workos 0.18.0 → 0.20.1

package/dist/lib/config-store.js

@@ -1,269 +0,0 @@
-/**
- * CLI config storage abstraction with keyring support and file fallback.
- *
- * Stores environment configurations (names, API keys, endpoints) separately
- * from OAuth credentials. Uses a second keyring entry under the same service.
- *
- * Storage priority:
- * 1. If insecure storage forced: use file only
- * 2. Try keyring, fall back to file with warning if unavailable
- */
-import { Entry } from '@napi-rs/keyring';
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import { logWarn } from '../utils/debug.js';
-import { observeHostFailure } from './host-probe.js';
-/**
- * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.
- */
-export function isUnclaimedEnvironment(env) {
-    return env.type === 'unclaimed';
-}
-const SERVICE_NAME = 'workos-cli';
-const ACCOUNT_NAME = 'config';
-let fallbackWarningShown = false;
-let forceInsecureStorage = false;
-let migrationAttempted = false;
-export function setInsecureConfigStorage(value) {
-    forceInsecureStorage = value;
-    migrationAttempted = false;
-}
-function getConfigDir() {
-    return path.join(os.homedir(), '.workos');
-}
-function getConfigFilePath() {
-    return path.join(getConfigDir(), 'config.json');
-}
-function fileExists() {
-    return fs.existsSync(getConfigFilePath());
-}
-function readFromFile() {
-    if (!fileExists())
-        return null;
-    const filePath = getConfigFilePath();
-    try {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        return JSON.parse(content);
-    }
-    catch (error) {
-        observeHostFailure('home-fs', error, {
-            operation: 'read',
-            target: filePath,
-            label: 'config fallback file',
-        });
-        logWarn('Failed to read config file:', error);
-        return null;
-    }
-}
-function writeToFile(config) {
-    const dir = getConfigDir();
-    const filePath = getConfigFilePath();
-    try {
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        }
-        fs.writeFileSync(filePath, JSON.stringify(config, null, 2), {
-            mode: 0o600,
-        });
-    }
-    catch (error) {
-        observeHostFailure('home-fs', error, {
-            operation: 'write',
-            target: filePath,
-            label: 'config fallback file',
-        });
-        throw error;
-    }
-}
-function deleteFile() {
-    const filePath = getConfigFilePath();
-    if (fileExists()) {
-        try {
-            fs.unlinkSync(filePath);
-        }
-        catch (error) {
-            observeHostFailure('home-fs', error, {
-                operation: 'delete',
-                target: filePath,
-                label: 'config fallback file',
-            });
-            throw error;
-        }
-    }
-}
-function getKeyringEntry() {
-    return new Entry(SERVICE_NAME, ACCOUNT_NAME);
-}
-function readFromKeyring() {
-    try {
-        const entry = getKeyringEntry();
-        const data = entry.getPassword();
-        if (!data)
-            return null;
-        return JSON.parse(data);
-    }
-    catch (error) {
-        logWarn('Failed to read config from keyring:', error);
-        observeHostFailure('keychain', error, {
-            operation: 'read',
-            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-            label: 'config keychain entry',
-        });
-        return null;
-    }
-}
-function writeToKeyring(config) {
-    try {
-        const entry = getKeyringEntry();
-        entry.setPassword(JSON.stringify(config));
-        return true;
-    }
-    catch (error) {
-        logWarn('Failed to write config to keyring:', error);
-        observeHostFailure('keychain', error, {
-            operation: 'write',
-            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-            label: 'config keychain entry',
-        });
-        return false;
-    }
-}
-function deleteFromKeyring() {
-    try {
-        const entry = getKeyringEntry();
-        entry.deletePassword();
-    }
-    catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        if (!msg.includes('not found') && !msg.includes('No such')) {
-            logWarn('Failed to delete config from keyring:', error);
-            observeHostFailure('keychain', error, {
-                operation: 'delete',
