workos 0.19.0 → 0.20.2

package/dist/lib/ai-content.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ai-content.js","sourceRoot":"","sources":["../../src/lib/ai-content.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAOtD;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAI,EAAqC;IAC/D,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QACzB,4DAA4D;QAC5D,OAAO,CAAC,2DAA2D,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,SAAS,EAAE,4DAA4D;YAC/E,cAAc,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;SAClG,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED,0BAA0B;IAC1B,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;QACvC,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE;YACP,aAAa,EAAE,gBAAgB,EAAE;YACjC,QAAQ,EAAE,kBAAkB,EAAE;YAC9B,kBAAkB,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,kBAAkB;SACzD;KACF,CAAC,CAAC;IAEH,OAAO,CAAC,iCAAiC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,MAAM,EAAE,OAAO,EAAE,kDAAkD;SACpE,CAAC,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CAAI,EAAqC;IAChE,qDAAqD;IACrD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB,EACnB,KAAe,EACf,UAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC5C,KAAK,EAAE,0BAA0B;gBACjC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE,wEAAwE,WAAW,4BAA4B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0EAA0E;qBAChO;iBACF;aACF,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO,4CAA4C,WAAW,EAAE,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB,EACnB,KAAe,EACf,aAAqB,EACrB,UAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC5C,KAAK,EAAE,0BAA0B;gBACjC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE,0CAA0C,aAAa;;aAE/D,WAAW;iBACP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;kCAOC;qBACvB;iBACF;aACF,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO;uCAC4B,WAAW;;;EAGhD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;wCAGC,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import Anthropic from '@anthropic-ai/sdk';\nimport { startCredentialProxy } from './credential-proxy.js';\nimport { getAuthkitDomain, getCliAuthClientId, getConfig } from './settings.js';\nimport { getLlmGatewayUrl } from '../utils/urls.js';\nimport { getCredentials } from './credentials.js';\nimport { logInfo, logError } from '../utils/debug.js';\n\nexport interface AiContentOptions {\n  /** Use direct Anthropic API instead of llm-gateway */\n  direct?: boolean;\n}\n\n/**\n * Execute an API call through a short-lived credential proxy.\n * Handles proxy lifecycle automatically.\n */\nasync function withProxy<T>(fn: (client: Anthropic) => Promise<T>): Promise<T> {\n  const gatewayUrl = getLlmGatewayUrl();\n  const creds = getCredentials();\n\n  if (!creds?.refreshToken) {\n    // No refresh token - use credentials directly (legacy mode)\n    logInfo('[ai-content] No refresh token, using credentials directly');\n    const client = new Anthropic({\n      baseURL: gatewayUrl,\n      apiKey: 'gateway', // SDK requires something, gateway uses Authorization header\n      defaultHeaders: creds?.accessToken ? { Authorization: `Bearer ${creds.accessToken}` } : undefined,\n    });\n    return fn(client);\n  }\n\n  // Start short-lived proxy\n  const proxy = await startCredentialProxy({\n    upstreamUrl: gatewayUrl,\n    refresh: {\n      authkitDomain: getAuthkitDomain(),\n      clientId: getCliAuthClientId(),\n      refreshThresholdMs: getConfig().proxy.refreshThresholdMs,\n    },\n  });\n\n  logInfo(`[ai-content] Started proxy at ${proxy.url}`);\n\n  try {\n    const client = new Anthropic({\n      baseURL: proxy.url,\n      apiKey: 'proxy', // SDK requires something, proxy handles real auth\n    });\n    return await fn(client);\n  } finally {\n    await proxy.stop();\n    logInfo('[ai-content] Stopped proxy');\n  }\n}\n\n/**\n * Execute an API call directly to Anthropic (--direct mode).\n */\nasync function withDirect<T>(fn: (client: Anthropic) => Promise<T>): Promise<T> {\n  // SDK reads ANTHROPIC_API_KEY from env automatically\n  const client = new Anthropic();\n  return fn(client);\n}\n\n/**\n * Generate a concise commit message for the AuthKit integration.\n * Falls back to a default message if AI generation fails.\n */\nexport async function generateCommitMessage(\n  integration: string,\n  files: string[],\n  options: AiContentOptions = {},\n): Promise<string> {\n  const executor = options.direct ? withDirect : withProxy;\n\n  try {\n    return await executor(async (client) => {\n      const response = await client.messages.create({\n        model: 'claude-sonnet-4-20250514',\n        max_tokens: 100,\n        messages: [\n          {\n            role: 'user',\n            content: `Generate a concise git commit message for adding WorkOS AuthKit to a ${integration} project. Changed files: ${files.slice(0, 10).join(', ')}. Use conventional commit format (feat:). One line only, under 72 chars.`,\n          },\n        ],\n      });\n\n      const text = response.content[0];\n      if (text.type === 'text') {\n        return text.text.trim();\n      }\n      throw new Error('Unexpected response format');\n    });\n  } catch (error) {\n    logError('[ai-content] Failed to generate commit message:', error);\n    return `feat: add WorkOS AuthKit integration for ${integration}`;\n  }\n}\n\n/**\n * Generate a PR description for the AuthKit integration.\n * Falls back to a default template if AI generation fails.\n */\nexport async function generatePrDescription(\n  integration: string,\n  files: string[],\n  commitMessage: string,\n  options: AiContentOptions = {},\n): Promise<string> {\n  const executor = options.direct ? withDirect : withProxy;\n\n  try {\n    return await executor(async (client) => {\n      const response = await client.messages.create({\n        model: 'claude-sonnet-4-20250514',\n        max_tokens: 500,\n        messages: [\n          {\n            role: 'user',\n            content: `Generate a GitHub PR description for: \"${commitMessage}\"\n\nFramework: ${integration}\nFiles changed: ${files.join(', ')}\n\nInclude:\n- Brief summary (2-3 sentences)\n- Key changes bullet list\n- Link to WorkOS AuthKit docs: https://workos.com/docs/user-management\n\nKeep it concise. Markdown format.`,\n          },\n        ],\n      });\n\n      const text = response.content[0];\n      if (text.type === 'text') {\n        return text.text.trim();\n      }\n      throw new Error('Unexpected response format');\n    });\n  } catch (error) {\n    logError('[ai-content] Failed to generate PR description:', error);\n    return `## Summary\nAdded WorkOS AuthKit integration for ${integration}.\n\n## Changes\n${files.map((f) => `- ${f}`).join('\\n')}\n\n## Documentation\nhttps://workos.com/docs/user-management`;\n  }\n}\n"]}

