workos 0.18.0 → 0.20.1

package/dist/lib/credential-proxy.d.ts

@@ -1,45 +0,0 @@
-/**
- * Lightweight HTTP proxy that injects credentials into upstream requests.
- * Includes lazy token refresh - refreshes proactively when token is expiring soon.
- */
-export interface RefreshConfig {
-    /** AuthKit domain for refresh endpoint */
-    authkitDomain: string;
-    /** OAuth client ID */
-    clientId: string;
-    /** Threshold in ms - refresh when token expires within this window (default: 60000 = 1 min) */
-    refreshThresholdMs?: number;
-    /** Callback when refresh succeeds */
-    onRefreshSuccess?: () => void;
-    /** Callback when refresh fails permanently (token expired, invalid_grant) */
-    onRefreshExpired?: () => void;
-}
-export interface CredentialProxyOptions {
-    /** Upstream URL to forward requests to */
-    upstreamUrl: string;
-    /** Optional: specific port to bind (default: random) */
-    port?: number;
-    /** Optional: refresh configuration for lazy token refresh */
-    refresh?: RefreshConfig;
-}
-export interface CredentialProxyHandle {
-    /** Port the proxy is listening on */
-    port: number;
-    /** Full URL for the proxy (e.g., http://localhost:54321) */
-    url: string;
-    /** Stop the proxy server */
-    stop: () => Promise<void>;
-}
-/**
- * Start the credential injector proxy with optional lazy refresh.
- */
-export declare function startCredentialProxy(options: CredentialProxyOptions): Promise<CredentialProxyHandle>;
-/**
- * Start a lightweight proxy that injects claim token headers for unclaimed environments.
- * No refresh logic — claim tokens are assumed valid for the duration of an install session.
- */
-export declare function startClaimTokenProxy(options: {
-    upstreamUrl: string;
-    claimToken: string;
-    clientId: string;
-}): Promise<CredentialProxyHandle>;

package/dist/lib/credential-proxy.js

@@ -1,364 +0,0 @@
-/**
- * Lightweight HTTP proxy that injects credentials into upstream requests.
- * Includes lazy token refresh - refreshes proactively when token is expiring soon.
- */
-import http from 'node:http';
-import https from 'node:https';
-import { URL } from 'node:url';
-import { logInfo, logError, logWarn } from '../utils/debug.js';
-import { getCredentials, updateTokens } from './credentials.js';
-import { analytics } from '../utils/analytics.js';
-import { refreshAccessToken } from './token-refresh-client.js';
-import { formatWorkOSCommand } from '../utils/command-invocation.js';
-import { observeHostFailure } from './host-probe.js';
-// Hop-by-hop headers that must not be forwarded by proxies (RFC 7230 §6.1)
-const HOP_BY_HOP_HEADERS = new Set([
-    'connection',
-    'keep-alive',
-    'proxy-authenticate',
-    'proxy-authorization',
-    'te',
-    'trailer',
-    'transfer-encoding',
-    'upgrade',
-]);
-/** Copy headers, excluding hop-by-hop headers */
-function filterHeaders(headers) {
-    const out = {};
-    for (const [key, value] of Object.entries(headers)) {
-        if (!HOP_BY_HOP_HEADERS.has(key.toLowerCase()) && value !== undefined) {
-            out[key] = value;
-        }
-    }
-    return out;
-}
-/** Build the upstream path, stripping the `beta` query param (unsupported by WorkOS LLM gateway) */
-function buildUpstreamPath(reqUrl, upstream) {
-    const requestPath = reqUrl || '/';
-    const basePath = upstream.pathname.replace(/\/$/, '');
-    const fullPath = basePath + requestPath;
-    const upstreamUrl = new URL(fullPath, upstream.origin);
-    const searchParams = new URLSearchParams(upstreamUrl.search);
-    searchParams.delete('beta');
-    const queryString = searchParams.toString();
-    return upstreamUrl.pathname + (queryString ? `?${queryString}` : '');
-}
-// Module-level state for lazy refresh
-let refreshPromise = null;
-let refreshConfig = null;
-let consecutiveFailures = 0;
-const MAX_CONSECUTIVE_FAILURES = 3;
-/**
- * Perform token refresh, updating credentials file.
- * Returns true if refresh succeeded.
