workos 0.18.0 → 0.19.0

package/dist/commands/env.js

@@ -1,11 +1,12 @@
 import chalk from 'chalk';
-import clack from '../utils/clack.js';
-import { getConfig, saveConfig, isUnclaimedEnvironment } from '../lib/config-store.js';
+import ui from '../utils/ui.js';
+import { getConfig, saveConfig, isUnclaimedEnvironment, freshEnvKey } from '../lib/config-store.js';
 import { outputSuccess, outputJson, exitWithError, isJsonMode } from '../utils/output.js';
 import { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';
 import { missingArgsRecovery } from '../utils/recovery-hints.js';
 import { formatWorkOSCommand } from '../utils/command-invocation.js';
 import { ExitCode, exitWithCode } from '../utils/exit-codes.js';
+import { provisionUnclaimedEnvironment, UnclaimedEnvApiError, } from '../lib/unclaimed-env-api.js';
 const ENV_NAME_REGEX = /^[a-z0-9\-_]+$/;
 function validateEnvName(name) {
     if (!name || !ENV_NAME_REGEX.test(name)) {
@@ -39,23 +40,23 @@ export async function runEnvAdd(options) {
     }
     else {
         // Interactive mode
-        const nameResult = await clack.text({
+        const nameResult = await ui.text({
             message: 'Enter a name for the environment (e.g., production, sandbox, local)',
             validate: (value) => validateEnvName(value),
         });
-        if (clack.isCancel(nameResult))
+        if (ui.isCancel(nameResult))
             exitWithCode(ExitCode.CANCELLED);
         name = nameResult;
-        const typeResult = await clack.select({
+        const typeResult = await ui.select({
             message: 'Select the environment type',
             options: [
                 { value: 'production', label: 'Production' },
                 { value: 'sandbox', label: 'Sandbox' },
             ],
         });
-        if (clack.isCancel(typeResult))
+        if (ui.isCancel(typeResult))
             exitWithCode(ExitCode.CANCELLED);
-        const apiKeyResult = await clack.password({
+        const apiKeyResult = await ui.password({
             message: 'Enter the API key for this environment',
             validate: (value) => {
                 if (!value)
@@ -63,7 +64,7 @@ export async function runEnvAdd(options) {
                 return undefined;
             },
         });
-        if (clack.isCancel(apiKeyResult))
+        if (ui.isCancel(apiKeyResult))
             exitWithCode(ExitCode.CANCELLED);
         apiKey = apiKeyResult;
         const config = getOrCreateConfig();
@@ -79,9 +80,9 @@ export async function runEnvAdd(options) {
             config.activeEnvironment = name;
         }
         saveConfig(config);
-        clack.log.success(`Environment ${chalk.bold(name)} added`);
+        ui.log.success(`Environment ${chalk.bold(name)} added`);
         if (isFirst) {
-            clack.log.info(`Set as active environment`);
+            ui.log.info(`Set as active environment`);
         }
         return;
     }
@@ -102,35 +103,110 @@ export async function runEnvAdd(options) {
     saveConfig(config);
     outputSuccess('Environment added', { name: name, type, active: isFirst });
 }
+/**
+ * `workos env provision` — provision a fresh unclaimed environment (credentials only).
+ *
+ * Calls the low-level `provisionUnclaimedEnvironment()` directly (no auth, no
+ * code-gen). Credentials are delivered on stdout (JSON is the agent credential
+ * channel) and persisted locally as an unclaimed env so a follow-up
+ * `env claim` works. NEVER writes to the project directory or any `.env` file,
+ * and NEVER falls back to an interactive login on failure.
+ */
+export async function runEnvProvision() {
+    let result;
+    try {
+        result = await provisionUnclaimedEnvironment();
+    }
+    catch (error) {
+        if (error instanceof UnclaimedEnvApiError) {
+            exitWithError({
+                code: error.statusCode === 429 ? 'rate_limited' : 'provision_failed',
+                message: error.message,
+                ...(error.statusCode && { apiContext: { status: error.statusCode } }),
+            });
+        }
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        exitWithError({ code: 'provision_failed', message: `Failed to provision environment: ${message}` });
+    }
+    // Persist as an unclaimed env (parity with install) — NEVER writes to the project dir.
+    // A fresh key ('unclaimed', 'unclaimed-2', …) so a repeated provision never clobbers an
+    // earlier env's claim token, which lives only in this config and is unrecoverable.
+    const config = getOrCreateConfig();
+    const key = freshEnvKey(config, 'unclaimed');
+    config.environments[key] = {
+        name: key,
+        type: 'unclaimed',
+        apiKey: result.apiKey,
+        clientId: result.clientId,
+        claimToken: result.claimToken,
+    };
+    config.activeEnvironment = key;
+    saveConfig(config);
+    if (isJsonMode()) {
+        outputSuccess('Environment provisioned', {
+            name: key,
+            type: 'unclaimed',
+            active: true,
+            apiKey: result.apiKey,
+            clientId: result.clientId,
+            claimToken: result.claimToken,
+            authkitDomain: result.authkitDomain,
+        });
+        return;
+    }
+    ui.log.success('Provisioned a new WorkOS environment');
+    console.log('');
+    console.log(`  ${chalk.dim('API key')}     ${result.apiKey}`);
+    console.log(`  ${chalk.dim('Client ID')}   ${result.clientId}`);
+    console.log(`  ${chalk.dim('AuthKit')}     ${result.authkitDomain}`);
+    console.log('');
+    ui.log.info(`Set as active environment (${key}). Run \`${formatWorkOSCommand('env claim')}\` to link it to your account (permanent).`);
+    if (key !== 'unclaimed') {
+        ui.log.info(`Your earlier unclaimed environment(s) are kept. See \`${formatWorkOSCommand('env list')}\`.`);
+    }
+}
 export async function runEnvRemove(name) {
     const config = getConfig();
     if (!config || Object.keys(config.environments).length === 0) {
         exitWithError({
             code: 'no_environments',
-            message: 'No environments configured. Run `workos env add` to get started.',
+            message: `No environments configured. Run \`${formatWorkOSCommand('env add')}\` to get started.`,
         });
     }
     if (!config.environments[name]) {
         const available = Object.keys(config.environments).join(', ');
         exitWithError({ code: 'not_found', message: `Environment "${name}" not found. Available: ${available}` });
     }
+    // Capture the claim risk BEFORE deleting — an unclaimed env's claim token lives
+    // only in this local config, so removing it permanently loses the ability to claim.