package/dist/lib/api-error-handler.d.ts

@@ -1,18 +0,0 @@
-export declare function isSdkException(error: unknown): error is {
-    status: number;
-    message: string;
-    requestID: string;
-    code?: string;
-    errors?: Array<{
-        message: string;
-    }>;
-};
-/**
- * Create a resource-specific API error handler.
- * Handles raw fetch errors (WorkOSApiError), SDK exceptions, and the SDK's
- * "errors is not iterable" TypeError from malformed 422 responses.
- *
- * `context` optionally names the specific resource instance (e.g. a vault
- * object name) so 404 messages can be more specific.
- */
-export declare function createApiErrorHandler(resourceName: string): (error: unknown, context?: string) => never;

package/dist/lib/api-error-handler.js

@@ -1,76 +0,0 @@
-import { WorkOSApiError } from './workos-api.js';
-import { exitWithError } from '../utils/output.js';
-export function isSdkException(error) {
-    if (!(error instanceof Error))
-        return false;
-    const e = error;
-    return typeof e.status === 'number' && typeof e.requestID === 'string';
-}
-function normalizeApiError(error) {
-    if (error instanceof WorkOSApiError) {
-        return {
-            status: error.statusCode,
-            code: error.code,
-            errors: error.errors,
-            message: error.message,
-        };
-    }
-    if (isSdkException(error)) {
-        return {
-            status: error.status,
-            code: error.code,
-            errors: error.errors,
-            message: error.message,
-        };
-    }
-    return null;
-}
-function getApiErrorMessage(error, label) {
-    if (error.status === 401)
-        return 'Invalid API key. Check your environment configuration.';
-    if (error.status === 404)
-        return `${label} not found.`;
-    if (error.status === 422 && error.errors?.length)
-        return error.errors.map((e) => e.message).join(', ');
-    return error.message;
-}
-/**
- * Create a resource-specific API error handler.
- * Handles raw fetch errors (WorkOSApiError), SDK exceptions, and the SDK's
- * "errors is not iterable" TypeError from malformed 422 responses.
- *
- * `context` optionally names the specific resource instance (e.g. a vault
- * object name) so 404 messages can be more specific.
- */
-export function createApiErrorHandler(resourceName) {
-    return (error, context) => {
-        if (error instanceof TypeError && error.message.includes('errors is not iterable')) {
-            exitWithError({
-                code: 'unprocessable_entity',
-                message: `${resourceName} API rejected the request. Check that all required fields are provided.`,
-                apiContext: { resource: resourceName },
-            });
-        }
-        const label = context ? `${resourceName} '${context}'` : resourceName;
-        const apiError = normalizeApiError(error);
-        if (apiError) {
-            const code = apiError.code ?? `http_${apiError.status}`;
-            exitWithError({
-                code,
-                message: getApiErrorMessage(apiError, label),
-                details: apiError.errors,
-                apiContext: {
-                    status: apiError.status,
-                    code,
-                    resource: resourceName,
-                },
-            });
-        }
-        exitWithError({
-            code: 'unknown_error',
-            message: error instanceof Error ? error.message : 'Unknown error',
-            apiContext: { resource: resourceName },
-        });
-    };
-}
-//# sourceMappingURL=api-error-handler.js.map