- */
-async function doRefresh() {
-    if (!refreshConfig) {
-        logError('[credential-proxy] No refresh config available');
-        return false;
-    }
-    const { authkitDomain, clientId, onRefreshSuccess, onRefreshExpired } = refreshConfig;
-    const startTime = Date.now();
-    logInfo('[credential-proxy] Starting token refresh...');
-    analytics.capture('installer.token.refresh', {
-        action: 'refresh_attempt',
-        trigger: 'lazy',
-    });
-    const result = await refreshAccessToken(authkitDomain, clientId);
-    if (result.success && result.accessToken && result.expiresAt) {
-        // Update credentials file atomically
-        updateTokens(result.accessToken, result.expiresAt, result.refreshToken);
-        consecutiveFailures = 0;
-        const durationMs = Date.now() - startTime;
-        logInfo(`[credential-proxy] Token refreshed in ${durationMs}ms, expires: ${new Date(result.expiresAt).toISOString()}`);
-        analytics.capture('installer.token.refresh', {
-            action: 'refresh_success',
-            duration_ms: durationMs,
-            token_rotated: !!result.refreshToken,
-        });
-        onRefreshSuccess?.();
-        return true;
-    }
-    consecutiveFailures++;
-    logError(`[credential-proxy] Refresh failed: ${result.error}`);
-    analytics.capture('installer.token.refresh', {
-        action: 'refresh_failure',
-        error_type: result.errorType || 'unknown',
-        error_message: result.error || 'Unknown error',
-        consecutive_failures: consecutiveFailures,
-    });
-    // Handle permanent failure
-    if (result.errorType === 'invalid_grant' || consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {
-        logError('[credential-proxy] Refresh token expired or too many failures');
-        onRefreshExpired?.();
-    }
-    return false;
-}
-/**
- * Ensure we have valid credentials, refreshing if needed.
- * Uses a promise-based lock to prevent concurrent refreshes.
- *
- * @returns Credentials to use for request, or null if unavailable
- */
-async function ensureValidCredentials(thresholdMs) {
-    const creds = getCredentials();
-    if (!creds?.accessToken) {
-        return null;
-    }
-    // No refresh token = can't refresh, just use what we have
-    if (!creds.refreshToken || !refreshConfig) {
-        return creds;
-    }
-    const timeUntilExpiry = creds.expiresAt - Date.now();
-    if (timeUntilExpiry <= 0) {
-        // Token expired - must wait for refresh
-        logWarn('[credential-proxy] Token expired, waiting for refresh...');
-        if (!refreshPromise) {
-            refreshPromise = doRefresh()
-                .then(() => { })
-                .finally(() => {
-                refreshPromise = null;
-            });
-        }
-        await refreshPromise;
-        return getCredentials(); // Return fresh credentials
-    }
-    if (timeUntilExpiry < thresholdMs) {
-        // Token expiring soon - trigger background refresh, but use current token
-        logInfo(`[credential-proxy] Token expires in ${Math.round(timeUntilExpiry / 1000)}s, triggering refresh`);
-        if (!refreshPromise) {
-            refreshPromise = doRefresh()
-                .then(() => { })
-                .finally(() => {
-                refreshPromise = null;
-            });
-        }
-        // Don't await - fire and forget, use current (still valid) token
-    }
-    return creds;
-}
-/**
- * Start the credential injector proxy with optional lazy refresh.
