailure('home-fs', error, {\n        operation: 'delete',\n        target: filePath,\n        label: 'config fallback file',\n      });\n      throw error;\n    }\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): CliConfig | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) return null;\n    return JSON.parse(data);\n  } catch (error) {\n    logWarn('Failed to read config from keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'read',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return null;\n  }\n}\n\nfunction writeToKeyring(config: CliConfig): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(config));\n    return true;\n  } catch (error) {\n    logWarn('Failed to write config to keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'write',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete config from keyring:', error);\n      observeHostFailure('keychain', error, {\n        operation: 'delete',\n        target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n        label: 'config keychain entry',\n      });\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store config in system keyring. Using file storage.',\n    'Config saved to ~/.workos/config.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function getConfig(): CliConfig | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringConfig = readFromKeyring();\n  if (keyringConfig) return keyringConfig;\n\n  const fileConfig = readFromFile();\n  if (fileConfig) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileConfig);\n    }\n    return fileConfig;\n  }\n\n  return null;\n}\n\nexport function saveConfig(config: CliConfig): void {\n  if (forceInsecureStorage) return writeToFile(config);\n\n  if (!writeToKeyring(config)) {\n    showFallbackWarning();\n    writeToFile(config);\n    return;\n  }\n\n  // Verify the keyring write is readable (guards against silent keyring failures\n  // where setPassword succeeds but getPassword returns null in the same process)\n  if (!readFromKeyring()) {\n    logWarn('Keyring write succeeded but read-back failed — falling back to file');\n    writeToFile(config);\n  }\n}\n\nexport function clearConfig(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function getActiveEnvironment(): EnvironmentConfig | null {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return null;\n  return config.environments[config.activeEnvironment] ?? null;\n}\n\n/**\n * Set the active environment by name.\n *\n * No-op when there is no config or the named environment does not exist —\n * callers should not be able to point `activeEnvironment` at a missing key.\n */\nexport function setActiveEnvironment(name: string): void {\n  const config = getConfig();\n  if (!config || !config.environments[name]) return;\n  config.activeEnvironment = name;\n  saveConfig(config);\n}\n\n/** Pick a non-colliding environments key: `base`, else `base-2`, `base-3`, … */\nexport function freshEnvKey(config: CliConfig, base: string): string {\n  if (!config.environments[base]) return base;\n  let i = 2;\n  while (config.environments[`${base}-${i}`]) i++;\n  return `${base}-${i}`;\n}\n\nexport function getConfigPath(): string {\n  return getConfigFilePath();\n}\n\n/**\n * Diagnostic info about config storage state — for debugging config persistence failures.\n */\nexport function diagnoseConfig(): string[] {\n  const lines: string[] = [];\n  const filePath = getConfigFilePath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`file config: active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } catch (e) {\n      lines.push(`file config: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`keyring: found, active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\n/**\n * Mark the active unclaimed environment as claimed.\n * Updates type to 'sandbox', removes the claim token, and renames\n * the environment key from 'unclaimed' to 'sandbox'.\n */\nexport function markEnvironmentClaimed(): void {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return;\n  const oldKey = config.activeEnvironment;\n  const env = config.environments[oldKey];\n  if (env && env.type === 'unclaimed') {\n    // Pick a key that won't overwrite an existing environment\n    let newKey = 'sandbox';\n    if (oldKey !== newKey && config.environments[newKey]) {\n      newKey = oldKey; // keep existing key if 'sandbox' is already taken\n    }\n\n    const claimed: ClaimedEnvironmentConfig = {\n      name: newKey,\n      type: 'sandbox',\n      apiKey: env.apiKey,\n      clientId: env.clientId,\n      ...(env.endpoint && { endpoint: env.endpoint }),\n      ...(env.ownerEmail && { ownerEmail: env.ownerEmail }),\n      ...(env.ownerUserId && { ownerUserId: env.ownerUserId }),\n    };\n\n    if (oldKey !== newKey) {\n      delete config.environments[oldKey];\n    }\n    config.environments[newKey] = claimed;\n    config.activeEnvironment = newKey;\n\n    saveConfig(config);\n  }\n}\n"]}

package/dist/lib/config.d.ts

@@ -25,7 +25,7 @@ export type IntegrationConfig = {
 };
 /**
  * Legacy detection configs for existing JS integrations.
- * Used by clack-utils.ts for abort/cancel messages.
+ * Used by ui-utils.ts for abort/cancel messages.
  * New integrations do NOT need to be added here.
  */
 export declare const INTEGRATION_CONFIG: Record<string, {

package/dist/lib/config.js

@@ -9,7 +9,7 @@
  */
 /**
  * Legacy detection configs for existing JS integrations.
- * Used by clack-utils.ts for abort/cancel messages.
+ * Used by ui-utils.ts for abort/cancel messages.
  * New integrations do NOT need to be added here.
  */
 export const INTEGRATION_CONFIG = {