-                target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-                label: 'config keychain entry',
-            });
-        }
-    }
-}
-function showFallbackWarning() {
-    if (fallbackWarningShown || forceInsecureStorage)
-        return;
-    fallbackWarningShown = true;
-    logWarn('Unable to store config in system keyring. Using file storage.', 'Config saved to ~/.workos/config.json', 'Use --insecure-storage to suppress this warning.');
-}
-export function getConfig() {
-    if (forceInsecureStorage)
-        return readFromFile();
-    const keyringConfig = readFromKeyring();
-    if (keyringConfig)
-        return keyringConfig;
-    const fileConfig = readFromFile();
-    if (fileConfig) {
-        if (!migrationAttempted) {
-            migrationAttempted = true;
-            writeToKeyring(fileConfig);
-        }
-        return fileConfig;
-    }
-    return null;
-}
-export function saveConfig(config) {
-    if (forceInsecureStorage)
-        return writeToFile(config);
-    if (!writeToKeyring(config)) {
-        showFallbackWarning();
-        writeToFile(config);
-        return;
-    }
-    // Verify the keyring write is readable (guards against silent keyring failures
-    // where setPassword succeeds but getPassword returns null in the same process)
-    if (!readFromKeyring()) {
-        logWarn('Keyring write succeeded but read-back failed — falling back to file');
-        writeToFile(config);
-    }
-}
-export function clearConfig() {
-    deleteFromKeyring();
-    deleteFile();
-    migrationAttempted = false;
-}
-export function getActiveEnvironment() {
-    const config = getConfig();
-    if (!config?.activeEnvironment)
-        return null;
-    return config.environments[config.activeEnvironment] ?? null;
-}
-export function getConfigPath() {
-    return getConfigFilePath();
-}
-/**
- * Diagnostic info about config storage state — for debugging config persistence failures.
- */
-export function diagnoseConfig() {
-    const lines = [];
-    const filePath = getConfigFilePath();
-    const filePresent = fileExists();
-    lines.push(`file: ${filePath} (exists=${filePresent})`);
-    if (filePresent) {
-        try {
-            const content = fs.readFileSync(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;
-            lines.push(`file config: active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);
-        }
-        catch (e) {
-            lines.push(`file config: parse error — ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }
-    try {
-        const entry = getKeyringEntry();
-        const data = entry.getPassword();
-        if (data) {
-            const parsed = JSON.parse(data);
-            const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;
-            lines.push(`keyring: found, active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);
-        }
-        else {
-            lines.push('keyring: empty (getPassword returned null)');
-        }
-    }
-    catch (e) {
-        lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);
-    }
-    lines.push(`insecureStorage=${forceInsecureStorage}`);
-    return lines;
-}
-/**
- * Mark the active unclaimed environment as claimed.
- * Updates type to 'sandbox', removes the claim token, and renames
- * the environment key from 'unclaimed' to 'sandbox'.
- */
-export function markEnvironmentClaimed() {
-    const config = getConfig();
-    if (!config?.activeEnvironment)
-        return;
-    const oldKey = config.activeEnvironment;
-    const env = config.environments[oldKey];
-    if (env && env.type === 'unclaimed') {
-        // Pick a key that won't overwrite an existing environment
-        let newKey = 'sandbox';
-        if (oldKey !== newKey && config.environments[newKey]) {
-            newKey = oldKey; // keep existing key if 'sandbox' is already taken
-        }
-        const claimed = {
-            name: newKey,
-            type: 'sandbox',
-            apiKey: env.apiKey,
-            clientId: env.clientId,
-            ...(env.endpoint && { endpoint: env.endpoint }),
-        };
-        if (oldKey !== newKey) {
-            delete config.environments[oldKey];
-        }
-        config.environments[newKey] = claimed;
-        config.activeEnvironment = newKey;
-        saveConfig(config);
-    }
-}
-//# sourceMappingURL=config-store.js.map