+    const wasUnclaimed = isUnclaimedEnvironment(config.environments[name]);
     delete config.environments[name];
+    if (!isJsonMode()) {
+        ui.log.warn(wasUnclaimed
+            ? `Removed only the local CLI config for "${name}". This environment was unclaimed — its claim token lived only here, so it can no longer be claimed.`
+            : `Removed only the local CLI config for "${name}". The environment still exists in WorkOS.`);
+    }
     if (config.activeEnvironment === name) {
         const remaining = Object.keys(config.environments);
         config.activeEnvironment = remaining.length > 0 ? remaining[0] : undefined;
         if (config.activeEnvironment && !isJsonMode()) {
-            clack.log.info(`Active environment switched to ${chalk.bold(config.activeEnvironment)}`);
+            ui.log.info(`Active environment switched to ${chalk.bold(config.activeEnvironment)}`);
         }
     }
     saveConfig(config);
-    outputSuccess('Environment removed', { name, newActive: config.activeEnvironment ?? null });
+    outputSuccess('Environment removed', {
+        name,
+        newActive: config.activeEnvironment ?? null,
+        localOnly: true,
+        wasUnclaimed,
+    });
 }
 export async function runEnvSwitch(name) {
     const config = getConfig();
     if (!config || Object.keys(config.environments).length === 0) {
         exitWithError({
             code: 'no_environments',
-            message: 'No environments configured. Run `workos env add` to get started.',
+            message: `No environments configured. Run \`${formatWorkOSCommand('env add')}\` to get started.`,
         });
     }
     if (name) {
@@ -151,11 +227,11 @@ export async function runEnvSwitch(name) {
                 label += chalk.green(' (active)');
             return { value: key, label };
         });
-        const selected = await clack.select({
+        const selected = await ui.select({
             message: 'Select an environment',
             options,
         });
-        if (clack.isCancel(selected))
+        if (ui.isCancel(selected))
             exitWithCode(ExitCode.CANCELLED);
         name = selected;
     }
@@ -179,7 +255,7 @@ export async function runEnvList() {
             outputJson({ data: [] });
         }
         else {
-            clack.log.info('No environments configured. Run `workos env add` to get started.');
+            ui.log.info(`No environments configured. Run \`${formatWorkOSCommand('env add')}\` to get started.`);
         }
         return;
     }
@@ -221,7 +297,7 @@ export async function runEnvList() {
     }
     if (hasUnclaimed) {
         console.log('');
-        console.log(chalk.dim('  Run `workos env claim` to keep this environment.'));
+        console.log(chalk.dim(`  Run \`${formatWorkOSCommand('env claim')}\` to keep this environment.`));
     }
 }
 //# sourceMappingURL=env.js.map

package/dist/commands/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEhE,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,SAAS,eAAe,CAAC,IAAwB;IAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,6EAA6E,CAAC;IACvF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAK/B;IACC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE7B,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACnB,uBAAuB;QACvB,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAC9B,aAAa,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,WAAW,EAAE;gBACpB,CAAC,CAAC,qDAAqD,mBAAmB,CAAC,oDAAoD,CAAC,EAAE;gBAClI,CAAC,CAAC,QAAQ,EAAE;oBACV,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,0DAA0D;YAChE,QAAQ,EAAE,mBAAmB,CAAC,SAAS,EAAE,+DAA+D,CAAC;SAC1G,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,mBAAmB;QACnB,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;YAClC,OAAO,EAAE,qEAAqE;YAC9E,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,GAAG,UAAU,CAAC;QAElB,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YACpC,OAAO,EAAE,6BAA6B;YACtC,OAAO,EAAE;gBACP,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;gBAC5C,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;aACvC;SACF,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEjE,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC;YACxC,OAAO,EAAE,wCAAwC;YACjD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,IAAI,CAAC,KAAK;oBAAE,OAAO,qBAAqB,CAAC;gBACzC,OAAO,SAAS,CAAC;YACnB,CAAC;SACF,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,GAAG,YAAY,CAAC;QAEtB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAE9D,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG;YAC1B,IAAI;YACJ,IAAI,EAAE,UAAsC;YAC5C,MAAM;YACN,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;SAC9B,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAClC,CAAC;QAED,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;IACT,CAAC;IAED,uBAAuB;IACvB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAE9D,MAAM,IAAI,GAA6B,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAEhG,MAAM,CAAC,YAAY,CAAC,IAAK,CAAC,GAAG;QAC3B,IAAI,EAAE,IAAK;QACX,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC9B,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAClC,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,aAAa,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,kEAAkE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,IAAI,2BAA2B,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,MAAM,CAAC,iBAAiB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC9C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,aAAa,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAa;IAC9C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,kEAAkE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,IAAI,2BAA2B,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE;YACrE,IAAI,KAAK,GAAG,GAAG,CAAC;YAChB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,KAAK,IAAI,YAAY,CAAC;YAClD,IAAI,GAAG,CAAC,QAAQ;gBAAE,KAAK,IAAI,KAAK,GAAG,CAAC,QAAQ,GAAG,CAAC;YAChD,IAAI,GAAG