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoBH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsD;IACnF,MAAM,EAAE;QACN,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,wDAAwD;KAClE;IACD,KAAK,EAAE;QACL,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,uDAAuD;KACjE;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD,cAAc,EAAE;QACd,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8DAA8D;KACxE;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;CACF,CAAC","sourcesContent":["/**\n * Integration detection configuration.\n *\n * This module previously held hardcoded INTEGRATION_CONFIG and INTEGRATION_ORDER.\n * These are now provided by the auto-discovery registry (src/lib/registry.ts).\n *\n * This file is kept for backwards compatibility — functions that previously\n * used INTEGRATION_CONFIG now delegate to the registry.\n */\n\nimport type { InstallerOptions } from '../utils/types.js';\n\n/**\n * @deprecated Use registry.detectionOrder() + config.detection.detect() instead.\n * This type is kept for any code that still references it.\n */\nexport type IntegrationConfig = {\n  name: string;\n  filterPatterns: string[];\n  ignorePatterns: string[];\n  detect: (options: Pick<InstallerOptions, 'installDir'>) => Promise<boolean>;\n  generateFilesRules: string;\n  filterFilesRules: string;\n  docsUrl: string;\n  nextSteps: string;\n  defaultChanges: string;\n};\n\n/**\n * Legacy detection configs for existing JS integrations.\n * Used by clack-utils.ts for abort/cancel messages.\n * New integrations do NOT need to be added here.\n */\nexport const INTEGRATION_CONFIG: Record<string, { docsUrl: string; name: string }> = {\n  nextjs: {\n    name: 'Next.js',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/nextjs',\n  },\n  react: {\n    name: 'React (SPA)',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/react',\n  },\n  'tanstack-start': {\n    name: 'TanStack Start',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/tanstack-start',\n  },\n  'react-router': {\n    name: 'React Router',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/react-router',\n  },\n  'vanilla-js': {\n    name: 'Vanilla JavaScript',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/javascript',\n  },\n};\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoBH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsD;IACnF,MAAM,EAAE;QACN,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,wDAAwD;KAClE;IACD,KAAK,EAAE;QACL,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,uDAAuD;KACjE;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD,cAAc,EAAE;QACd,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8DAA8D;KACxE;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;CACF,CAAC","sourcesContent":["/**\n * Integration detection configuration.\n *\n * This module previously held hardcoded INTEGRATION_CONFIG and INTEGRATION_ORDER.\n * These are now provided by the auto-discovery registry (src/lib/registry.ts).\n *\n * This file is kept for backwards compatibility — functions that previously\n * used INTEGRATION_CONFIG now delegate to the registry.\n */\n\nimport type { InstallerOptions } from '../utils/types.js';\n\n/**\n * @deprecated Use registry.detectionOrder() + config.detection.detect() instead.\n * This type is kept for any code that still references it.\n */\nexport type IntegrationConfig = {\n  name: string;\n  filterPatterns: string[];\n  ignorePatterns: string[];\n  detect: (options: Pick<InstallerOptions, 'installDir'>) => Promise<boolean>;\n  generateFilesRules: string;\n  filterFilesRules: string;\n  docsUrl: string;\n  nextSteps: string;\n  defaultChanges: string;\n};\n\n/**\n * Legacy detection configs for existing JS integrations.\n * Used by ui-utils.ts for abort/cancel messages.\n * New integrations do NOT need to be added here.\n */\nexport const INTEGRATION_CONFIG: Record<string, { docsUrl: string; name: string }> = {\n  nextjs: {\n    name: 'Next.js',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/nextjs',\n  },\n  react: {\n    name: 'React (SPA)',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/react',\n  },\n  'tanstack-start': {\n    name: 'TanStack Start',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/tanstack-start',\n  },\n  'react-router': {\n    name: 'React Router',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/react-router',\n  },\n  'vanilla-js': {\n    name: 'Vanilla JavaScript',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/javascript',\n  },\n};\n"]}

package/dist/lib/constants.d.ts

@@ -36,6 +36,14 @@ export declare const OAUTH_PORT: number;
  */
 export declare const MCP_SERVER_NAME = "workos";
 export declare const MCP_SERVER_URL = "https://mcp.workos.com/mcp";
+/**
+ * Shared description for the `migrations` command, referenced by both the yargs
+ * registration (`bin.ts`) and the JSON help registry (`help-json.ts`) so the two
+ * surfaces cannot drift. Advertises the generic-CSV path (e.g. Supabase) without
+ * implying a dedicated exporter exists for it. Hand-maintained — not derived from
+ * `@workos/migrations`.
+ */
+export declare const MIGRATIONS_DESCRIPTION = "Migrate users to WorkOS from Auth0, Cognito, Clerk, Firebase, or any provider via CSV (e.g. Supabase)";
 /**
  * Common glob patterns to ignore when searching for files.
  * Used by multiple integrations.

package/dist/lib/constants.js

@@ -28,6 +28,14 @@ export const OAUTH_PORT = settings.legacy.oauthPort;
  */
 export const MCP_SERVER_NAME = 'workos';
 export const MCP_SERVER_URL = 'https://mcp.workos.com/mcp';
+/**
+ * Shared description for the `migrations` command, referenced by both the yargs
+ * registration (`bin.ts`) and the JSON help registry (`help-json.ts`) so the two
+ * surfaces cannot drift. Advertises the generic-CSV path (e.g. Supabase) without
+ * implying a dedicated exporter exists for it. Hand-maintained — not derived from
+ * `@workos/migrations`.
+ */
+export const MIGRATIONS_DESCRIPTION = 'Migrate users to WorkOS from Auth0, Cognito, Clerk, Firebase, or any provider via CSV (e.g. Supabase)';
 /**
  * Common glob patterns to ignore when searching for files.
  * Used by multiple integrations.