- */
-export async function startCredentialProxy(options) {
-    const upstream = new URL(options.upstreamUrl);
-    const useHttps = upstream.protocol === 'https:';
-    const thresholdMs = options.refresh?.refreshThresholdMs ?? 60_000;
-    // Store refresh config for lazy refresh
-    refreshConfig = options.refresh ?? null;
-    consecutiveFailures = 0;
-    const server = http.createServer(async (req, res) => {
-        await handleRequest(req, res, upstream, useHttps, thresholdMs);
-    });
-    // Find available port
-    const port = await new Promise((resolve, reject) => {
-        const tryPort = options.port ?? 0; // 0 = random available port
-        let attempts = 0;
-        const maxAttempts = 10;
-        const tryListen = (p) => {
-            server.once('error', (err) => {
-                if (err.code === 'EADDRINUSE' && attempts < maxAttempts) {
-                    attempts++;
-                    tryListen(0); // Try random port
-                }
-                else {
-                    observeHostFailure('localhost-bind', err, {
-                        operation: 'listen',
-                        target: `127.0.0.1:${p}`,
-                        label: 'credential proxy',
-                    });
-                    reject(err);
-                }
-            });
-            server.listen(p, '127.0.0.1', () => {
-                const addr = server.address();
-                if (addr && typeof addr === 'object') {
-                    resolve(addr.port);
-                }
-                else {
-                    reject(new Error('Failed to get server address'));
-                }
-            });
-        };
-        tryListen(tryPort);
-    });
-    const url = `http://127.0.0.1:${port}`;
-    logInfo(`[credential-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);
-    if (refreshConfig) {
-        logInfo(`[credential-proxy] Lazy refresh enabled, threshold: ${thresholdMs}ms`);
-    }
-    // Telemetry for proxy start
-    analytics.capture('installer.proxy', {
-        action: 'start',
-        port,
-        refresh_enabled: !!refreshConfig,
-    });
-    return {
-        port,
-        url,
-        stop: async () => {
-            // Clear refresh state
-            refreshConfig = null;
-            refreshPromise = null;
-            consecutiveFailures = 0;
-            await stopServer(server);
-        },
-    };
-}
-async function handleRequest(req, res, upstream, useHttps, thresholdMs) {
-    // Get valid credentials, potentially triggering refresh
-    const creds = await ensureValidCredentials(thresholdMs);
-    if (!creds?.accessToken) {
-        logError('[credential-proxy] No credentials available');
-        res.writeHead(401, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: 'credentials_unavailable',
-            message: `Not authenticated. Run \`${formatWorkOSCommand('auth login')}\` first.`,
-        }));
-        return;
-    }
-    // Build upstream request
-    const headers = filterHeaders(req.headers);
-    headers['authorization'] = `Bearer ${creds.accessToken}`;
-    headers['host'] = upstream.host;
-    const finalPath = buildUpstreamPath(req.url, upstream);
-    const requestOptions = {
-        hostname: upstream.hostname,
-        port: upstream.port || (useHttps ? 443 : 80),
-        path: finalPath,
-        method: req.method,
-        headers,
-        timeout: 120_000, // 2 minute timeout
-    };
-    const transport = useHttps ? https : http;
-    const proxyReq = transport.request(requestOptions, (proxyRes) => {
-        res.writeHead(proxyRes.statusCode || 500, filterHeaders(proxyRes.headers));
-        proxyRes.pipe(res);
-    });
-    proxyReq.on('error', (err) => {
-        logError('[credential-proxy] Upstream error:', err.message);
-        if (!res.headersSent) {
-            if (err.code === 'ECONNREFUSED') {
-                res.writeHead(502, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: 'upstream_unavailable',
-                    message: 'Could not connect to upstream server',
-                }));
-            }
-            else if (err.code === 'ETIMEDOUT') {
-                res.writeHead(504, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: 'upstream_timeout',
-                    message: 'Upstream server timed out',
-                }));
-            }
-            else {
-                res.writeHead(502, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: 'proxy_error',
-                    message: err.message,
-                }));
-            }
-        }
-    });
-    proxyReq.on('timeout', () => {
-        proxyReq.destroy();
-        if (!res.headersSent) {
-            res.writeHead(504, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: 'upstream_timeout',
-                message: 'Upstream server timed out',
-            }));
-        }
-    });
-    // Stream request body
-    req.pipe(proxyReq);
-}
-/**
- * Start a lightweight proxy that injects claim token headers for unclaimed environments.
- * No refresh logic — claim tokens are assumed valid for the duration of an install session.