,KAAK,MAAM,CAAC,iBAAiB;gBAAE,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YAClC,OAAO,EAAE,uBAAuB;YAChC,OAAO;SACR,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,GAAG,QAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAChC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;QACzC,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EACL,gHAAgH;aACnH;SACF;QACH,CAAC,CAAC,SAAS,CAAC;IACd,aAAa,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAEpD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,KAAK,MAAM,CAAC,iBAAiB;YACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;YAC9B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACvB,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;SAC5B,CAAC,CAAC,CAAC;QACJ,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,KAAK,GACT,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,EAAE,CAAC;IAEjB,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QAClB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,KAAK,MAAM,CAAC,iBAAiB,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9E,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QACzF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEtD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC","sourcesContent":["import chalk from 'chalk';\nimport clack from '../utils/clack.js';\nimport { getConfig, saveConfig, isUnclaimedEnvironment } from '../lib/config-store.js';\nimport type { CliConfig } from '../lib/config-store.js';\nimport { outputSuccess, outputJson, exitWithError, isJsonMode } from '../utils/output.js';\nimport { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';\nimport { missingArgsRecovery } from '../utils/recovery-hints.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\n\nconst ENV_NAME_REGEX = /^[a-z0-9\\-_]+$/;\n\nfunction validateEnvName(name: string | undefined): string | undefined {\n  if (!name || !ENV_NAME_REGEX.test(name)) {\n    return 'Name must contain only lowercase letters, numbers, hyphens, and underscores';\n  }\n  return undefined;\n}\n\nfunction getOrCreateConfig(): CliConfig {\n  return getConfig() ?? { environments: {} };\n}\n\nexport async function runEnvAdd(options: {\n  name?: string;\n  apiKey?: string;\n  clientId?: string;\n  endpoint?: string;\n}): Promise<void> {\n  let { name, apiKey, endpoint } = options;\n  const { clientId } = options;\n\n  if (name && apiKey) {\n    // Non-interactive mode\n    const nameError = validateEnvName(name);\n    if (nameError) {\n      exitWithError({ code: 'invalid_args', message: nameError });\n    }\n  } else if (!isPromptAllowed()) {\n    exitWithError({\n      code: 'missing_args',\n      message: isAgentMode()\n        ? `Name and API key required in agent mode. Example: ${formatWorkOSCommand('env add staging sk_test_xxx --client-id client_xxx')}`\n        : isCiMode()\n          ? 'Name and API key required in CI mode.'\n          : 'Name and API key required when prompting is unavailable.',\n      recovery: missingArgsRecovery(undefined, 'Provide environment name and API key as positional arguments.'),\n    });\n  } else {\n    // Interactive mode\n    const nameResult = await clack.text({\n      message: 'Enter a name for the environment (e.g., production, sandbox, local)',\n      validate: (value) => validateEnvName(value),\n    });\n    if (clack.isCancel(nameResult)) exitWithCode(ExitCode.CANCELLED);\n    name = nameResult;\n\n    const typeResult = await clack.select({\n      message: 'Select the environment type',\n      options: [\n        { value: 'production', label: 'Production' },\n        { value: 'sandbox', label: 'Sandbox' },\n      ],\n    });\n    if (clack.isCancel(typeResult)) exitWithCode(ExitCode.CANCELLED);\n\n    const apiKeyResult = await clack.password({\n      message: 'Enter the API key for this environment',\n      validate: (value) => {\n        if (!value) return 'API key is required';\n        return undefined;\n      },\n    });\n    if (clack.isCancel(apiKeyResult)) exitWithCode(ExitCode.CANCELLED);\n    apiKey = apiKeyResult;\n\n    const config = getOrCreateConfig();\n    const isFirst = Object.keys(config.environments).length === 0;\n\n    config.environments[name] = {\n      name,\n      type: typeResult as 'production' | 'sandbox',\n      apiKey,\n      ...(clientId && { clientId }),\n      ...(endpoint && { endpoint }),\n    };\n\n    if (isFirst) {\n      config.activeEnvironment = name;\n    }\n\n    saveConfig(config);\n    clack.log.success(`Environment ${chalk.bold(name)} added`);\n    if (isFirst) {\n      clack.log.info(`Set as active environment`);\n    }\n    return;\n  }\n\n  // Non-interactive path\n  const config = getOrCreateConfig();\n  const isFirst = Object.keys(config.environments).length === 0;\n\n  const type: 'production' | 'sandbox' = apiKey.startsWith('sk_test_') ? 'sandbox' : 'production';\n\n  config.environments[name!] = {\n    name: name!,\n    type,\n    apiKey,\n    ...(clientId && { clientId }),\n    ...(endpoint && { endpoint }),\n  };\n\n  if (isFirst) {\n    config.activeEnvironment = name;\n  }\n\n  saveConfig(config);\n  outputSuccess('Environment added', { name: name!, type, active: isFirst });\n}\n\nexport async function runEnvRemove(name: string): Promise<void> {\n  const config = getConfig();\n  if (!config || Object.keys(config.environments).length === 0) {\n    exitWithError({\n      code: 'no_environments',\n      message: 'No environments configured. Run `workos env add` to get started.',\n    });\n  }\n\n  if (!config.environments[name]) {\n    const available = Object.keys(config.environments).join(', ');\n    exitWithError({ code: 'not_found', message: `Environment \"${name}\" not found. Available: ${available}` });\n  }\n\n  delete config.environments[name];\n\n  if (config.activeEnvironment === name) {\n    const remaining = Object.keys(config.environments);\n    config.activeEnvironment = remaining.length > 0 ? remaining[0] : undefined;\n    if (config.activeEnvironment && !isJsonMode()) {\n      clack.log.info(`Active environment switched to ${chalk.bold(config.activeEnvironment)}`);\n    }\n  }\n\n  saveConfig(config);\n  outputSuccess('Environment removed', { name, newActive: config.activeEnvironment ?? null });\n}\n\nexport async function runEnvSwitch(name?: string): Promise<void> {\n  const config = getConfig();\n  if (!config || Object.keys(config.environments).length === 0) {\n    exitWithError({\n      code: 'no_environments',\n      message: 'No environments configured. Run `workos env add` to get started.',\n    });\n  }\n\n  if (name) {\n    if (!config.environments[name]) {\n      const available = Object.keys(config.environments).join(', ');\n      exitWithError({ code: 'not_found', message: `Environment \"${name}\" not found. Available: ${available}` });\n    }\n  } else {\n    // Interactive selection (TTY only — non-TTY guard is in bin.ts)\n    const options = Object.entries(config.environments).map(([key, env]) => {\n      let label = key;\n      if (env.type === 'sandbox') label += ` [Sandbox]`;\n      if (env.endpoint) label += ` [${env.endpoint}]`;\n      if (key === config.activeEnvironment) label += chalk.green(' (active)');\n      return { value: key, label };\n    });\n\n    const selected = await clack.select({\n      message: 'Select an environment',\n      options,\n    });\n    if (clack.isCancel(selected)) exitWithCode(ExitCode.CANCELLED);\n    name = selected as string;\n  }\n\n  config.activeEnvironment = name;\n  saveConfig(config);\n\n  const env = config.environments[name];\n  const warnings = process.env.WORKOS_API_KEY\n    ? [\n        {\n          code: 'env_var_override',\n          message:\n            \"WORKOS_API_KEY is set in your shell. It will override this environment's stored key unless you pass --api-key.\",\n        },\n      ]\n    : undefined;\n  outputSuccess('Switched environment', { name, type: env.type }, { warnings });\n}\n\nexport async function runEnvList(): Promise<void> {\n  const config = getConfig();\n  if (!config || Object.keys(config.environments).length === 0) {\n    if (isJsonMode()) {\n      outputJson({ data: [] });\n    } else {\n      clack.log.info('No environments configured. Run `workos env add` to get started.');\n    }\n    return;\n  }\n\n  const entries = Object.entries(config.environments);\n\n  if (isJsonMode()) {\n    const data = entries.map(([key, env]) => ({\n      name: key,\n      type: env.type,\n      active: key === config.activeEnvironment,\n      endpoint: env.endpoint ?? null,\n      hasApiKey: !!env.apiKey,\n      hasClientId: !!env.clientId,\n    }));\n    outputJson({ data });\n    return;\n  }\n\n  // Human-mode table\n  const hasUnclaimed = entries.some(([, env]) => isUnclaimedEnvironment(env));\n  const nameW =\n    Math.max(6, ...entries.map(([k, env]) => k.length + (isUnclaimedEnvironment(env) ? ' (unclaimed)'.length : 0))) + 2;\n  const typeW = 12;\n\n  const header = [\n    chalk.yellow('  '),\n    chalk.yellow('Name'.padEnd(nameW)),\n    chalk.yellow('Type'.padEnd(typeW)),\n    chalk.yellow('Endpoint'),\n  ].join('  ');\n\n  const separator = chalk.dim('─'.repeat(header.length));\n\n  console.log(header);\n  console.log(separator);\n\n  for (const [key, env] of entries) {\n    const isActive = key === config.activeEnvironment;\n    const marker = isActive ? chalk.green('▸ ') : '  ';\n    const unclaimed = isUnclaimedEnvironment(env);\n    const displayName = unclaimed ? `${key} ${chalk.yellow('(unclaimed)')}` : key;\n    const name = isActive ? chalk.green(displayName.padEnd(nameW)) : displayName.padEnd(nameW);\n    const type = unclaimed ? 'Unclaimed' : env.type === 'sandbox' ? 'Sandbox' : 'Production';\n    const endpoint = env.endpoint || chalk.dim('default');\n\n    console.log([marker, name, type.padEnd(typeW), endpoint].join('  '));\n  }\n\n  if (hasUnclaimed) {\n    console.log('');\n    console.log(chalk.dim('  Run `workos env claim` to keep this environment.'));\n  }\n}\n"]}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEpG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AAErC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,SAAS,eAAe,CAAC,IAAwB;IAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,6EAA6E,CAAC;IACvF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAK/B;IACC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE7B,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACnB,uBAAuB;QACvB,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAC9B,aAAa,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,WAAW,EAAE;gBACpB,CAAC,CAAC,qDAAqD,mBAAmB,CAAC,oDAAoD,CAAC,EAAE;gBAClI,CAAC,CAAC,QAAQ,EAAE;oBACV,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,0DAA0D;YAChE,QAAQ,EAAE,mBAAmB,CAAC,SAAS,EAAE,+DAA+D,CAAC;SAC1G,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,mBAAmB;QACnB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,qEAAqE;YAC9E,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,GAAG,UAAU,CAAC;QAElB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YACjC,OAAO,EAAE,6BAA6B;YACtC,OAAO,EAAE;gBACP,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;gBAC5C,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;aACvC;SACF,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE9D,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC;YACrC,OAAO,EAAE,wCAAwC;YACjD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,IAAI,CAAC,KAAK;oBAAE,OAAO,qBAAqB,CAAC;gBACzC,OAAO,SAAS,CAAC;YACnB,CAAC;SACF,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,GAAG,YAAY,CAAC;QAEtB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAE9D,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG;YAC1B,IAAI;YACJ,IAAI,EAAE,UAAsC;YAC5C,MAAM;YACN,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;SAC9B,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAClC,CAAC;QAED,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO;IACT,CAAC;IAED,uBAAuB;IACvB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAE9D,MAAM,IAAI,GAA6B,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAEhG,MAAM,CAAC,YAAY,CAAC,IAAK,CAAC,GAAG;QAC3B,IAAI,EAAE,IAAK;QACX,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC9B,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAClC,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,aAAa,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,6BAA6B,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,aAAa,CAAC;gBACZ,IAAI,EAAE,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB;gBACpE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;aACtE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,aAAa,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oCAAoC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,uFAAuF;IACvF,wFAAwF;IACxF,mFAAmF;IACnF,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG;QACzB,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,CAAC,iBAAiB,GAAG,GAAG,CAAC;IAC/B,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,aAAa,CAAC,yBAAyB,EAAE;YACvC,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,8BAA8B,GAAG,YAAY,mBAAmB,CAAC,WAAW,CAAC,4CAA4C,CAC1H,CAAC;IACF,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,qCAAqC,mBAAmB,CAAC,SAAS,CAAC,oBAAoB;SACjG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,IAAI,2BAA2B,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,gFAAgF;IAChF,oFAAoF;IACpF,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,YAAY;YACV,CAAC,CAAC,0CAA0C,IAAI,sGAAsG;YACtJ,CAAC,CAAC,0CAA0C,IAAI,4CAA4C,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,MAAM,CAAC,iBAAiB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC9C,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,aAAa,CAAC,qBAAqB,EAAE;QACnC,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,iBAAiB,IAAI,IAAI;QAC3C,SAAS,EAAE,IAAI;QACf,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAa;IAC9C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,qCAAqC,mBAAmB,CAAC,SAAS,CAAC,oBAAoB;SACjG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,IAAI,2BAA2B,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE;YACrE,IAAI,KAAK,GAAG,GAAG,CAAC;YAChB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,KAAK,IAAI,YAAY,CAAC;YAClD,IAAI,GAAG,CAAC,QAAQ;gBAAE,KAAK,IAAI,KAAK,GAAG,CAAC,QAAQ,GAAG,CAAC;YAChD,IAAI,GAAG,KAAK,MAAM,CAAC,iBAAiB;gBAAE,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC/B,OAAO,EAAE,uBAAuB;YAChC,OAAO;SACR,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,GAAG,QAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAChC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;QACzC,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EACL,gHAAgH;aACnH;SACF;QACH,CAAC,CAAC,SAAS,CAAC;IACd,aAAa,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,mBAAmB,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACvG,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAEpD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,KAAK,MAAM,CAAC,iBAAiB;YACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;YAC9B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACvB,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;SAC5B,CAAC,CAAC,CAAC;QACJ,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,KAAK,GACT,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,EAAE,CAAC;IAEjB,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QAClB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,KAAK,MAAM,CAAC,iBAAiB,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9E,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QACzF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEtD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,mBAAmB,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACpG,CAAC;AACH,CAAC","sourcesContent":["import chalk from 'chalk';\nimport ui from '../utils/ui.js';\nimport { getConfig, saveConfig, isUnclaimedEnvironment, freshEnvKey } from '../lib/config-store.js';\nimport type { CliConfig } from '../lib/config-store.js';\nimport { outputSuccess, outputJson, exitWithError, isJsonMode } from '../utils/output.js';\nimport { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';\nimport { missingArgsRecovery } from '../utils/recovery-hints.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\nimport {\n  provisionUnclaimedEnvironment,\n  UnclaimedEnvApiError,\n  type UnclaimedEnvProvisionResult,\n} from '../lib/unclaimed-env-api.js';\n\nconst ENV_NAME_REGEX = /^[a-z0-9\\-_]+$/;\n\nfunction validateEnvName(name: string | undefined): string | undefined {\n  if (!name || !ENV_NAME_REGEX.test(name)) {\n    return 'Name must contain only lowercase letters, numbers, hyphens, and underscores';\n  }\n  return undefined;\n}\n\nfunction getOrCreateConfig(): CliConfig {\n  return getConfig() ?? { environments: {} };\n}\n\nexport async function runEnvAdd(options: {\n  name?: string;\n  apiKey?: string;\n  clientId?: string;\n  endpoint?: string;\n}): Promise<void> {\n  let { name, apiKey, endpoint } = options;\n  const { clientId } = options;\n\n  if (name && apiKey) {\n    // Non-interactive mode\n    const nameError = validateEnvName(name);\n    if (nameError) {\n      exitWithError({ code: 'invalid_args', message: nameError });\n    }\n  } else if (!isPromptAllowed()) {\n    exitWithError({\n      code: 'missing_args',\n      message: isAgentMode()\n        ? `Name and API key required in agent mode. Example: ${formatWorkOSCommand('env add staging sk_test_xxx --client-id client_xxx')}`\n        : isCiMode()\n          ? 'Name and API key required in CI mode.'