package/dist/lib/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAS1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;CACf,CAAC;AAOX,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,aAAa,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,cAAc;IACd,aAAa;CACd,CAAC","sourcesContent":["import { getConfig } from './settings.js';\n\n/**\n * Integration identifier type.\n * No longer an enum — each integration self-registers via the auto-discovery registry.\n * The string value matches the integration directory name (e.g., 'nextjs', 'react-router').\n */\nexport type Integration = string;\n\n/**\n * Well-known integration names for backwards compatibility.\n * New integrations do NOT need to be added here — they're auto-discovered.\n */\nexport const KNOWN_INTEGRATIONS = {\n  nextjs: 'nextjs',\n  react: 'react',\n  tanstackStart: 'tanstack-start',\n  reactRouter: 'react-router',\n  vanillaJs: 'vanilla-js',\n} as const;\n\nexport interface Args {\n  debug: boolean;\n  integration: Integration;\n}\n\nexport const IS_DEV = ['test', 'development'].includes(process.env.NODE_ENV ?? '');\n\nconst settings = getConfig();\n\nexport const DEBUG = settings.logging.debugMode;\nexport const WORKOS_DOCS_URL = settings.documentation.workosDocsUrl;\nexport const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;\nexport const ISSUES_URL = settings.documentation.issuesUrl;\nexport const ANALYTICS_ENABLED = settings.telemetry.enabled;\nexport const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;\nexport const OAUTH_PORT = settings.legacy.oauthPort;\n\n/**\n * WorkOS MCP server identity, shared by the `mcp` command group and the\n * per-client writers in `lib/mcp-clients.ts`.\n *\n * The server is secret-free: HTTP transport with OAuth handled by each client\n * on first connect, so configuring it never requires CLI auth.\n */\nexport const MCP_SERVER_NAME = 'workos';\nexport const MCP_SERVER_URL = 'https://mcp.workos.com/mcp';\n\n/**\n * Common glob patterns to ignore when searching for files.\n * Used by multiple integrations.\n */\nexport const IGNORE_PATTERNS: string[] = [\n  '**/node_modules/**',\n  '**/dist/**',\n  '**/build/**',\n  '**/public/**',\n  '**/.next/**',\n];\n"]}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAS1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;CACf,CAAC;AAOX,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,aAAa,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,uGAAuG,CAAC;AAE1G;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,cAAc;IACd,aAAa;CACd,CAAC","sourcesContent":["import { getConfig } from './settings.js';\n\n/**\n * Integration identifier type.\n * No longer an enum — each integration self-registers via the auto-discovery registry.\n * The string value matches the integration directory name (e.g., 'nextjs', 'react-router').\n */\nexport type Integration = string;\n\n/**\n * Well-known integration names for backwards compatibility.\n * New integrations do NOT need to be added here — they're auto-discovered.\n */\nexport const KNOWN_INTEGRATIONS = {\n  nextjs: 'nextjs',\n  react: 'react',\n  tanstackStart: 'tanstack-start',\n  reactRouter: 'react-router',\n  vanillaJs: 'vanilla-js',\n} as const;\n\nexport interface Args {\n  debug: boolean;\n  integration: Integration;\n}\n\nexport const IS_DEV = ['test', 'development'].includes(process.env.NODE_ENV ?? '');\n\nconst settings = getConfig();\n\nexport const DEBUG = settings.logging.debugMode;\nexport const WORKOS_DOCS_URL = settings.documentation.workosDocsUrl;\nexport const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;\nexport const ISSUES_URL = settings.documentation.issuesUrl;\nexport const ANALYTICS_ENABLED = settings.telemetry.enabled;\nexport const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;\nexport const OAUTH_PORT = settings.legacy.oauthPort;\n\n/**\n * WorkOS MCP server identity, shared by the `mcp` command group and the\n * per-client writers in `lib/mcp-clients.ts`.\n *\n * The server is secret-free: HTTP transport with OAuth handled by each client\n * on first connect, so configuring it never requires CLI auth.\n */\nexport const MCP_SERVER_NAME = 'workos';\nexport const MCP_SERVER_URL = 'https://mcp.workos.com/mcp';\n\n/**\n * Shared description for the `migrations` command, referenced by both the yargs\n * registration (`bin.ts`) and the JSON help registry (`help-json.ts`) so the two\n * surfaces cannot drift. Advertises the generic-CSV path (e.g. Supabase) without\n * implying a dedicated exporter exists for it. Hand-maintained — not derived from\n * `@workos/migrations`.\n */\nexport const MIGRATIONS_DESCRIPTION =\n  'Migrate users to WorkOS from Auth0, Cognito, Clerk, Firebase, or any provider via CSV (e.g. Supabase)';\n\n/**\n * Common glob patterns to ignore when searching for files.\n * Used by multiple integrations.\n */\nexport const IGNORE_PATTERNS: string[] = [\n  '**/node_modules/**',\n  '**/dist/**',\n  '**/build/**',\n  '**/public/**',\n  '**/.next/**',\n];\n"]}

package/dist/lib/events.d.ts

@@ -1,4 +1,30 @@
 import { EventEmitter } from 'events';
+/**
+ * Structured data describing a successful installation, used to render the
+ * completion summary and enrich the headless `complete` NDJSON event.
+ *
+ * Defined here (not in installer-core.types.ts) to avoid an import cycle:
+ * installer-core.types.ts already imports from this module, so this module
+ * must not import back.
+ */
+export interface CompletionData {
+    /** Integration identifier (e.g. 'nextjs') */
+    integration: string;
+    /** Lockfile-aware dev command, e.g. "pnpm run dev" */
+    devCommand: string;
+    /** App URL with the detected port, e.g. "http://localhost:3000" */
+    url: string;
+    /** Changed files (git-relative), full list — display cap lives in the renderer */
+    files: string[];
+    /** Composed concrete + framework next-step lines */
+    nextSteps: string[];
+    /** Per-framework docs URL */
+    docsUrl: string;
+    /** WorkOS dashboard URL */
+    dashboardUrl: string;
+    /** Optional per-framework "add a sign-in link" snippet */
+    signInSnippet?: string;
+}
 export interface InstallerEvents {
     status: {
         message: string;
@@ -45,6 +71,7 @@ export interface InstallerEvents {
     complete: {
         success: boolean;
         summary?: string;
+        completion?: CompletionData;
     };
     error: {
         message: string;
@@ -103,7 +130,9 @@ export interface InstallerEvents {
         message: string;
     };
     'staging:fetching': Record<string, never>;
-    'staging:success': Record<string, never>;
+    'staging:success': {
+        source?: 'device' | 'stored';
+    };
     'staging:error': {
         message: string;
         statusCode?: number;
@@ -126,6 +155,10 @@ export interface InstallerEvents {
         attempt: number;
         maxRetries: number;
     };
+    'agent:tool': {
+        kind: 'command';
+        detail: string;
+    };
     'validation:retry:start': {
         attempt: number;
     };