- */
-export async function startClaimTokenProxy(options) {
-    const upstream = new URL(options.upstreamUrl);
-    const useHttps = upstream.protocol === 'https:';
-    const server = http.createServer(async (req, res) => {
-        const headers = filterHeaders(req.headers);
-        headers['x-workos-claim-token'] = options.claimToken;
-        headers['x-workos-client-id'] = options.clientId;
-        headers['host'] = upstream.host;
-        const finalPath = buildUpstreamPath(req.url, upstream);
-        const transport = useHttps ? https : http;
-        const proxyReq = transport.request({
-            hostname: upstream.hostname,
-            port: upstream.port || (useHttps ? 443 : 80),
-            path: finalPath,
-            method: req.method,
-            headers,
-            timeout: 120_000,
-        }, (proxyRes) => {
-            res.writeHead(proxyRes.statusCode || 500, filterHeaders(proxyRes.headers));
-            proxyRes.pipe(res);
-        });
-        proxyReq.on('error', (err) => {
-            logError('[claim-token-proxy] Upstream error:', err.message);
-            if (!res.headersSent) {
-                res.writeHead(502, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'proxy_error', message: err.message }));
-            }
-        });
-        proxyReq.on('timeout', () => {
-            proxyReq.destroy();
-            if (!res.headersSent) {
-                res.writeHead(504, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'upstream_timeout', message: 'Upstream server timed out' }));
-            }
-        });
-        req.pipe(proxyReq);
-    });
-    const port = await new Promise((resolve, reject) => {
-        server.once('error', (err) => {
-            observeHostFailure('localhost-bind', err, {
-                operation: 'listen',
-                target: '127.0.0.1:0',
-                label: 'claim token proxy',
-            });
-            reject(err);
-        });
-        server.listen(0, '127.0.0.1', () => {
-            const addr = server.address();
-            if (addr && typeof addr === 'object')
-                resolve(addr.port);
-            else
-                reject(new Error('Failed to get server address'));
-        });
-    });
-    const url = `http://127.0.0.1:${port}`;
-    logInfo(`[claim-token-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);
-    return {
-        port,
-        url,
-        stop: async () => stopServer(server),
-    };
-}
-function stopServer(server) {
-    return new Promise((resolve, reject) => {
-        // Set a timeout for graceful shutdown
-        const timeout = setTimeout(() => {
-            logInfo('[credential-proxy] Force closing after timeout');
-            server.closeAllConnections?.();
-            resolve();
-        }, 5000);
-        server.close((err) => {
-            clearTimeout(timeout);
-            if (err) {
-                logError('[credential-proxy] Error stopping server:', err);
-                reject(err);
-            }
-            else {
-                logInfo('[credential-proxy] Stopped');
-                resolve();
-            }
-        });
-    });
-}
-//# sourceMappingURL=credential-proxy.js.map

package/dist/lib/credential-proxy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-proxy.js","sourceRoot":"","sources":["../../src/lib/credential-proxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAoB,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAiCrD,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH,iDAAiD;AACjD,SAAS,aAAa,CAAC,OAAsD;IAC3E,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CAAC,MAA0B,EAAE,QAAa;IAClE,MAAM,WAAW,GAAG,MAAM,IAAI,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7D,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC5C,OAAO,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,sCAAsC;AACtC,IAAI,cAAc,GAAyB,IAAI,CAAC;AAChD,IAAI,aAAa,GAAyB,IAAI,CAAC;AAC/C,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAC5B,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC;;;GAGG;AACH,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,gDAAgD,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAExD,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7D,qCAAqC;QACrC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAExE,mBAAmB,GAAG,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,OAAO,CACL,yCAAyC,UAAU,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9G,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAC3C,MAAM,EAAE,iBAAiB;YACzB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;SACrC,CAAC,CAAC;QAEH,gBAAgB,EAAE,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB,EAAE,CAAC;IAEtB,QAAQ,CAAC,sCAAsC