package/dist/lib/config-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/lib/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAqBrD;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,OAAO,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;AAClC,CAAC;AAOD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC1D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;gBACnC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,sBAAsB;aAC9B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACtD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACrD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;YACxD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;gBACpC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;gBACzC,KAAK,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,+DAA+D,EAC/D,uCAAuC,EACvC,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,aAAa,GAAG,eAAe,EAAE,CAAC;IACxC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAiB;IAC1C,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,qEAAqE,CAAC,CAAC;QAC/E,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,iBAAiB,IAAI,MAAM,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAAE,OAAO;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpC,0DAA0D;QAC1D,IAAI,MAAM,GAAG,SAAS,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,MAAM,CAAC,CAAC,kDAAkD;QACrE,CAAC;QAED,MAAM,OAAO,GAA6B;YACxC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;SAChD,CAAC;QAEF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAElC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["/**\n * CLI config storage abstraction with keyring support and file fallback.\n *\n * Stores environment configurations (names, API keys, endpoints) separately\n * from OAuth credentials. Uses a second keyring entry under the same service.\n *\n * Storage priority:\n * 1. If insecure storage forced: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\nimport { observeHostFailure } from './host-probe.js';\n\ninterface BaseEnvironmentConfig {\n  name: string;\n  apiKey: string;\n  endpoint?: string;\n}\n\nexport interface ClaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'production' | 'sandbox';\n  clientId?: string;\n}\n\nexport interface UnclaimedEnvironmentConfig extends BaseEnvironmentConfig {\n  type: 'unclaimed';\n  clientId: string;\n  claimToken: string;\n}\n\nexport type EnvironmentConfig = ClaimedEnvironmentConfig | UnclaimedEnvironmentConfig;\n\n/**\n * Type guard — narrows to UnclaimedEnvironmentConfig with required clientId and claimToken.\n */\nexport function isUnclaimedEnvironment(env: EnvironmentConfig): env is UnclaimedEnvironmentConfig {\n  return env.type === 'unclaimed';\n}\n\nexport interface CliConfig {\n  activeEnvironment?: string;\n  environments: Record<string, EnvironmentConfig>;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'config';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureConfigStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getConfigDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getConfigFilePath(): string {\n  return path.join(getConfigDir(), 'config.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getConfigFilePath());\n}\n\nfunction readFromFile(): CliConfig | null {\n  if (!fileExists()) return null;\n  const filePath = getConfigFilePath();\n  try {\n    const content = fs.readFileSync(filePath, 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'read',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    logWarn('Failed to read config file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(config: CliConfig): void {\n  const dir = getConfigDir();\n  const filePath = getConfigFilePath();\n  try {\n    if (!fs.existsSync(dir)) {\n      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    fs.writeFileSync(filePath, JSON.stringify(config, null, 2), {\n      mode: 0o600,\n    });\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'write',\n      target: filePath,\n      label: 'config fallback file',\n    });\n    throw error;\n  }\n}\n\nfunction deleteFile(): void {\n  const filePath = getConfigFilePath();\n  if (fileExists()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch (error) {\n      observeHostFailure('home-fs', error, {\n        operation: 'delete',\n        target: filePath,\n        label: 'config fallback file',\n      });\n      throw error;\n    }\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): CliConfig | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) return null;\n    return JSON.parse(data);\n  } catch (error) {\n    logWarn('Failed to read config from keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'read',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return null;\n  }\n}\n\nfunction writeToKeyring(config: CliConfig): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(config));\n    return true;\n  } catch (error) {\n    logWarn('Failed to write config to keyring:', error);\n    observeHostFailure('keychain', error, {\n      operation: 'write',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'config keychain entry',\n    });\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete config from keyring:', error);\n      observeHostFailure('keychain', error, {\n        operation: 'delete',\n        target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n        label: 'config keychain entry',\n      });\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store config in system keyring. Using file storage.',\n    'Config saved to ~/.workos/config.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function getConfig(): CliConfig | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringConfig = readFromKeyring();\n  if (keyringConfig) return keyringConfig;\n\n  const fileConfig = readFromFile();\n  if (fileConfig) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileConfig);\n    }\n    return fileConfig;\n  }\n\n  return null;\n}\n\nexport function saveConfig(config: CliConfig): void {\n  if (forceInsecureStorage) return writeToFile(config);\n\n  if (!writeToKeyring(config)) {\n    showFallbackWarning();\n    writeToFile(config);\n    return;\n  }\n\n  // Verify the keyring write is readable (guards against silent keyring failures\n  // where setPassword succeeds but getPassword returns null in the same process)\n  if (!readFromKeyring()) {\n    logWarn('Keyring write succeeded but read-back failed — falling back to file');\n    writeToFile(config);\n  }\n}\n\nexport function clearConfig(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function getActiveEnvironment(): EnvironmentConfig | null {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return null;\n  return config.environments[config.activeEnvironment] ?? null;\n}\n\nexport function getConfigPath(): string {\n  return getConfigFilePath();\n}\n\n/**\n * Diagnostic info about config storage state — for debugging config persistence failures.\n */\nexport function diagnoseConfig(): string[] {\n  const lines: string[] = [];\n  const filePath = getConfigFilePath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`file config: active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } catch (e) {\n      lines.push(`file config: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<CliConfig>;\n      const envCount = parsed.environments ? Object.keys(parsed.environments).length : 0;\n      lines.push(`keyring: found, active=${parsed.activeEnvironment ?? 'none'}, environments=${envCount}`);\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\n/**\n * Mark the active unclaimed environment as claimed.\n * Updates type to 'sandbox', removes the claim token, and renames\n * the environment key from 'unclaimed' to 'sandbox'.\n */\nexport function markEnvironmentClaimed(): void {\n  const config = getConfig();\n  if (!config?.activeEnvironment) return;\n  const oldKey = config.activeEnvironment;\n  const env = config.environments[oldKey];\n  if (env && env.type === 'unclaimed') {\n    // Pick a key that won't overwrite an existing environment\n    let newKey = 'sandbox';\n    if (oldKey !== newKey && config.environments[newKey]) {\n      newKey = oldKey; // keep existing key if 'sandbox' is already taken\n    }\n\n    const claimed: ClaimedEnvironmentConfig = {\n      name: newKey,\n      type: 'sandbox',\n      apiKey: env.apiKey,\n      clientId: env.clientId,\n      ...(env.endpoint && { endpoint: env.endpoint }),\n    };\n\n    if (oldKey !== newKey) {\n      delete config.environments[oldKey];\n    }\n    config.environments[newKey] = claimed;\n    config.activeEnvironment = newKey;\n\n    saveConfig(config);\n  }\n}\n"]}