package/dist/lib/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/lib/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAoGtC,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IACrD,IAAI,CAA+B,KAAQ,EAAE,OAA2B;QACtE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,EAAE,CAA+B,KAAQ,EAAE,QAA+C;QACxF,OAAO,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAA+B,KAAQ,EAAE,QAA+C;QACzF,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAA+B,KAAQ,EAAE,QAA+C;QAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,IAAI,qBAAqB,EAAE,CAAC;AACrC,CAAC","sourcesContent":["import { EventEmitter } from 'events';\n\nexport interface InstallerEvents {\n  status: { message: string };\n  output: { text: string; isError?: boolean };\n  'file:write': { path: string; content: string };\n  'file:edit': { path: string; oldContent: string; newContent: string };\n  'prompt:request': { id: string; message: string; options?: string[] };\n  'prompt:response': { id: string; value: string };\n  'confirm:request': { id: string; message: string; warning?: string; files?: string[] };\n  'confirm:response': { id: string; confirmed: boolean };\n  'credentials:request': { requiresApiKey: boolean };\n  'credentials:response': { apiKey: string; clientId: string };\n  complete: { success: boolean; summary?: string };\n  error: { message: string; stack?: string };\n\n  'state:enter': { state: string };\n  'state:exit': { state: string };\n  'auth:checking': Record<string, never>;\n  'auth:required': Record<string, never>;\n  'auth:success': Record<string, never>;\n  'auth:failure': { message: string };\n  'detection:start': Record<string, never>;\n  'detection:complete': { integration: string };\n  'detection:none': Record<string, never>;\n  'git:checking': Record<string, never>;\n  'git:clean': Record<string, never>;\n  'git:dirty': { files: string[] };\n  'git:dirty:confirmed': Record<string, never>;\n  'git:dirty:cancelled': Record<string, never>;\n  'credentials:gathering': { requiresApiKey: boolean };\n  'credentials:found': Record<string, never>;\n  // Credential discovery events\n  'credentials:env:detected': { files: string[] };\n  'credentials:env:prompt': { files: string[] };\n  'credentials:env:scanning': Record<string, never>;\n  'credentials:env:found': { sourcePath: string };\n  'credentials:env:notfound': Record<string, never>;\n  // Device auth events\n  'device:started': { verificationUri: string; verificationUriComplete: string; userCode: string };\n  'device:polling': Record<string, never>;\n  'device:success': { email?: string };\n  'device:timeout': Record<string, never>;\n  'device:error': { message: string };\n  // Staging API events\n  'staging:fetching': Record<string, never>;\n  'staging:success': Record<string, never>;\n  'staging:error': { message: string; statusCode?: number };\n  'config:start': Record<string, never>;\n  'config:complete': Record<string, never>;\n  'agent:start': Record<string, never>;\n  'agent:progress': { step: string; detail?: string };\n  'agent:success': { summary?: string };\n  'agent:failure': { message: string; stack?: string };\n  'agent:retry': { attempt: number; maxRetries: number };\n\n  'validation:retry:start': { attempt: number };\n  'validation:retry:complete': { attempt: number; passed: boolean };\n\n  'validation:start': { framework: string };\n  'validation:issues': { issues: import('./validation/types.js').ValidationIssue[] };\n  'validation:complete': { passed: boolean; issueCount: number; durationMs: number };\n\n  // Scaffold events (empty-directory app scaffolding)\n  'scaffold:checking': Record<string, never>;\n  'scaffold:prompt': { packageManager: string };\n  'scaffold:start': { packageManager: string };\n  'scaffold:progress': { text: string };\n  'scaffold:complete': Record<string, never>;\n  'scaffold:failed': { error: string };\n  'scaffold:skipped': Record<string, never>;\n\n  // Branch check events\n  'branch:checking': Record<string, never>;\n  'branch:protected': { branch: string };\n  'branch:prompt': { branch: string };\n  'branch:created': { branch: string };\n  'branch:create:failed': { error: string };\n  'branch:skipped': Record<string, never>;\n\n  // Post-install events\n  'postinstall:changes': { files: string[] };\n  'postinstall:nochanges': Record<string, never>;\n  'postinstall:commit:prompt': Record<string, never>;\n  'postinstall:commit:generating': Record<string, never>;\n  'postinstall:commit:committing': { message: string };\n  'postinstall:commit:success': { message: string };\n  'postinstall:commit:failed': { error: string };\n  'postinstall:pr:prompt': Record<string, never>;\n  'postinstall:pr:generating': Record<string, never>;\n  'postinstall:pr:pushing': Record<string, never>;\n  'postinstall:pr:creating': Record<string, never>;\n  'postinstall:pr:success': { url: string };\n  'postinstall:pr:failed': { error: string };\n  'postinstall:push:failed': { error: string };\n  'postinstall:manual': { instructions: string };\n}\n\nexport type InstallerEventName = keyof InstallerEvents;\n\nexport class InstallerEventEmitter extends EventEmitter {\n  emit<K extends InstallerEventName>(event: K, payload: InstallerEvents[K]): boolean {\n    return super.emit(event, payload);\n  }\n\n  on<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.on(event, listener);\n  }\n\n  off<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.off(event, listener);\n  }\n\n  once<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.once(event, listener);\n  }\n}\n\nexport function createInstallerEventEmitter(): InstallerEventEmitter {\n  return new InstallerEventEmitter();\n}\n"]}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/lib/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAiItC,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IACrD,IAAI,CAA+B,KAAQ,EAAE,OAA2B;QACtE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,EAAE,CAA+B,KAAQ,EAAE,QAA+C;QACxF,OAAO,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAA+B,KAAQ,EAAE,QAA+C;QACzF,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAA+B,KAAQ,EAAE,QAA+C;QAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,IAAI,qBAAqB,EAAE,CAAC;AACrC,CAAC","sourcesContent":["import { EventEmitter } from 'events';\n\n/**\n * Structured data describing a successful installation, used to render the\n * completion summary and enrich the headless `complete` NDJSON event.