\n          : 'Name and API key required when prompting is unavailable.',\n      recovery: missingArgsRecovery(undefined, 'Provide environment name and API key as positional arguments.'),\n    });\n  } else {\n    // Interactive mode\n    const nameResult = await ui.text({\n      message: 'Enter a name for the environment (e.g., production, sandbox, local)',\n      validate: (value) => validateEnvName(value),\n    });\n    if (ui.isCancel(nameResult)) exitWithCode(ExitCode.CANCELLED);\n    name = nameResult;\n\n    const typeResult = await ui.select({\n      message: 'Select the environment type',\n      options: [\n        { value: 'production', label: 'Production' },\n        { value: 'sandbox', label: 'Sandbox' },\n      ],\n    });\n    if (ui.isCancel(typeResult)) exitWithCode(ExitCode.CANCELLED);\n\n    const apiKeyResult = await ui.password({\n      message: 'Enter the API key for this environment',\n      validate: (value) => {\n        if (!value) return 'API key is required';\n        return undefined;\n      },\n    });\n    if (ui.isCancel(apiKeyResult)) exitWithCode(ExitCode.CANCELLED);\n    apiKey = apiKeyResult;\n\n    const config = getOrCreateConfig();\n    const isFirst = Object.keys(config.environments).length === 0;\n\n    config.environments[name] = {\n      name,\n      type: typeResult as 'production' | 'sandbox',\n      apiKey,\n      ...(clientId && { clientId }),\n      ...(endpoint && { endpoint }),\n    };\n\n    if (isFirst) {\n      config.activeEnvironment = name;\n    }\n\n    saveConfig(config);\n    ui.log.success(`Environment ${chalk.bold(name)} added`);\n    if (isFirst) {\n      ui.log.info(`Set as active environment`);\n    }\n    return;\n  }\n\n  // Non-interactive path\n  const config = getOrCreateConfig();\n  const isFirst = Object.keys(config.environments).length === 0;\n\n  const type: 'production' | 'sandbox' = apiKey.startsWith('sk_test_') ? 'sandbox' : 'production';\n\n  config.environments[name!] = {\n    name: name!,\n    type,\n    apiKey,\n    ...(clientId && { clientId }),\n    ...(endpoint && { endpoint }),\n  };\n\n  if (isFirst) {\n    config.activeEnvironment = name;\n  }\n\n  saveConfig(config);\n  outputSuccess('Environment added', { name: name!, type, active: isFirst });\n}\n\n/**\n * `workos env provision` — provision a fresh unclaimed environment (credentials only).\n *\n * Calls the low-level `provisionUnclaimedEnvironment()` directly (no auth, no\n * code-gen). Credentials are delivered on stdout (JSON is the agent credential\n * channel) and persisted locally as an unclaimed env so a follow-up\n * `env claim` works. NEVER writes to the project directory or any `.env` file,\n * and NEVER falls back to an interactive login on failure.\n */\nexport async function runEnvProvision(): Promise<void> {\n  let result: UnclaimedEnvProvisionResult;\n  try {\n    result = await provisionUnclaimedEnvironment();\n  } catch (error) {\n    if (error instanceof UnclaimedEnvApiError) {\n      exitWithError({\n        code: error.statusCode === 429 ? 'rate_limited' : 'provision_failed',\n        message: error.message,\n        ...(error.statusCode && { apiContext: { status: error.statusCode } }),\n      });\n    }\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    exitWithError({ code: 'provision_failed', message: `Failed to provision environment: ${message}` });\n  }\n\n  // Persist as an unclaimed env (parity with install) — NEVER writes to the project dir.\n  // A fresh key ('unclaimed', 'unclaimed-2', …) so a repeated provision never clobbers an\n  // earlier env's claim token, which lives only in this config and is unrecoverable.\n  const config = getOrCreateConfig();\n  const key = freshEnvKey(config, 'unclaimed');\n  config.environments[key] = {\n    name: key,\n    type: 'unclaimed',\n    apiKey: result.apiKey,\n    clientId: result.clientId,\n    claimToken: result.claimToken,\n  };\n  config.activeEnvironment = key;\n  saveConfig(config);\n\n  if (isJsonMode()) {\n    outputSuccess('Environment provisioned', {\n      name: key,\n      type: 'unclaimed',\n      active: true,\n      apiKey: result.apiKey,\n      clientId: result.clientId,\n      claimToken: result.claimToken,\n      authkitDomain: result.authkitDomain,\n    });\n    return;\n  }\n\n  ui.log.success('Provisioned a new WorkOS environment');\n  console.log('');\n  console.log(`  ${chalk.dim('API key')}     ${result.apiKey}`);\n  console.log(`  ${chalk.dim('Client ID')}   ${result.clientId}`);\n  console.log(`  ${chalk.dim('AuthKit')}     ${result.authkitDomain}`);\n  console.log('');\n  ui.log.info(\n    `Set as active environment (${key}). Run \\`${formatWorkOSCommand('env claim')}\\` to link it to your account (permanent).`,\n  );\n  if (key !== 'unclaimed') {\n    ui.log.info(`Your earlier unclaimed environment(s) are kept. See \\`${formatWorkOSCommand('env list')}\\`.`);\n  }\n}\n\nexport async function runEnvRemove(name: string): Promise<void> {\n  const config = getConfig();\n  if (!config || Object.keys(config.environments).length === 0) {\n    exitWithError({\n      code: 'no_environments',\n      message: `No environments configured. Run \\`${formatWorkOSCommand('env add')}\\` to get started.`,\n    });\n  }\n\n  if (!config.environments[name]) {\n    const available = Object.keys(config.environments).join(', ');\n    exitWithError({ code: 'not_found', message: `Environment \"${name}\" not found. Available: ${available}` });\n  }\n\n  // Capture the claim risk BEFORE deleting — an unclaimed env's claim token lives\n  // only in this local config, so removing it permanently loses the ability to claim.\n  const wasUnclaimed = isUnclaimedEnvironment(config.environments[name]);\n\n  delete config.environments[name];\n\n  if (!isJsonMode()) {\n    ui.log.warn(\n      wasUnclaimed\n        ? `Removed only the local CLI config for \"${name}\". This environment was unclaimed — its claim token lived only here, so it can no longer be claimed.`\n        : `Removed only the local CLI config for \"${name}\". The environment still exists in WorkOS.