package/dist/lib/config.d.ts

@@ -1,34 +0,0 @@
-/**
- * Integration detection configuration.
- *
- * This module previously held hardcoded INTEGRATION_CONFIG and INTEGRATION_ORDER.
- * These are now provided by the auto-discovery registry (src/lib/registry.ts).
- *
- * This file is kept for backwards compatibility — functions that previously
- * used INTEGRATION_CONFIG now delegate to the registry.
- */
-import type { InstallerOptions } from '../utils/types.js';
-/**
- * @deprecated Use registry.detectionOrder() + config.detection.detect() instead.
- * This type is kept for any code that still references it.
- */
-export type IntegrationConfig = {
-    name: string;
-    filterPatterns: string[];
-    ignorePatterns: string[];
-    detect: (options: Pick<InstallerOptions, 'installDir'>) => Promise<boolean>;
-    generateFilesRules: string;
-    filterFilesRules: string;
-    docsUrl: string;
-    nextSteps: string;
-    defaultChanges: string;
-};
-/**
- * Legacy detection configs for existing JS integrations.
- * Used by clack-utils.ts for abort/cancel messages.
- * New integrations do NOT need to be added here.
- */
-export declare const INTEGRATION_CONFIG: Record<string, {
-    docsUrl: string;
-    name: string;
-}>;

package/dist/lib/config.js

@@ -1,37 +0,0 @@
-/**
- * Integration detection configuration.
- *
- * This module previously held hardcoded INTEGRATION_CONFIG and INTEGRATION_ORDER.
- * These are now provided by the auto-discovery registry (src/lib/registry.ts).
- *
- * This file is kept for backwards compatibility — functions that previously
- * used INTEGRATION_CONFIG now delegate to the registry.
- */
-/**
- * Legacy detection configs for existing JS integrations.
- * Used by clack-utils.ts for abort/cancel messages.
- * New integrations do NOT need to be added here.
- */
-export const INTEGRATION_CONFIG = {
-    nextjs: {
-        name: 'Next.js',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/nextjs',
-    },
-    react: {
-        name: 'React (SPA)',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/react',
-    },
-    'tanstack-start': {
-        name: 'TanStack Start',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/tanstack-start',
-    },
-    'react-router': {
-        name: 'React Router',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/react-router',
-    },
-    'vanilla-js': {
-        name: 'Vanilla JavaScript',
-        docsUrl: 'https://workos.com/docs/user-management/authkit/javascript',
-    },
-};
-//# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoBH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsD;IACnF,MAAM,EAAE;QACN,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,wDAAwD;KAClE;IACD,KAAK,EAAE;QACL,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,uDAAuD;KACjE;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD,cAAc,EAAE;QACd,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8DAA8D;KACxE;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;CACF,CAAC","sourcesContent":["/**\n * Integration detection configuration.\n *\n * This module previously held hardcoded INTEGRATION_CONFIG and INTEGRATION_ORDER.\n * These are now provided by the auto-discovery registry (src/lib/registry.ts).\n *\n * This file is kept for backwards compatibility — functions that previously\n * used INTEGRATION_CONFIG now delegate to the registry.\n */\n\nimport type { InstallerOptions } from '../utils/types.js';\n\n/**\n * @deprecated Use registry.detectionOrder() + config.detection.detect() instead.\n * This type is kept for any code that still references it.\n */\nexport type IntegrationConfig = {\n  name: string;\n  filterPatterns: string[];\n  ignorePatterns: string[];\n  detect: (options: Pick<InstallerOptions, 'installDir'>) => Promise<boolean>;\n  generateFilesRules: string;\n  filterFilesRules: string;\n  docsUrl: string;\n  nextSteps: string;\n  defaultChanges: string;\n};\n\n/**\n * Legacy detection configs for existing JS integrations.\n * Used by clack-utils.ts for abort/cancel messages.\n * New integrations do NOT need to be added here.\n */\nexport const INTEGRATION_CONFIG: Record<string, { docsUrl: string; name: string }> = {\n  nextjs: {\n    name: 'Next.js',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/nextjs',\n  },\n  react: {\n    name: 'React (SPA)',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/react',\n  },\n  'tanstack-start': {\n    name: 'TanStack Start',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/tanstack-start',\n  },\n  'react-router': {\n    name: 'React Router',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/react-router',\n  },\n  'vanilla-js': {\n    name: 'Vanilla JavaScript',\n    docsUrl: 'https://workos.com/docs/user-management/authkit/javascript',\n  },\n};\n"]}