\n *\n * Defined here (not in installer-core.types.ts) to avoid an import cycle:\n * installer-core.types.ts already imports from this module, so this module\n * must not import back.\n */\nexport interface CompletionData {\n  /** Integration identifier (e.g. 'nextjs') */\n  integration: string;\n  /** Lockfile-aware dev command, e.g. \"pnpm run dev\" */\n  devCommand: string;\n  /** App URL with the detected port, e.g. \"http://localhost:3000\" */\n  url: string;\n  /** Changed files (git-relative), full list — display cap lives in the renderer */\n  files: string[];\n  /** Composed concrete + framework next-step lines */\n  nextSteps: string[];\n  /** Per-framework docs URL */\n  docsUrl: string;\n  /** WorkOS dashboard URL */\n  dashboardUrl: string;\n  /** Optional per-framework \"add a sign-in link\" snippet */\n  signInSnippet?: string;\n}\n\nexport interface InstallerEvents {\n  status: { message: string };\n  output: { text: string; isError?: boolean };\n  'file:write': { path: string; content: string };\n  'file:edit': { path: string; oldContent: string; newContent: string };\n  'prompt:request': { id: string; message: string; options?: string[] };\n  'prompt:response': { id: string; value: string };\n  'confirm:request': { id: string; message: string; warning?: string; files?: string[] };\n  'confirm:response': { id: string; confirmed: boolean };\n  'credentials:request': { requiresApiKey: boolean };\n  'credentials:response': { apiKey: string; clientId: string };\n  complete: { success: boolean; summary?: string; completion?: CompletionData };\n  error: { message: string; stack?: string };\n\n  'state:enter': { state: string };\n  'state:exit': { state: string };\n  'auth:checking': Record<string, never>;\n  'auth:required': Record<string, never>;\n  'auth:success': Record<string, never>;\n  'auth:failure': { message: string };\n  'detection:start': Record<string, never>;\n  'detection:complete': { integration: string };\n  'detection:none': Record<string, never>;\n  'git:checking': Record<string, never>;\n  'git:clean': Record<string, never>;\n  'git:dirty': { files: string[] };\n  'git:dirty:confirmed': Record<string, never>;\n  'git:dirty:cancelled': Record<string, never>;\n  'credentials:gathering': { requiresApiKey: boolean };\n  'credentials:found': Record<string, never>;\n  // Credential discovery events\n  'credentials:env:detected': { files: string[] };\n  'credentials:env:prompt': { files: string[] };\n  'credentials:env:scanning': Record<string, never>;\n  'credentials:env:found': { sourcePath: string };\n  'credentials:env:notfound': Record<string, never>;\n  // Device auth events\n  'device:started': { verificationUri: string; verificationUriComplete: string; userCode: string };\n  'device:polling': Record<string, never>;\n  'device:success': { email?: string };\n  'device:timeout': Record<string, never>;\n  'device:error': { message: string };\n  // Staging API events\n  'staging:fetching': Record<string, never>;\n  'staging:success': { source?: 'device' | 'stored' };\n  'staging:error': { message: string; statusCode?: number };\n  'config:start': Record<string, never>;\n  'config:complete': Record<string, never>;\n  'agent:start': Record<string, never>;\n  'agent:progress': { step: string; detail?: string };\n  'agent:success': { summary?: string };\n  'agent:failure': { message: string; stack?: string };\n  'agent:retry': { attempt: number; maxRetries: number };\n  // Surfaced agent tool activity (e.g. Bash commands run during install)\n  'agent:tool': { kind: 'command'; detail: string };\n\n  'validation:retry:start': { attempt: number };\n  'validation:retry:complete': { attempt: number; passed: boolean };\n\n  'validation:start': { framework: string };\n  'validation:issues': { issues: import('./validation/types.js').ValidationIssue[] };\n  'validation:complete': { passed: boolean; issueCount: number; durationMs: number };\n\n  // Scaffold events (empty-directory app scaffolding)\n  'scaffold:checking': Record<string, never>;\n  'scaffold:prompt': { packageManager: string };\n  'scaffold:start': { packageManager: string };\n  'scaffold:progress': { text: string };\n  'scaffold:complete': Record<string, never>;\n  'scaffold:failed': { error: string };\n  'scaffold:skipped': Record<string, never>;\n\n  // Branch check events\n  'branch:checking': Record<string, never>;\n  'branch:protected': { branch: string };\n  'branch:prompt': { branch: string };\n  'branch:created': { branch: string };\n  'branch:create:failed': { error: string };\n  'branch:skipped': Record<string, never>;\n\n  // Post-install events\n  'postinstall:changes': { files: string[] };\n  'postinstall:nochanges': Record<string, never>;\n  'postinstall:commit:prompt': Record<string, never>;\n  'postinstall:commit:generating': Record<string, never>;\n  'postinstall:commit:committing': { message: string };\n  'postinstall:commit:success': { message: string };\n  'postinstall:commit:failed': { error: string };\n  'postinstall:pr:prompt': Record<string, never>;\n  'postinstall:pr:generating': Record<string, never>;\n  'postinstall:pr:pushing': Record<string, never>;\n  'postinstall:pr:creating': Record<string, never>;\n  'postinstall:pr:success': { url: string };\n  'postinstall:pr:failed': { error: string };\n  'postinstall:push:failed': { error: string };\n  'postinstall:manual': { instructions: string };\n}\n\nexport type InstallerEventName = keyof InstallerEvents;\n\nexport class InstallerEventEmitter extends EventEmitter {\n  emit<K extends InstallerEventName>(event: K, payload: InstallerEvents[K]): boolean {\n    return super.emit(event, payload);\n  }\n\n  on<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.on(event, listener);\n  }\n\n  off<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.off(event, listener);\n  }\n\n  once<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.once(event, listener);\n  }\n}\n\nexport function createInstallerEventEmitter(): InstallerEventEmitter {\n  return new InstallerEventEmitter();\n}\n"]}