`,\n    );\n  }\n\n  if (config.activeEnvironment === name) {\n    const remaining = Object.keys(config.environments);\n    config.activeEnvironment = remaining.length > 0 ? remaining[0] : undefined;\n    if (config.activeEnvironment && !isJsonMode()) {\n      ui.log.info(`Active environment switched to ${chalk.bold(config.activeEnvironment)}`);\n    }\n  }\n\n  saveConfig(config);\n  outputSuccess('Environment removed', {\n    name,\n    newActive: config.activeEnvironment ?? null,\n    localOnly: true,\n    wasUnclaimed,\n  });\n}\n\nexport async function runEnvSwitch(name?: string): Promise<void> {\n  const config = getConfig();\n  if (!config || Object.keys(config.environments).length === 0) {\n    exitWithError({\n      code: 'no_environments',\n      message: `No environments configured. Run \\`${formatWorkOSCommand('env add')}\\` to get started.`,\n    });\n  }\n\n  if (name) {\n    if (!config.environments[name]) {\n      const available = Object.keys(config.environments).join(', ');\n      exitWithError({ code: 'not_found', message: `Environment \"${name}\" not found. Available: ${available}` });\n    }\n  } else {\n    // Interactive selection (TTY only — non-TTY guard is in bin.ts)\n    const options = Object.entries(config.environments).map(([key, env]) => {\n      let label = key;\n      if (env.type === 'sandbox') label += ` [Sandbox]`;\n      if (env.endpoint) label += ` [${env.endpoint}]`;\n      if (key === config.activeEnvironment) label += chalk.green(' (active)');\n      return { value: key, label };\n    });\n\n    const selected = await ui.select({\n      message: 'Select an environment',\n      options,\n    });\n    if (ui.isCancel(selected)) exitWithCode(ExitCode.CANCELLED);\n    name = selected as string;\n  }\n\n  config.activeEnvironment = name;\n  saveConfig(config);\n\n  const env = config.environments[name];\n  const warnings = process.env.WORKOS_API_KEY\n    ? [\n        {\n          code: 'env_var_override',\n          message:\n            \"WORKOS_API_KEY is set in your shell. It will override this environment's stored key unless you pass --api-key.\",\n        },\n      ]\n    : undefined;\n  outputSuccess('Switched environment', { name, type: env.type }, { warnings });\n}\n\nexport async function runEnvList(): Promise<void> {\n  const config = getConfig();\n  if (!config || Object.keys(config.environments).length === 0) {\n    if (isJsonMode()) {\n      outputJson({ data: [] });\n    } else {\n      ui.log.info(`No environments configured. Run \\`${formatWorkOSCommand('env add')}\\` to get started.`);\n    }\n    return;\n  }\n\n  const entries = Object.entries(config.environments);\n\n  if (isJsonMode()) {\n    const data = entries.map(([key, env]) => ({\n      name: key,\n      type: env.type,\n      active: key === config.activeEnvironment,\n      endpoint: env.endpoint ?? null,\n      hasApiKey: !!env.apiKey,\n      hasClientId: !!env.clientId,\n    }));\n    outputJson({ data });\n    return;\n  }\n\n  // Human-mode table\n  const hasUnclaimed = entries.some(([, env]) => isUnclaimedEnvironment(env));\n  const nameW =\n    Math.max(6, ...entries.map(([k, env]) => k.length + (isUnclaimedEnvironment(env) ? ' (unclaimed)'.length : 0))) + 2;\n  const typeW = 12;\n\n  const header = [\n    chalk.yellow('  '),\n    chalk.yellow('Name'.padEnd(nameW)),\n    chalk.yellow('Type'.padEnd(typeW)),\n    chalk.yellow('Endpoint'),\n  ].join('  ');\n\n  const separator = chalk.dim('─'.repeat(header.length));\n\n  console.log(header);\n  console.log(separator);\n\n  for (const [key, env] of entries) {\n    const isActive = key === config.activeEnvironment;\n    const marker = isActive ? chalk.green('▸ ') : '  ';\n    const unclaimed = isUnclaimedEnvironment(env);\n    const displayName = unclaimed ? `${key} ${chalk.yellow('(unclaimed)')}` : key;\n    const name = isActive ? chalk.green(displayName.padEnd(nameW)) : displayName.padEnd(nameW);\n    const type = unclaimed ? 'Unclaimed' : env.type === 'sandbox' ? 'Sandbox' : 'Production';\n    const endpoint = env.endpoint || chalk.dim('default');\n\n    console.log([marker, name, type.padEnd(typeW), endpoint].join('  '));\n  }\n\n  if (hasUnclaimed) {\n    console.log('');\n    console.log(chalk.dim(`  Run \\`${formatWorkOSCommand('env claim')}\\` to keep this environment.`));\n  }\n}\n"]}

package/dist/commands/install.js

@@ -1,16 +1,16 @@
 import { runInstaller } from '../run.js';
-import clack from '../utils/clack.js';
+import ui from '../utils/ui.js';
 import { exitWithError, isJsonMode } from '../utils/output.js';
 import { ExitCode, exitWithCode } from '../utils/exit-codes.js';
-import { autoInstallSkills } from './install-skill.js';
-import { maybeOfferMcpInstall } from '../lib/mcp-notice.js';
+import { isCiMode } from '../utils/interaction-mode.js';
+import { maybeRunSetupAfter } from './setup.js';
 /**
  * Handle install command execution.
  */
 export async function handleInstall(argv) {
     const options = { ...argv };
-    // CI mode validation
-    if (options.ci) {
+    // CI mode validation — trigger for the hidden --ci flag or WORKOS_MODE=ci.
+    if (options.ci || isCiMode()) {
         if (!options.apiKey) {
             exitWithError({ code: 'missing_args', message: 'CI mode requires --api-key (WorkOS API key sk_xxx)' });
         }
@@ -26,14 +26,9 @@ export async function handleInstall(argv) {
     }
     try {
         await runInstaller(options);
-        const skillResult = await autoInstallSkills();
-        if (skillResult && !isJsonMode()) {
-            const skillWord = skillResult.skills.length === 1 ? 'skill' : 'skills';
-            clack.log.info(`Installed ${skillResult.skills.length} WorkOS ${skillWord} for ${skillResult.agents.join(', ')}. Your coding agent now has up-to-date WorkOS guidance.`);
-        }
-        // Offer to connect the user's coding agent to WorkOS via MCP. Self-gating
+        // One consented moment offers skills + MCP together. Self-gating
         // (human/TTY-only, decline-respecting) and best-effort — never fails install.