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE/D,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;QACzC,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe;QAC9C,oBAAoB,EAAE,mBAAmB;KAC1C,CAAC,CAAC;IAEH,2BAA2B;IAC3B,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,IAAI,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;QAC5F,QAAQ,CAAC,+DAA+D,CAAC,CAAC;QAC1E,gBAAgB,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAErD,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,wCAAwC;QACxC,OAAO,CAAC,0DAA0D,CAAC,CAAC;QAEpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,MAAM,cAAc,CAAC;QACrB,OAAO,cAAc,EAAE,CAAC,CAAC,2BAA2B;IACtD,CAAC;IAED,IAAI,eAAe,GAAG,WAAW,EAAE,CAAC;QAClC,0EAA0E;QAC1E,OAAO,CAAC,uCAAuC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE1G,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,iEAAiE;IACnE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA+B;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,kBAAkB,IAAI,MAAM,CAAC;IAElE,wCAAwC;IACxC,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IACxC,mBAAmB,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;oBACxD,QAAQ,EAAE,CAAC;oBACX,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;gBAClC,CAAC;qBAAM,CAAC;oBACN,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,EAAE;wBACxC,SAAS,EAAE,QAAQ;wBACnB,MAAM,EAAE,aAAa,CAAC,EAAE;wBACxB,KAAK,EAAE,kBAAkB;qBAC1B,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,iCAAiC,GAAG,mBAAmB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,uDAAuD,WAAW,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,4BAA4B;IAC5B,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE;QACnC,MAAM,EAAE,OAAO;QACf,IAAI;QACJ,eAAe,EAAE,CAAC,CAAC,aAAa;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,sBAAsB;YACtB,aAAa,GAAG,IAAI,CAAC;YACrB,cAAc,GAAG,IAAI,CAAC;YACtB,mBAAmB,GAAG,CAAC,CAAC;YACxB,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAyB,EACzB,GAAwB,EACxB,QAAa,EACb,QAAiB,EACjB,WAAmB;IAEnB,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,6CAA6C,CAAC,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,4BAA4B,mBAAmB,CAAC,YAAY,CAAC,WAAW;SAClF,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEvD,MAAM,cAAc,GAAwB;QAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO;QACP,OAAO,EAAE,OAAO,EAAE,mBAAmB;KACtC,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC9D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,QAAQ,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,IAAK,GAA6B,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,sBAAsB;oBAC7B,OAAO,EAAE,sCAAsC;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,IAAK,GAA6B,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,2BAA2B;iBACrC,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,2BAA2B;aACrC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAI1C;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QACrD,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEvD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAChC;YACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO;YACP,OAAO,EAAE,OAAO;SACjB,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;QAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,QAAQ,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,EAAE;gBACxC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,kCAAkC,GAAG,mBAAmB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvF,OAAO;QACL,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,sCAAsC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,CAAC,gDAAgD,CAAC,CAAC;YAC1D,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,4BAA4B,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Lightweight HTTP proxy that injects credentials into upstream requests.\n * Includes lazy token refresh - refreshes proactively when token is expiring soon.\n */\n\nimport http from 'node:http';\nimport https from 'node:https';\nimport { URL } from 'node:url';\nimport { logInfo, logError, logWarn } from '../utils/debug.js';\nimport { getCredentials, updateTokens, type Credentials } from './credentials.js';\nimport { analytics } from '../utils/analytics.