package/dist/lib/framework-config.d.ts

@@ -116,6 +116,12 @@ export interface UIConfig {
     getOutroChanges: (context: any) => string[];
     /** Generate "Next steps" bullets from context */
     getOutroNextSteps: (context: any) => string[];
+    /**
+     * Optional per-framework "add a sign-in link" snippet, surfaced as a next
+     * step in the completion summary. Only defined for frameworks that scaffold
+     * interactive auth UI. Copy must stay accurate to what the agent scaffolds.
+     */
+    getSignInSnippet?: (context: any) => string;
 }
 /**
  * Generate welcome message from framework name

package/dist/lib/framework-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"framework-config.js","sourceRoot":"","sources":["../../src/lib/framework-config.ts"],"names":[],"mappings":"AAmJA;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB;IACrD,OAAO,kBAAkB,aAAa,4BAA4B,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iFAAiF,CAAC","sourcesContent":["import type { InstallerOptions } from '../utils/types.js';\n\n/**\n * Supported programming languages for framework integrations.\n */\nexport type Language = 'javascript' | 'python' | 'ruby' | 'php' | 'go' | 'kotlin' | 'dotnet' | 'elixir';\n\n/**\n * Configuration interface for framework-specific agent integrations.\n * Each framework exports a FrameworkConfig that the universal runner uses.\n */\nexport interface FrameworkConfig {\n  metadata: FrameworkMetadata;\n  detection: FrameworkDetection;\n  environment: EnvironmentConfig;\n  analytics: AnalyticsConfig;\n  prompts: PromptConfig;\n  ui: UIConfig;\n}\n\n/**\n * Basic framework information and documentation\n */\nexport interface FrameworkMetadata {\n  /** Display name (e.g., \"Next.js\", \"React\") */\n  name: string;\n\n  /** Integration identifier (e.g., 'nextjs', 'python'). String, not enum — auto-discovered from registry. */\n  integration: string;\n\n  /** URL to framework-specific WorkOS AuthKit docs */\n  docsUrl: string;\n\n  /**\n   * Optional URL to docs for users with unsupported framework versions.\n   * If not provided, defaults to docsUrl.\n   */\n  unsupportedVersionDocsUrl?: string;\n\n  /**\n   * Optional function to gather framework-specific context before agent runs.\n   * For Next.js: detects router type\n   * For React Native: detects Expo vs bare\n   */\n  gatherContext?: (options: InstallerOptions) => Promise<Record<string, any>>;\n\n  /**\n   * Name of the framework-specific skill for agent integration.\n   * Skills are located in .claude/skills/{skillName}/SKILL.md\n   */\n  skillName?: string;\n\n  /** Language ecosystem this integration belongs to */\n  language: Language;\n\n  /** Stability tier: 'stable' for tested integrations, 'experimental' for new ones */\n  stability: 'stable' | 'experimental';\n\n  /** Detection priority — higher numbers are checked first */\n  priority: number;\n\n  /** Default package manager command (e.g., 'pip', 'gem', 'go'). Optional for JS integrations. */\n  packageManager?: string;\n\n  /** Primary manifest file (e.g., 'pyproject.toml', 'Gemfile'). Optional for JS integrations. */\n  manifestFile?: string;\n\n  /**\n   * Optional custom detection override for non-JS integrations. When present,\n   * the registry calls this instead of falling back to `manifestFile` existence.\n   * Use when a single manifest file isn't enough (e.g., Django projects may\n   * use `manage.py` + `requirements.txt` without a `pyproject.toml`).\n   */\n  detect?: (options: Pick<InstallerOptions, 'installDir'>) => boolean | Promise<boolean>;\n}\n\n/**\n * Framework detection and version handling\n */\nexport interface FrameworkDetection {\n  /** Package name to check in package.json (e.g., \"next\", \"react\") */\n  packageName: string;\n\n  /** Human-readable name for error messages (e.g., \"Next.js\") */\n  packageDisplayName: string;\n\n  /** Extract version from package.json */\n  getVersion: (packageJson: any) => string | undefined;\n\n  /** Optional: Convert version to analytics bucket (e.g., \"15.x\") */\n  getVersionBucket?: (version: string) => string;\n}\n\n/**\n * Environment variable configuration\n */\nexport interface EnvironmentConfig {\n  /** Whether to upload env vars to hosting providers post-agent */\n  uploadToHosting: boolean;\n\n  /** Whether this framework requires API key (false for client-only SDKs) */\n  requiresApiKey: boolean;\n\n  /**\n   * Build the environment variables object for this framework.\n   * Returns the exact variable names and values to upload to hosting providers.\n   */\n  getEnvVars: (apiKey: string, clientId: string) => Record<string, string>;\n}\n\n/**\n * Analytics configuration\n */\nexport interface AnalyticsConfig {\n  /** Generate tags from context (e.g., { 'nextjs-version': '15.x', 'router': 'app' }) */\n  getTags: (context: any) => Record<string, any>;\n\n  /** Optional: Additional event properties */\n  getEventProperties?: (context: any) => Record<string, any>;\n}\n\n/**\n * Prompt configuration\n */\nexport interface PromptConfig {\n  /**\n   * Optional: Additional context lines to append to base prompt\n   * For Next.js: \"- Router: app\"\n   * For React Native: \"- Platform: Expo\"\n   */\n  getAdditionalContextLines?: (context: any) => string[];\n}\n\n/**\n * UI messaging configuration\n */\nexport interface UIConfig {\n  /** Success message when agent completes */\n  successMessage: string;\n\n  /** Generate \"What the agent did\" bullets from context */\n  getOutroChanges: (context: any) => string[];\n\n  /** Generate \"Next steps\" bullets from context */\n  getOutroNextSteps: (context: any) => string[];\n}\n\n/**\n * Generate welcome message from framework name\n */\nexport function getWelcomeMessage(frameworkName: string): string {\n  return `WorkOS AuthKit ${frameworkName} installer (agent-powered)`;\n}\n\n/**\n * Shared spinner message for all frameworks\n */\nexport const SPINNER_MESSAGE = 'Setting up WorkOS AuthKit with login, authentication, and session management...';\n"]}