-        await maybeOfferMcpInstall({ entryPoint: 'install-flow' });
+        await maybeRunSetupAfter('install');
     }
     catch (err) {
         const { getLogFilePath } = await import('../utils/debug.js');
@@ -48,7 +43,7 @@ export async function handleInstall(argv) {
             console.error(err.stack);
         }
         if (logPath) {
-            clack.log.info(`Debug logs: ${logPath}`);
+            ui.log.info(`Debug logs: ${logPath}`);
         }
         exitWithCode(ExitCode.GENERAL_ERROR);
     }

package/dist/commands/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuC;IACzE,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAE5B,qBAAqB;IACrB,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,aAAa,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yEAAyE;aACnF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC9C,IAAI,WAAW,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvE,KAAK,CAAC,GAAG,CAAC,IAAI,CACZ,aAAa,WAAW,CAAC,MAAM,CAAC,MAAM,WAAW,SAAS,QAAQ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,CACzJ,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QAEjC,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,aAAa,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import { runInstaller } from '../run.js';\nimport type { InstallerArgs } from '../run.js';\nimport clack from '../utils/clack.js';\nimport { exitWithError, isJsonMode } from '../utils/output.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\nimport type { ArgumentsCamelCase } from 'yargs';\nimport { autoInstallSkills } from './install-skill.js';\nimport { maybeOfferMcpInstall } from '../lib/mcp-notice.js';\n\n/**\n * Handle install command execution.\n */\nexport async function handleInstall(argv: ArgumentsCamelCase<InstallerArgs>): Promise<void> {\n  const options = { ...argv };\n\n  // CI mode validation\n  if (options.ci) {\n    if (!options.apiKey) {\n      exitWithError({ code: 'missing_args', message: 'CI mode requires --api-key (WorkOS API key sk_xxx)' });\n    }\n    if (!options.clientId) {\n      exitWithError({ code: 'missing_args', message: 'CI mode requires --client-id (WorkOS Client ID client_xxx)' });\n    }\n    if (!options.installDir) {\n      exitWithError({\n        code: 'missing_args',\n        message: 'CI mode requires --install-dir (directory to install WorkOS AuthKit in)',\n      });\n    }\n  }\n\n  try {\n    await runInstaller(options);\n    const skillResult = await autoInstallSkills();\n    if (skillResult && !isJsonMode()) {\n      const skillWord = skillResult.skills.length === 1 ? 'skill' : 'skills';\n      clack.log.info(\n        `Installed ${skillResult.skills.length} WorkOS ${skillWord} for ${skillResult.agents.join(', ')}. Your coding agent now has up-to-date WorkOS guidance.`,\n      );\n    }\n\n    // Offer to connect the user's coding agent to WorkOS via MCP. Self-gating\n    // (human/TTY-only, decline-respecting) and best-effort — never fails install.\n    await maybeOfferMcpInstall({ entryPoint: 'install-flow' });\n  } catch (err) {\n    const { getLogFilePath } = await import('../utils/debug.js');\n    const logPath = getLogFilePath();\n\n    if (isJsonMode()) {\n      exitWithError({\n        code: 'installer_error',\n        message: err instanceof Error ? err.message : 'Unknown error',\n      });\n    }\n\n    if (options.debug && err instanceof Error && err.stack) {\n      console.error(err.stack);\n    }\n    if (logPath) {\n      clack.log.info(`Debug logs: ${logPath}`);\n    }\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n"]}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuC;IACzE,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAE5B,2EAA2E;IAC3E,IAAI,OAAO,CAAC,EAAE,IAAI,QAAQ,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,aAAa,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yEAAyE;aACnF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAE5B,iEAAiE;QACjE,8EAA8E;QAC9E,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QAEjC,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,aAAa,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import { runInstaller } from '../run.js';\nimport type { InstallerArgs } from '../run.js';\nimport ui from '../utils/ui.js';\nimport { exitWithError, isJsonMode } from '../utils/output.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\nimport { isCiMode } from '../utils/interaction-mode.js';\nimport type { ArgumentsCamelCase } from 'yargs';\nimport { maybeRunSetupAfter } from './setup.js';\n\n/**\n * Handle install command execution.\n */\nexport async function handleInstall(argv: ArgumentsCamelCase<InstallerArgs>): Promise<void> {\n  const options = { ...argv };\n\n  // CI mode validation — trigger for the hidden --ci flag or WORKOS_MODE=ci.\n  if (options.ci || isCiMode()) {\n    if (!options.apiKey) {\n      exitWithError({ code: 'missing_args', message: 'CI mode requires --api-key (WorkOS API key sk_xxx)' });\n    }\n    if (!options.clientId) {\n      exitWithError({ code: 'missing_args', message: 'CI mode requires --client-id (WorkOS Client ID client_xxx)' });\n    }\n    if (!options.installDir) {\n      exitWithError({\n        code: 'missing_args',\n        message: 'CI mode requires --install-dir (directory to install WorkOS AuthKit in)',\n      });\n    }\n  }\n\n  try {\n    await runInstaller(options);\n\n    // One consented moment offers skills + MCP together. Self-gating\n    // (human/TTY-only, decline-respecting) and best-effort — never fails install.\n    await maybeRunSetupAfter('install');\n  } catch (err) {\n    const { getLogFilePath } = await import('../utils/debug.js');\n    const logPath = getLogFilePath();\n\n    if (isJsonMode()) {\n      exitWithError({\n        code: 'installer_error',\n        message: err instanceof Error ? err.message : 'Unknown error',\n      });\n    }\n\n    if (options.debug && err instanceof Error && err.stack) {\n      console.error(err.stack);\n    }\n    if (logPath) {\n      ui.log.info(`Debug logs: ${logPath}`);\n    }\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n"]}

package/dist/commands/login.d.ts

@@ -1,22 +1,32 @@
 /**
- * Best-effort skill install after a successful auth-login.
- *
- * Mirrors the install.ts hook copy, but wraps `autoInstallSkills` in its own
- * try/catch AND a 30s timeout so a skill install hang (e.g. blocked filesystem
- * call) never blocks login completion. Login already succeeded by the time
- * this runs — the user having a working session is the contract that must hold.
- *
- * Extracted from runLogin so it can be unit-tested without standing up the
- * device-auth polling loop.
+ * Result of a post-login staging provision. Carries enough context for
+ * `runLogin` to detect a cross-account switch and decide how to surface it
+ * without ever silently repointing the active environment.
  */
-export declare const SKILL_INSTALL_TIMEOUT_MS: number;
-export declare function installSkillsAfterLogin(): Promise<void>;
+export interface StagingProvisionResult {
+    provisioned: boolean;
+    /** Active env name AFTER provisioning (unchanged unless there was no prior active env). */
+    activeEnvironment?: string;
+    /** Key the new Staging env was written under ('staging' or a fresh 'staging-N'). */
+    envName?: string;
+    mismatch: boolean;
+    priorEnvName?: string;
+    priorAccount?: {
+        email?: string;
+        clientId?: string;
+    };
+}
 /**
  * Auto-provision a staging environment after login.
  *
- * Fetches staging credentials using the access token, then saves them
- * as a "staging" environment in the config store. Non-fatal — logs a
- * hint on failure instead of throwing.
+ * Fetches staging credentials for the just-authenticated account and stores
+ * them. On a detected cross-account mismatch, the new account's Staging is
+ * written under a DISTINCT key rather than clobbering the active slot, and the
+ * active pointer is left alone — only a login onto an empty config auto-assigns
+ * the active env. Non-fatal — logs a hint on failure instead of throwing.
  */
-export declare function provisionStagingEnvironment(accessToken: string): Promise<boolean>;
+export declare function provisionStagingEnvironment(accessToken: string, account: {
+    email?: string;
+    userId: string;
+}): Promise<StagingProvisionResult>;
 export declare function runLogin(): Promise<void>;