package/dist/lib/constants.d.ts

@@ -1,43 +0,0 @@
-/**
- * Integration identifier type.
- * No longer an enum — each integration self-registers via the auto-discovery registry.
- * The string value matches the integration directory name (e.g., 'nextjs', 'react-router').
- */
-export type Integration = string;
-/**
- * Well-known integration names for backwards compatibility.
- * New integrations do NOT need to be added here — they're auto-discovered.
- */
-export declare const KNOWN_INTEGRATIONS: {
-    readonly nextjs: "nextjs";
-    readonly react: "react";
-    readonly tanstackStart: "tanstack-start";
-    readonly reactRouter: "react-router";
-    readonly vanillaJs: "vanilla-js";
-};
-export interface Args {
-    debug: boolean;
-    integration: Integration;
-}
-export declare const IS_DEV: boolean;
-export declare const DEBUG: boolean;
-export declare const WORKOS_DOCS_URL: string;
-export declare const WORKOS_DASHBOARD_URL: string;
-export declare const ISSUES_URL: string;
-export declare const ANALYTICS_ENABLED: boolean;
-export declare const INSTALLER_INTERACTION_EVENT_NAME: string;
-export declare const OAUTH_PORT: number;
-/**
- * WorkOS MCP server identity, shared by the `mcp` command group and the
- * per-client writers in `lib/mcp-clients.ts`.
- *
- * The server is secret-free: HTTP transport with OAuth handled by each client
- * on first connect, so configuring it never requires CLI auth.
- */
-export declare const MCP_SERVER_NAME = "workos";
-export declare const MCP_SERVER_URL = "https://mcp.workos.com/mcp";
-/**
- * Common glob patterns to ignore when searching for files.
- * Used by multiple integrations.
- */
-export declare const IGNORE_PATTERNS: string[];

package/dist/lib/constants.js

@@ -1,42 +0,0 @@
-import { getConfig } from './settings.js';
-/**
- * Well-known integration names for backwards compatibility.
- * New integrations do NOT need to be added here — they're auto-discovered.
- */
-export const KNOWN_INTEGRATIONS = {
-    nextjs: 'nextjs',
-    react: 'react',
-    tanstackStart: 'tanstack-start',
-    reactRouter: 'react-router',
-    vanillaJs: 'vanilla-js',
-};
-export const IS_DEV = ['test', 'development'].includes(process.env.NODE_ENV ?? '');
-const settings = getConfig();
-export const DEBUG = settings.logging.debugMode;
-export const WORKOS_DOCS_URL = settings.documentation.workosDocsUrl;
-export const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;
-export const ISSUES_URL = settings.documentation.issuesUrl;
-export const ANALYTICS_ENABLED = settings.telemetry.enabled;
-export const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;
-export const OAUTH_PORT = settings.legacy.oauthPort;
-/**
- * WorkOS MCP server identity, shared by the `mcp` command group and the
- * per-client writers in `lib/mcp-clients.ts`.
- *
- * The server is secret-free: HTTP transport with OAuth handled by each client
- * on first connect, so configuring it never requires CLI auth.
- */
-export const MCP_SERVER_NAME = 'workos';
-export const MCP_SERVER_URL = 'https://mcp.workos.com/mcp';
-/**
- * Common glob patterns to ignore when searching for files.
- * Used by multiple integrations.
- */
-export const IGNORE_PATTERNS = [
-    '**/node_modules/**',
-    '**/dist/**',
-    '**/build/**',
-    '**/public/**',
-    '**/.next/**',
-];
-//# sourceMappingURL=constants.js.map