+{"version":3,"file":"framework-config.js","sourceRoot":"","sources":["../../src/lib/framework-config.ts"],"names":[],"mappings":"AA0JA;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB;IACrD,OAAO,kBAAkB,aAAa,4BAA4B,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iFAAiF,CAAC","sourcesContent":["import type { InstallerOptions } from '../utils/types.js';\n\n/**\n * Supported programming languages for framework integrations.\n */\nexport type Language = 'javascript' | 'python' | 'ruby' | 'php' | 'go' | 'kotlin' | 'dotnet' | 'elixir';\n\n/**\n * Configuration interface for framework-specific agent integrations.\n * Each framework exports a FrameworkConfig that the universal runner uses.\n */\nexport interface FrameworkConfig {\n  metadata: FrameworkMetadata;\n  detection: FrameworkDetection;\n  environment: EnvironmentConfig;\n  analytics: AnalyticsConfig;\n  prompts: PromptConfig;\n  ui: UIConfig;\n}\n\n/**\n * Basic framework information and documentation\n */\nexport interface FrameworkMetadata {\n  /** Display name (e.g., \"Next.js\", \"React\") */\n  name: string;\n\n  /** Integration identifier (e.g., 'nextjs', 'python'). String, not enum — auto-discovered from registry. */\n  integration: string;\n\n  /** URL to framework-specific WorkOS AuthKit docs */\n  docsUrl: string;\n\n  /**\n   * Optional URL to docs for users with unsupported framework versions.\n   * If not provided, defaults to docsUrl.\n   */\n  unsupportedVersionDocsUrl?: string;\n\n  /**\n   * Optional function to gather framework-specific context before agent runs.\n   * For Next.js: detects router type\n   * For React Native: detects Expo vs bare\n   */\n  gatherContext?: (options: InstallerOptions) => Promise<Record<string, any>>;\n\n  /**\n   * Name of the framework-specific skill for agent integration.\n   * Skills are located in .claude/skills/{skillName}/SKILL.md\n   */\n  skillName?: string;\n\n  /** Language ecosystem this integration belongs to */\n  language: Language;\n\n  /** Stability tier: 'stable' for tested integrations, 'experimental' for new ones */\n  stability: 'stable' | 'experimental';\n\n  /** Detection priority — higher numbers are checked first */\n  priority: number;\n\n  /** Default package manager command (e.g., 'pip', 'gem', 'go'). Optional for JS integrations. */\n  packageManager?: string;\n\n  /** Primary manifest file (e.g., 'pyproject.toml', 'Gemfile'). Optional for JS integrations. */\n  manifestFile?: string;\n\n  /**\n   * Optional custom detection override for non-JS integrations. When present,\n   * the registry calls this instead of falling back to `manifestFile` existence.\n   * Use when a single manifest file isn't enough (e.g., Django projects may\n   * use `manage.py` + `requirements.txt` without a `pyproject.toml`).\n   */\n  detect?: (options: Pick<InstallerOptions, 'installDir'>) => boolean | Promise<boolean>;\n}\n\n/**\n * Framework detection and version handling\n */\nexport interface FrameworkDetection {\n  /** Package name to check in package.json (e.g., \"next\", \"react\") */\n  packageName: string;\n\n  /** Human-readable name for error messages (e.g., \"Next.js\") */\n  packageDisplayName: string;\n\n  /** Extract version from package.json */\n  getVersion: (packageJson: any) => string | undefined;\n\n  /** Optional: Convert version to analytics bucket (e.g., \"15.x\") */\n  getVersionBucket?: (version: string) => string;\n}\n\n/**\n * Environment variable configuration\n */\nexport interface EnvironmentConfig {\n  /** Whether to upload env vars to hosting providers post-agent */\n  uploadToHosting: boolean;\n\n  /** Whether this framework requires API key (false for client-only SDKs) */\n  requiresApiKey: boolean;\n\n  /**\n   * Build the environment variables object for this framework.\n   * Returns the exact variable names and values to upload to hosting providers.\n   */\n  getEnvVars: (apiKey: string, clientId: string) => Record<string, string>;\n}\n\n/**\n * Analytics configuration\n */\nexport interface AnalyticsConfig {\n  /** Generate tags from context (e.g., { 'nextjs-version': '15.x', 'router': 'app' }) */\n  getTags: (context: any) => Record<string, any>;\n\n  /** Optional: Additional event properties */\n  getEventProperties?: (context: any) => Record<string, any>;\n}\n\n/**\n * Prompt configuration\n */\nexport interface PromptConfig {\n  /**\n   * Optional: Additional context lines to append to base prompt\n   * For Next.js: \"- Router: app\"\n   * For React Native: \"- Platform: Expo\"\n   */\n  getAdditionalContextLines?: (context: any) => string[];\n}\n\n/**\n * UI messaging configuration\n */\nexport interface UIConfig {\n  /** Success message when agent completes */\n  successMessage: string;\n\n  /** Generate \"What the agent did\" bullets from context */\n  getOutroChanges: (context: any) => string[];\n\n  /** Generate \"Next steps\" bullets from context */\n  getOutroNextSteps: (context: any) => string[];\n\n  /**\n   * Optional per-framework \"add a sign-in link\" snippet, surfaced as a next\n   * step in the completion summary. Only defined for frameworks that scaffold\n   * interactive auth UI. Copy must stay accurate to what the agent scaffolds.\n   */\n  getSignInSnippet?: (context: any) => string;\n}\n\n/**\n * Generate welcome message from framework name\n */\nexport function getWelcomeMessage(frameworkName: string): string {\n  return `WorkOS AuthKit ${frameworkName} installer (agent-powered)`;\n}\n\n/**\n * Shared spinner message for all frameworks\n */\nexport const SPINNER_MESSAGE = 'Setting up WorkOS AuthKit with login, authentication, and session management...';\n"]}