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { observeHostFailure } from './host-probe.js';\n\nexport interface RefreshConfig {\n  /** AuthKit domain for refresh endpoint */\n  authkitDomain: string;\n  /** OAuth client ID */\n  clientId: string;\n  /** Threshold in ms - refresh when token expires within this window (default: 60000 = 1 min) */\n  refreshThresholdMs?: number;\n  /** Callback when refresh succeeds */\n  onRefreshSuccess?: () => void;\n  /** Callback when refresh fails permanently (token expired, invalid_grant) */\n  onRefreshExpired?: () => void;\n}\n\nexport interface CredentialProxyOptions {\n  /** Upstream URL to forward requests to */\n  upstreamUrl: string;\n  /** Optional: specific port to bind (default: random) */\n  port?: number;\n  /** Optional: refresh configuration for lazy token refresh */\n  refresh?: RefreshConfig;\n}\n\nexport interface CredentialProxyHandle {\n  /** Port the proxy is listening on */\n  port: number;\n  /** Full URL for the proxy (e.g., http://localhost:54321) */\n  url: string;\n  /** Stop the proxy server */\n  stop: () => Promise<void>;\n}\n\n// Hop-by-hop headers that must not be forwarded by proxies (RFC 7230 §6.1)\nconst HOP_BY_HOP_HEADERS = new Set([\n  'connection',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailer',\n  'transfer-encoding',\n  'upgrade',\n]);\n\n/** Copy headers, excluding hop-by-hop headers */\nfunction filterHeaders(headers: Record<string, string | string[] | undefined>): http.OutgoingHttpHeaders {\n  const out: http.OutgoingHttpHeaders = {};\n  for (const [key, value] of Object.entries(headers)) {\n    if (!HOP_BY_HOP_HEADERS.has(key.toLowerCase()) && value !== undefined) {\n      out[key] = value;\n    }\n  }\n  return out;\n}\n\n/** Build the upstream path, stripping the `beta` query param (unsupported by WorkOS LLM gateway) */\nfunction buildUpstreamPath(reqUrl: string | undefined, upstream: URL): string {\n  const requestPath = reqUrl || '/';\n  const basePath = upstream.pathname.replace(/\\/$/, '');\n  const fullPath = basePath + requestPath;\n  const upstreamUrl = new URL(fullPath, upstream.origin);\n  const searchParams = new URLSearchParams(upstreamUrl.search);\n  searchParams.delete('beta');\n  const queryString = searchParams.toString();\n  return upstreamUrl.pathname + (queryString ? `?${queryString}` : '');\n}\n\n// Module-level state for lazy refresh\nlet refreshPromise: Promise<void> | null = null;\nlet refreshConfig: RefreshConfig | null = null;\nlet consecutiveFailures = 0;\nconst MAX_CONSECUTIVE_FAILURES = 3;\n\n/**\n * Perform token refresh, updating credentials file.\n * Returns true if refresh succeeded.\n */\nasync function doRefresh(): Promise<boolean> {\n  if (!refreshConfig) {\n    logError('[credential-proxy] No refresh config available');\n    return false;\n  }\n\n  const { authkitDomain, clientId, onRefreshSuccess, onRefreshExpired } = refreshConfig;\n  const startTime = Date.now();\n\n  logInfo('[credential-proxy] Starting token refresh...');\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_attempt',\n    trigger: 'lazy',\n  });\n\n  const result = await refreshAccessToken(authkitDomain, clientId);\n\n  if (result.success && result.accessToken && result.expiresAt) {\n    // Update credentials file atomically\n    updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n\n    consecutiveFailures = 0;\n    const durationMs = Date.now() - startTime;\n\n    logInfo(\n      `[credential-proxy] Token refreshed in ${durationMs}ms, expires: ${new Date(result.expiresAt).toISOString()}`,\n    );\n\n    analytics.capture('installer.token.refresh', {\n      action: 'refresh_success',\n      duration_ms: durationMs,\n      token_rotated: !!result.refreshToken,\n    });\n\n    onRefreshSuccess?.();\n    return true;\n  }\n\n  consecutiveFailures++;\n\n  logError(`[credential-proxy] Refresh failed: ${result.error}`);\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_failure',\n    error_type: result.errorType || 'unknown',\n    error_message: result.error || 'Unknown error',\n    consecutive_failures: consecutiveFailures,\n  });\n\n  // Handle permanent failure\n  if (result.errorType === 'invalid_grant' || consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {\n    logError('[credential-proxy] Refresh token expired or too many failures');\n    onRefreshExpired?.();\n  }\n\n  return false;\n}\n\n/**\n * Ensure we have valid credentials, refreshing if needed.\n * Uses a promise-based lock to prevent concurrent refreshes.\n *\n * @returns Credentials to use for request, or null if unavailable\n */\nasync function ensureValidCredentials(thresholdMs: number): Promise<Credentials | null> {\n  const creds = getCredentials();\n\n  if (!creds?.accessToken) {\n    return null;\n  }\n\n  // No refresh token = can't refresh, just use what we have\n  if (!creds.refreshToken || !refreshConfig) {\n    return creds;\n  }\n\n  const timeUntilExpiry = creds.expiresAt - Date.now();\n\n  if (timeUntilExpiry <= 0) {\n    // Token expired - must wait for refresh\n    logWarn('[credential-proxy] Token expired, waiting for refresh...');\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n\n    await refreshPromise;\n    return getCredentials(); // Return fresh credentials\n  }\n\n  if (timeUntilExpiry < thresholdMs) {\n    // Token expiring soon - trigger background refresh, but use current token\n    logInfo(`[credential-proxy] Token expires in ${Math.round(timeUntilExpiry / 1000)}s, triggering refresh`);\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n    // Don't await - fire and forget, use current (still valid) token\n  }\n\n  return creds;\n}\n\n/**\n * Start the credential injector proxy with optional lazy refresh.