package/dist/lib/api-error-handler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-error-handler.js","sourceRoot":"","sources":["../../src/lib/api-error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,UAAU,cAAc,CAC5B,KAAc;IAEd,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,CAAC,GAAG,KAA0D,CAAC;IACrE,OAAO,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC;AACzE,CAAC;AASD,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,UAAU;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB,EAAE,KAAa;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,wDAAwD,CAAC;IAC1F,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,KAAK,aAAa,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,CAAC,KAAc,EAAE,OAAgB,EAAS,EAAE;QACjD,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACnF,aAAa,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,YAAY,yEAAyE;gBACjG,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACtE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxD,aAAa,CAAC;gBACZ,IAAI;gBACJ,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;gBAC5C,OAAO,EAAE,QAAQ,CAAC,MAAM;gBACxB,UAAU,EAAE;oBACV,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI;oBACJ,QAAQ,EAAE,YAAY;iBACvB;aACF,CAAC,CAAC;QACL,CAAC;QAED,aAAa,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;YACjE,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;SACvC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { WorkOSApiError } from './workos-api.js';\nimport { exitWithError } from '../utils/output.js';\n\nexport function isSdkException(\n  error: unknown,\n): error is { status: number; message: string; requestID: string; code?: string; errors?: Array<{ message: string }> } {\n  if (!(error instanceof Error)) return false;\n  const e = error as Error & { status?: unknown; requestID?: unknown };\n  return typeof e.status === 'number' && typeof e.requestID === 'string';\n}\n\ninterface NormalizedApiError {\n  status: number;\n  code?: string;\n  errors?: Array<{ message: string }>;\n  message: string;\n}\n\nfunction normalizeApiError(error: unknown): NormalizedApiError | null {\n  if (error instanceof WorkOSApiError) {\n    return {\n      status: error.statusCode,\n      code: error.code,\n      errors: error.errors,\n      message: error.message,\n    };\n  }\n\n  if (isSdkException(error)) {\n    return {\n      status: error.status,\n      code: error.code,\n      errors: error.errors,\n      message: error.message,\n    };\n  }\n\n  return null;\n}\n\nfunction getApiErrorMessage(error: NormalizedApiError, label: string): string {\n  if (error.status === 401) return 'Invalid API key. Check your environment configuration.';\n  if (error.status === 404) return `${label} not found.`;\n  if (error.status === 422 && error.errors?.length) return error.errors.map((e) => e.message).join(', ');\n  return error.message;\n}\n\n/**\n * Create a resource-specific API error handler.\n * Handles raw fetch errors (WorkOSApiError), SDK exceptions, and the SDK's\n * \"errors is not iterable\" TypeError from malformed 422 responses.\n *\n * `context` optionally names the specific resource instance (e.g. a vault\n * object name) so 404 messages can be more specific.\n */\nexport function createApiErrorHandler(resourceName: string) {\n  return (error: unknown, context?: string): never => {\n    if (error instanceof TypeError && error.message.includes('errors is not iterable')) {\n      exitWithError({\n        code: 'unprocessable_entity',\n        message: `${resourceName} API rejected the request. Check that all required fields are provided.`,\n        apiContext: { resource: resourceName },\n      });\n    }\n\n    const label = context ? `${resourceName} '${context}'` : resourceName;\n    const apiError = normalizeApiError(error);\n    if (apiError) {\n      const code = apiError.code ?? `http_${apiError.status}`;\n      exitWithError({\n        code,\n        message: getApiErrorMessage(apiError, label),\n        details: apiError.errors,\n        apiContext: {\n          status: apiError.status,\n          code,\n          resource: resourceName,\n        },\n      });\n    }\n\n    exitWithError({\n      code: 'unknown_error',\n      message: error instanceof Error ? error.message : 'Unknown error',\n      apiContext: { resource: resourceName },\n    });\n  };\n}\n"]}

package/dist/lib/api-key.d.ts

@@ -1,14 +0,0 @@
-/**
- * API key resolution for management commands.
- *
- * Priority chain:
- * 1. --api-key flag
- * 2. WORKOS_API_KEY environment variable
- * 3. Active environment's stored API key
- */
-export interface ApiKeyOptions {
-    apiKey?: string;
-}
-export declare function resolveApiKey(options?: ApiKeyOptions): string;
-export declare function resolveOptionalApiKey(options?: ApiKeyOptions): string | undefined;
-export declare function resolveApiBaseUrl(): string;