package/dist/lib/constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAS1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;CACf,CAAC;AAOX,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,aAAa,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;AAC5D,MAAM,CAAC,MAAM,gCAAgC,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,cAAc;IACd,aAAa;CACd,CAAC","sourcesContent":["import { getConfig } from './settings.js';\n\n/**\n * Integration identifier type.\n * No longer an enum — each integration self-registers via the auto-discovery registry.\n * The string value matches the integration directory name (e.g., 'nextjs', 'react-router').\n */\nexport type Integration = string;\n\n/**\n * Well-known integration names for backwards compatibility.\n * New integrations do NOT need to be added here — they're auto-discovered.\n */\nexport const KNOWN_INTEGRATIONS = {\n  nextjs: 'nextjs',\n  react: 'react',\n  tanstackStart: 'tanstack-start',\n  reactRouter: 'react-router',\n  vanillaJs: 'vanilla-js',\n} as const;\n\nexport interface Args {\n  debug: boolean;\n  integration: Integration;\n}\n\nexport const IS_DEV = ['test', 'development'].includes(process.env.NODE_ENV ?? '');\n\nconst settings = getConfig();\n\nexport const DEBUG = settings.logging.debugMode;\nexport const WORKOS_DOCS_URL = settings.documentation.workosDocsUrl;\nexport const WORKOS_DASHBOARD_URL = settings.documentation.dashboardUrl;\nexport const ISSUES_URL = settings.documentation.issuesUrl;\nexport const ANALYTICS_ENABLED = settings.telemetry.enabled;\nexport const INSTALLER_INTERACTION_EVENT_NAME = settings.telemetry.eventName;\nexport const OAUTH_PORT = settings.legacy.oauthPort;\n\n/**\n * WorkOS MCP server identity, shared by the `mcp` command group and the\n * per-client writers in `lib/mcp-clients.ts`.\n *\n * The server is secret-free: HTTP transport with OAuth handled by each client\n * on first connect, so configuring it never requires CLI auth.\n */\nexport const MCP_SERVER_NAME = 'workos';\nexport const MCP_SERVER_URL = 'https://mcp.workos.com/mcp';\n\n/**\n * Common glob patterns to ignore when searching for files.\n * Used by multiple integrations.\n */\nexport const IGNORE_PATTERNS: string[] = [\n  '**/node_modules/**',\n  '**/dist/**',\n  '**/build/**',\n  '**/public/**',\n  '**/.next/**',\n];\n"]}

package/dist/lib/credential-discovery.d.ts

@@ -1,42 +0,0 @@
-export interface DiscoveryResult {
-    found: boolean;
-    source?: 'env' | 'declined';
-    clientId?: string;
-    apiKey?: string;
-    sourcePath?: string;
-}
-export interface EnvFileInfo {
-    exists: boolean;
-    files: string[];
-}
-/**
- * Check if env files exist in the project directory (without reading contents).
- * Returns which files were found so the UI can prompt for consent.
- */
-export declare function checkForEnvFiles(projectDir: string): Promise<EnvFileInfo>;
-/**
- * Scan a single env file for WorkOS credentials.
- * Only extracts WORKOS_CLIENT_ID and WORKOS_API_KEY - ignores all other variables.
- */
-export declare function scanEnvFile(filePath: string): Promise<{
-    clientId?: string;
-    apiKey?: string;
-}>;
-/**
- * Validate client ID format.
- * WorkOS client IDs start with 'client_' prefix.
- */
-export declare function isValidClientId(value: string): boolean;
-/**
- * Validate API key format.
- * WorkOS secret keys start with 'sk_' prefix.
- */
-export declare function isValidApiKey(value: string): boolean;
-/**
- * Discover WorkOS credentials from project env files.
- * Must be called AFTER user consent is given.
- *
- * Scans files in priority order: .env.local > .env.development.local > .env.development > .env
- * Returns first complete match (both clientId and apiKey preferred, but clientId-only is valid).
- */
-export declare function discoverCredentials(projectDir: string): Promise<DiscoveryResult>;