\n */\nexport async function startCredentialProxy(options: CredentialProxyOptions): Promise<CredentialProxyHandle> {\n  const upstream = new URL(options.upstreamUrl);\n  const useHttps = upstream.protocol === 'https:';\n  const thresholdMs = options.refresh?.refreshThresholdMs ?? 60_000;\n\n  // Store refresh config for lazy refresh\n  refreshConfig = options.refresh ?? null;\n  consecutiveFailures = 0;\n\n  const server = http.createServer(async (req, res) => {\n    await handleRequest(req, res, upstream, useHttps, thresholdMs);\n  });\n\n  // Find available port\n  const port = await new Promise<number>((resolve, reject) => {\n    const tryPort = options.port ?? 0; // 0 = random available port\n    let attempts = 0;\n    const maxAttempts = 10;\n\n    const tryListen = (p: number) => {\n      server.once('error', (err: NodeJS.ErrnoException) => {\n        if (err.code === 'EADDRINUSE' && attempts < maxAttempts) {\n          attempts++;\n          tryListen(0); // Try random port\n        } else {\n          observeHostFailure('localhost-bind', err, {\n            operation: 'listen',\n            target: `127.0.0.1:${p}`,\n            label: 'credential proxy',\n          });\n          reject(err);\n        }\n      });\n\n      server.listen(p, '127.0.0.1', () => {\n        const addr = server.address();\n        if (addr && typeof addr === 'object') {\n          resolve(addr.port);\n        } else {\n          reject(new Error('Failed to get server address'));\n        }\n      });\n    };\n\n    tryListen(tryPort);\n  });\n\n  const url = `http://127.0.0.1:${port}`;\n  logInfo(`[credential-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);\n  if (refreshConfig) {\n    logInfo(`[credential-proxy] Lazy refresh enabled, threshold: ${thresholdMs}ms`);\n  }\n\n  // Telemetry for proxy start\n  analytics.capture('installer.proxy', {\n    action: 'start',\n    port,\n    refresh_enabled: !!refreshConfig,\n  });\n\n  return {\n    port,\n    url,\n    stop: async () => {\n      // Clear refresh state\n      refreshConfig = null;\n      refreshPromise = null;\n      consecutiveFailures = 0;\n      await stopServer(server);\n    },\n  };\n}\n\nasync function handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  upstream: URL,\n  useHttps: boolean,\n  thresholdMs: number,\n): Promise<void> {\n  // Get valid credentials, potentially triggering refresh\n  const creds = await ensureValidCredentials(thresholdMs);\n\n  if (!creds?.accessToken) {\n    logError('[credential-proxy] No credentials available');\n    res.writeHead(401, { 'Content-Type': 'application/json' });\n    res.end(\n      JSON.stringify({\n        error: 'credentials_unavailable',\n        message: `Not authenticated. Run \\`${formatWorkOSCommand('auth login')}\\` first.`,\n      }),\n    );\n    return;\n  }\n\n  // Build upstream request\n  const headers = filterHeaders(req.headers);\n  headers['authorization'] = `Bearer ${creds.accessToken}`;\n  headers['host'] = upstream.host;\n  const finalPath = buildUpstreamPath(req.url, upstream);\n\n  const requestOptions: http.RequestOptions = {\n    hostname: upstream.hostname,\n    port: upstream.port || (useHttps ? 443 : 80),\n    path: finalPath,\n    method: req.method,\n    headers,\n    timeout: 120_000, // 2 minute timeout\n  };\n\n  const transport = useHttps ? https : http;\n\n  const proxyReq = transport.request(requestOptions, (proxyRes) => {\n    res.writeHead(proxyRes.statusCode || 500, filterHeaders(proxyRes.headers));\n    proxyRes.pipe(res);\n  });\n\n  proxyReq.on('error', (err) => {\n    logError('[credential-proxy] Upstream error:', err.message);\n\n    if (!res.headersSent) {\n      if ((err as NodeJS.ErrnoException).code === 'ECONNREFUSED') {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_unavailable',\n            message: 'Could not connect to upstream server',\n          }),\n        );\n      } else if ((err as NodeJS.ErrnoException).code === 'ETIMEDOUT') {\n        res.writeHead(504, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_timeout',\n            message: 'Upstream server timed out',\n          }),\n        );\n      } else {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'proxy_error',\n            message: err.message,\n          }),\n        );\n      }\n    }\n  });\n\n  proxyReq.on('timeout', () => {\n    proxyReq.destroy();\n    if (!res.headersSent) {\n      res.writeHead(504, { 'Content-Type': 'application/json' });\n      res.end(\n        JSON.stringify({\n          error: 'upstream_timeout',\n          message: 'Upstream server timed out',\n        }),\n      );\n    }\n  });\n\n  // Stream request body\n  req.pipe(proxyReq);\n}\n\n/**\n * Start a lightweight proxy that injects claim token headers for unclaimed environments.