package/dist/lib/installer-core.d.ts

@@ -1,6 +1,7 @@
 import { type ActorRefFrom } from 'xstate';
 import type { InstallerMachineContext, InstallerMachineInput, DetectionOutput, GitCheckOutput, AgentOutput, EnvFileInfo, DiscoveryResult, BranchCheckOutput, WorkspaceCheckOutput } from './installer-core.types.js';
 import type { InstallerOptions } from '../utils/types.js';
+import type { CompletionData } from './events.js';
 import type { DeviceAuthResult, DeviceAuthResponse } from './device-auth.js';
 import type { StagingCredentials } from './staging-api.js';
 export declare const installerMachine: import("xstate").StateMachine<InstallerMachineContext, {
@@ -56,6 +57,8 @@ export declare const installerMachine: import("xstate").StateMachine<InstallerMa
         context: InstallerMachineContext;
     }, import("xstate").EventObject> | import("xstate").PromiseActorLogic<AgentOutput, {
         context: InstallerMachineContext;
+    }, import("xstate").EventObject> | import("xstate").PromiseActorLogic<CompletionData | undefined, {
+        context: InstallerMachineContext;
     }, import("xstate").EventObject> | import("xstate").PromiseActorLogic<EnvFileInfo, {
         installDir: string;
     }, import("xstate").EventObject> | import("xstate").PromiseActorLogic<DiscoveryResult, {
@@ -142,6 +145,12 @@ export declare const installerMachine: import("xstate").StateMachine<InstallerMa
         context: InstallerMachineContext;
     }, import("xstate").EventObject>;
     id: string | undefined;
+} | {
+    src: "buildCompletion";
+    logic: import("xstate").PromiseActorLogic<CompletionData | undefined, {
+        context: InstallerMachineContext;
+    }, import("xstate").EventObject>;
+    id: string | undefined;
 } | {
     src: "detectEnvFiles";
     logic: import("xstate").PromiseActorLogic<EnvFileInfo, {
@@ -442,6 +451,9 @@ export declare const installerMachine: import("xstate").StateMachine<InstallerMa
 } | {
     type: "emitComplete";
     params: unknown;
+} | {
+    type: "assignCompletion";
+    params: unknown;
 }, {
     type: "shouldSkipAuth";
     params: unknown;
@@ -466,7 +478,7 @@ export declare const installerMachine: import("xstate").StateMachine<InstallerMa
 } | {
     type: "shouldAutoScaffold";
     params: unknown;
-}, never, "error" | "cancelled" | "complete" | "idle" | "authenticating" | "configuring" | "runningAgent" | {
+}, never, "cancelled" | "error" | "complete" | "idle" | "authenticating" | "configuring" | "runningAgent" | "buildingCompletion" | {
     scaffold: "done" | "checking" | "running" | "prompting";
 } | {
     preparing: {
@@ -547,6 +559,7 @@ export declare const installerMachine: import("xstate").StateMachine<InstallerMa
                 readonly done: {};
             };
         };
+        readonly buildingCompletion: {};
         readonly complete: {};
         readonly cancelled: {};
         readonly error: {};

package/dist/lib/installer-core.js

@@ -1,6 +1,7 @@
 import { setup, assign, fromPromise } from 'xstate';
 import { getManualPrInstructions } from './post-install.js';
 import { hasGhCli } from '../utils/git-utils.js';
+import { formatWorkOSCommand } from '../utils/command-invocation.js';
 export const installerMachine = setup({
     types: {
         context: {},
@@ -146,7 +147,7 @@ export const installerMachine = setup({
             context.emitter.emit('staging:fetching', {});
         },
         emitStagingSuccess: ({ context }) => {
-            context.emitter.emit('staging:success', {});
+            context.emitter.emit('staging:success', { source: context.deviceAuth ? 'device' : 'stored' });
         },
         emitStagingError: ({ context }) => {
             const message = context.error?.message ?? 'Failed to fetch staging credentials';
@@ -291,8 +292,11 @@ export const installerMachine = setup({
         },
         emitComplete: ({ context }) => {
             const summary = context.agentSummary ?? 'WorkOS AuthKit installed successfully!';
-            context.emitter.emit('complete', { success: true, summary });
+            context.emitter.emit('complete', { success: true, summary, completion: context.completion });
         },
+        assignCompletion: assign({
+            completion: ({ event }) => event.output,
+        }),
     },
     guards: {
         shouldSkipAuth: ({ context }) => context.options.skipAuth === true,
@@ -331,6 +335,9 @@ export const installerMachine = setup({
         runAgent: fromPromise(async () => {
             throw new Error('runAgent not implemented - provide via machine.provide()');
         }),
+        buildCompletion: fromPromise(async () => {
+            throw new Error('buildCompletion not implemented - provide via machine.provide()');
+        }),
         // Credential discovery actors
         detectEnvFiles: fromPromise(async () => {
             throw new Error('detectEnvFiles not implemented - provide via machine.provide()');
@@ -667,7 +674,7 @@ export const installerMachine = setup({
                                     `Because this directory isn't empty, a new app wasn't scaffolded, and no recognized ` +
                                     `framework (such as a package.json with Next.js) was found to install into.\n\n` +
                                     `Next steps:\n` +
-                                    `  - New app: run \`workos install\` in an empty directory to scaffold Next.js + AuthKit.\n` +
+                                    `  - New app: run \`${formatWorkOSCommand('install')}\` in an empty directory to scaffold Next.js + AuthKit.\n` +
                                     `  - Existing project: run from the directory that contains your package.json, or pass --install-dir <path>.`);
                             },
                         }),
@@ -950,7 +957,7 @@ export const installerMachine = setup({
                 checking: {
                     always: [
                         {
-                            target: '#installer.complete',
+                            target: '#installer.buildingCompletion',
                             guard: 'shouldSkipPostInstall',
                         },
                         { target: 'detectingChanges' },
@@ -1095,7 +1102,19 @@ export const installerMachine = setup({
                 },
             },
             onDone: {
-                target: 'complete',
+                target: 'buildingCompletion',
+            },
+        },
+        // Compute the structured completion payload before entering `complete`.
+        // `emitComplete` is a synchronous entry action, but the builder is async
+        // (lockfile-aware dev command, port detection), so it must run in an actor
+        // first. Errors never block completion — they fall through to the static box.
+        buildingCompletion: {
+            invoke: {
+                src: 'buildCompletion',
+                input: ({ context }) => ({ context }),
+                onDone: { target: 'complete', actions: ['assignCompletion'] },
+                onError: { target: 'complete' },
             },
         },
         complete: {