package/dist/lib/credential-discovery.js

@@ -1,100 +0,0 @@
-import { promises as fs } from 'node:fs';
-import path from 'node:path';
-import { logInfo } from '../utils/debug.js';
-const ENV_FILE_NAMES = ['.env.local', '.env.development.local', '.env.development', '.env'];
-// Only extract WorkOS variables - ignore everything else
-const WORKOS_CLIENT_ID_PATTERN = /^WORKOS_CLIENT_ID=["']?([^"'\s#]+)["']?/m;
-const WORKOS_API_KEY_PATTERN = /^WORKOS_API_KEY=["']?([^"'\s#]+)["']?/m;
-/**
- * Check if env files exist in the project directory (without reading contents).
- * Returns which files were found so the UI can prompt for consent.
- */
-export async function checkForEnvFiles(projectDir) {
-    logInfo('[credential-discovery] Checking for env files in:', projectDir);
-    const foundFiles = [];
-    for (const fileName of ENV_FILE_NAMES) {
-        const filePath = path.join(projectDir, fileName);
-        try {
-            await fs.access(filePath, fs.constants.R_OK);
-            foundFiles.push(fileName);
-        }
-        catch {
-            // continue
-        }
-    }
-    logInfo('[credential-discovery] Found env files:', foundFiles);
-    return {
-        exists: foundFiles.length > 0,
-        files: foundFiles,
-    };
-}
-/**
- * Scan a single env file for WorkOS credentials.
- * Only extracts WORKOS_CLIENT_ID and WORKOS_API_KEY - ignores all other variables.
- */
-export async function scanEnvFile(filePath) {
-    const content = await fs.readFile(filePath, 'utf-8');
-    // Filter out commented lines before matching
-    const lines = content.split(/\r?\n/);
-    const uncommentedContent = lines.filter((line) => !line.trim().startsWith('#')).join('\n');
-    const clientIdMatch = uncommentedContent.match(WORKOS_CLIENT_ID_PATTERN);
-    const apiKeyMatch = uncommentedContent.match(WORKOS_API_KEY_PATTERN);
-    return {
-        clientId: clientIdMatch?.[1],
-        apiKey: apiKeyMatch?.[1],
-    };
-}
-/**
- * Validate client ID format.
- * WorkOS client IDs start with 'client_' prefix.
- */
-export function isValidClientId(value) {
-    return value.startsWith('client_') && value.length > 10;
-}
-/**
- * Validate API key format.
- * WorkOS secret keys start with 'sk_' prefix.
- */
-export function isValidApiKey(value) {
-    return value.startsWith('sk_') && value.length > 10;
-}
-/**
- * Discover WorkOS credentials from project env files.
- * Must be called AFTER user consent is given.
- *
- * Scans files in priority order: .env.local > .env.development.local > .env.development > .env
- * Returns first complete match (both clientId and apiKey preferred, but clientId-only is valid).
- */
-export async function discoverCredentials(projectDir) {
-    logInfo('[credential-discovery] Scanning env files for WorkOS credentials');
-    for (const fileName of ENV_FILE_NAMES) {
-        const filePath = path.join(projectDir, fileName);
-        try {
-            const result = await scanEnvFile(filePath);
-            const clientIdValid = result.clientId && isValidClientId(result.clientId);
-            const apiKeyValid = result.apiKey && isValidApiKey(result.apiKey);
-            if (result.clientId && !clientIdValid) {
-                logInfo('[credential-discovery] Invalid clientId format in', fileName);
-            }
-            if (result.apiKey && !apiKeyValid) {
-                logInfo('[credential-discovery] Invalid apiKey format in', fileName);
-            }
-            if (clientIdValid) {
-                logInfo('[credential-discovery] Found valid credentials in', fileName);
-                return {
-                    found: true,
-                    source: 'env',
-                    clientId: result.clientId,
-                    apiKey: apiKeyValid ? result.apiKey : undefined,
-                    sourcePath: fileName,
-                };
-            }
-        }
-        catch {
-            // continue
-        }
-    }
-    logInfo('[credential-discovery] No valid credentials found');
-    return { found: false };
-}
-//# sourceMappingURL=credential-discovery.js.map