\n * No refresh logic — claim tokens are assumed valid for the duration of an install session.\n */\nexport async function startClaimTokenProxy(options: {\n  upstreamUrl: string;\n  claimToken: string;\n  clientId: string;\n}): Promise<CredentialProxyHandle> {\n  const upstream = new URL(options.upstreamUrl);\n  const useHttps = upstream.protocol === 'https:';\n\n  const server = http.createServer(async (req, res) => {\n    const headers = filterHeaders(req.headers);\n    headers['x-workos-claim-token'] = options.claimToken;\n    headers['x-workos-client-id'] = options.clientId;\n    headers['host'] = upstream.host;\n    const finalPath = buildUpstreamPath(req.url, upstream);\n\n    const transport = useHttps ? https : http;\n\n    const proxyReq = transport.request(\n      {\n        hostname: upstream.hostname,\n        port: upstream.port || (useHttps ? 443 : 80),\n        path: finalPath,\n        method: req.method,\n        headers,\n        timeout: 120_000,\n      },\n      (proxyRes) => {\n        res.writeHead(proxyRes.statusCode || 500, filterHeaders(proxyRes.headers));\n        proxyRes.pipe(res);\n      },\n    );\n\n    proxyReq.on('error', (err) => {\n      logError('[claim-token-proxy] Upstream error:', err.message);\n      if (!res.headersSent) {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'proxy_error', message: err.message }));\n      }\n    });\n\n    proxyReq.on('timeout', () => {\n      proxyReq.destroy();\n      if (!res.headersSent) {\n        res.writeHead(504, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'upstream_timeout', message: 'Upstream server timed out' }));\n      }\n    });\n\n    req.pipe(proxyReq);\n  });\n\n  const port = await new Promise<number>((resolve, reject) => {\n    server.once('error', (err) => {\n      observeHostFailure('localhost-bind', err, {\n        operation: 'listen',\n        target: '127.0.0.1:0',\n        label: 'claim token proxy',\n      });\n      reject(err);\n    });\n    server.listen(0, '127.0.0.1', () => {\n      const addr = server.address();\n      if (addr && typeof addr === 'object') resolve(addr.port);\n      else reject(new Error('Failed to get server address'));\n    });\n  });\n\n  const url = `http://127.0.0.1:${port}`;\n  logInfo(`[claim-token-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);\n\n  return {\n    port,\n    url,\n    stop: async () => stopServer(server),\n  };\n}\n\nfunction stopServer(server: http.Server): Promise<void> {\n  return new Promise((resolve, reject) => {\n    // Set a timeout for graceful shutdown\n    const timeout = setTimeout(() => {\n      logInfo('[credential-proxy] Force closing after timeout');\n      server.closeAllConnections?.();\n      resolve();\n    }, 5000);\n\n    server.close((err) => {\n      clearTimeout(timeout);\n      if (err) {\n        logError('[credential-proxy] Error stopping server:', err);\n        reject(err);\n      } else {\n        logInfo('[credential-proxy] Stopped');\n        resolve();\n      }\n    });\n  });\n}\n"]}

package/dist/lib/credential-store.d.ts

@@ -1,32 +0,0 @@
-/**
- * Credential storage abstraction with keyring support and file fallback.
- *
- * Storage priority:
- * 1. If --insecure-storage: use file only
- * 2. Try keyring, fall back to file with warning if unavailable
- */
-export interface StagingCache {
-    clientId: string;
-    apiKey: string;
-    fetchedAt: number;
-}
-export interface Credentials {
-    accessToken: string;
-    expiresAt: number;
-    userId: string;
-    email?: string;
-    staging?: StagingCache;
-    refreshToken?: string;
-}
-export declare function setInsecureStorage(value: boolean): void;
-declare function getCredentialsPath(): string;
-export declare function hasCredentials(): boolean;
-export declare function getCredentials(): Credentials | null;
-export declare function saveCredentials(creds: Credentials): void;
-export declare function clearCredentials(): void;
-export declare function updateTokens(accessToken: string, expiresAt: number, refreshToken?: string): void;
-/**
- * Diagnostic info about credential storage state — for debugging auth failures.
- */
-export declare function diagnoseCredentials(): string[];
-export { getCredentialsPath };