package/dist/lib/credential-discovery.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-discovery.js","sourceRoot":"","sources":["../../src/lib/credential-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAe5C,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;AAE5F,yDAAyD;AACzD,MAAM,wBAAwB,GAAG,0CAA0C,CAAC;AAC5E,MAAM,sBAAsB,GAAG,wCAAwC,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,OAAO,CAAC,mDAAmD,EAAE,UAAU,CAAC,CAAC;IACzE,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,OAAO,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;IAC/D,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7B,KAAK,EAAE,UAAU;KAClB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAErD,6CAA6C;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3F,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAErE,OAAO;QACL,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,OAAO,CAAC,kEAAkE,CAAC,CAAC;IAC5E,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;YAE3C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAElE,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBACtC,OAAO,CAAC,mDAAmD,EAAE,QAAQ,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,CAAC,mDAAmD,EAAE,QAAQ,CAAC,CAAC;gBACvE,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC/C,UAAU,EAAE,QAAQ;iBACrB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { logInfo } from '../utils/debug.js';\n\nexport interface DiscoveryResult {\n  found: boolean;\n  source?: 'env' | 'declined';\n  clientId?: string;\n  apiKey?: string;\n  sourcePath?: string;\n}\n\nexport interface EnvFileInfo {\n  exists: boolean;\n  files: string[];\n}\n\nconst ENV_FILE_NAMES = ['.env.local', '.env.development.local', '.env.development', '.env'];\n\n// Only extract WorkOS variables - ignore everything else\nconst WORKOS_CLIENT_ID_PATTERN = /^WORKOS_CLIENT_ID=[\"']?([^\"'\\s#]+)[\"']?/m;\nconst WORKOS_API_KEY_PATTERN = /^WORKOS_API_KEY=[\"']?([^\"'\\s#]+)[\"']?/m;\n\n/**\n * Check if env files exist in the project directory (without reading contents).\n * Returns which files were found so the UI can prompt for consent.\n */\nexport async function checkForEnvFiles(projectDir: string): Promise<EnvFileInfo> {\n  logInfo('[credential-discovery] Checking for env files in:', projectDir);\n  const foundFiles: string[] = [];\n\n  for (const fileName of ENV_FILE_NAMES) {\n    const filePath = path.join(projectDir, fileName);\n    try {\n      await fs.access(filePath, fs.constants.R_OK);\n      foundFiles.push(fileName);\n    } catch {\n      // continue\n    }\n  }\n\n  logInfo('[credential-discovery] Found env files:', foundFiles);\n  return {\n    exists: foundFiles.length > 0,\n    files: foundFiles,\n  };\n}\n\n/**\n * Scan a single env file for WorkOS credentials.\n * Only extracts WORKOS_CLIENT_ID and WORKOS_API_KEY - ignores all other variables.\n */\nexport async function scanEnvFile(filePath: string): Promise<{ clientId?: string; apiKey?: string }> {\n  const content = await fs.readFile(filePath, 'utf-8');\n\n  // Filter out commented lines before matching\n  const lines = content.split(/\\r?\\n/);\n  const uncommentedContent = lines.filter((line) => !line.trim().startsWith('#')).join('\\n');\n\n  const clientIdMatch = uncommentedContent.match(WORKOS_CLIENT_ID_PATTERN);\n  const apiKeyMatch = uncommentedContent.match(WORKOS_API_KEY_PATTERN);\n\n  return {\n    clientId: clientIdMatch?.[1],\n    apiKey: apiKeyMatch?.[1],\n  };\n}\n\n/**\n * Validate client ID format.\n * WorkOS client IDs start with 'client_' prefix.\n */\nexport function isValidClientId(value: string): boolean {\n  return value.startsWith('client_') && value.length > 10;\n}\n\n/**\n * Validate API key format.\n * WorkOS secret keys start with 'sk_' prefix.\n */\nexport function isValidApiKey(value: string): boolean {\n  return value.startsWith('sk_') && value.length > 10;\n}\n\n/**\n * Discover WorkOS credentials from project env files.\n * Must be called AFTER user consent is given.\n *\n * Scans files in priority order: .env.local > .env.development.local > .env.development > .env\n * Returns first complete match (both clientId and apiKey preferred, but clientId-only is valid).\n */\nexport async function discoverCredentials(projectDir: string): Promise<DiscoveryResult> {\n  logInfo('[credential-discovery] Scanning env files for WorkOS credentials');\n  for (const fileName of ENV_FILE_NAMES) {\n    const filePath = path.join(projectDir, fileName);\n\n    try {\n      const result = await scanEnvFile(filePath);\n\n      const clientIdValid = result.clientId && isValidClientId(result.clientId);\n      const apiKeyValid = result.apiKey && isValidApiKey(result.apiKey);\n\n      if (result.clientId && !clientIdValid) {\n        logInfo('[credential-discovery] Invalid clientId format in', fileName);\n      }\n      if (result.apiKey && !apiKeyValid) {\n        logInfo('[credential-discovery] Invalid apiKey format in', fileName);\n      }\n\n      if (clientIdValid) {\n        logInfo('[credential-discovery] Found valid credentials in', fileName);\n        return {\n          found: true,\n          source: 'env',\n          clientId: result.clientId,\n          apiKey: apiKeyValid ? result.apiKey : undefined,\n          sourcePath: fileName,\n        };\n      }\n    } catch {\n      // continue\n    }\n  }\n\n  logInfo('[credential-discovery] No valid credentials found');\n  return { found: false };\n}\n"]}