package/dist/lib/api-key.js

@@ -1,37 +0,0 @@
-/**
- * API key resolution for management commands.
- *
- * Priority chain:
- * 1. --api-key flag
- * 2. WORKOS_API_KEY environment variable
- * 3. Active environment's stored API key
- */
-import { getActiveEnvironment } from './config-store.js';
-import { exitWithError } from '../utils/output.js';
-import { formatWorkOSCommand } from '../utils/command-invocation.js';
-const DEFAULT_BASE_URL = 'https://api.workos.com';
-export function resolveApiKey(options) {
-    const apiKey = resolveOptionalApiKey(options);
-    if (apiKey)
-        return apiKey;
-    exitWithError({
-        code: 'no_api_key',
-        message: `No API key configured. Run \`${formatWorkOSCommand('env add')}\` to configure an environment, or set WORKOS_API_KEY.`,
-    });
-}
-export function resolveOptionalApiKey(options) {
-    if (options?.apiKey)
-        return options.apiKey;
-    const envVar = process.env.WORKOS_API_KEY;
-    if (envVar)
-        return envVar;
-    const activeEnv = getActiveEnvironment();
-    if (activeEnv?.apiKey)
-        return activeEnv.apiKey;
-    return undefined;
-}
-export function resolveApiBaseUrl() {
-    const activeEnv = getActiveEnvironment();
-    return activeEnv?.endpoint || DEFAULT_BASE_URL;
-}
-//# sourceMappingURL=api-key.js.map

package/dist/lib/api-key.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../src/lib/api-key.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAMlD,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,aAAa,CAAC;QACZ,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,gCAAgC,mBAAmB,CAAC,SAAS,CAAC,wDAAwD;KAChI,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAuB;IAC3D,IAAI,OAAO,EAAE,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IAE3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IACzC,IAAI,SAAS,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAE/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IACzC,OAAO,SAAS,EAAE,QAAQ,IAAI,gBAAgB,CAAC;AACjD,CAAC","sourcesContent":["/**\n * API key resolution for management commands.\n *\n * Priority chain:\n * 1. --api-key flag\n * 2. WORKOS_API_KEY environment variable\n * 3. Active environment's stored API key\n */\n\nimport { getActiveEnvironment } from './config-store.js';\nimport { exitWithError } from '../utils/output.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nconst DEFAULT_BASE_URL = 'https://api.workos.com';\n\nexport interface ApiKeyOptions {\n  apiKey?: string;\n}\n\nexport function resolveApiKey(options?: ApiKeyOptions): string {\n  const apiKey = resolveOptionalApiKey(options);\n  if (apiKey) return apiKey;\n\n  exitWithError({\n    code: 'no_api_key',\n    message: `No API key configured. Run \\`${formatWorkOSCommand('env add')}\\` to configure an environment, or set WORKOS_API_KEY.`,\n  });\n}\n\nexport function resolveOptionalApiKey(options?: ApiKeyOptions): string | undefined {\n  if (options?.apiKey) return options.apiKey;\n\n  const envVar = process.env.WORKOS_API_KEY;\n  if (envVar) return envVar;\n\n  const activeEnv = getActiveEnvironment();\n  if (activeEnv?.apiKey) return activeEnv.apiKey;\n\n  return undefined;\n}\n\nexport function resolveApiBaseUrl(): string {\n  const activeEnv = getActiveEnvironment();\n  return activeEnv?.endpoint || DEFAULT_BASE_URL;\n}\n"]}

package/dist/lib/api.d.ts

@@ -1,25 +0,0 @@
-import { z } from 'zod';
-export declare const ApiUserSchema: z.ZodObject<{
-    distinct_id: z.ZodString;
-    organizations: z.ZodArray<z.ZodObject<{
-        id: z.ZodUUID;
-    }, z.core.$strip>>;
-    team: z.ZodObject<{
-        id: z.ZodNumber;
-        organization: z.ZodUUID;
-    }, z.core.$strip>;
-    organization: z.ZodObject<{
-        id: z.ZodUUID;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export declare const ApiProjectSchema: z.ZodObject<{
-    id: z.ZodNumber;
-    uuid: z.ZodUUID;
-    organization: z.ZodUUID;
-    api_token: z.ZodString;
-    name: z.ZodString;
-}, z.core.$strip>;
-export type ApiUser = z.infer<typeof ApiUserSchema>;
-export type ApiProject = z.infer<typeof ApiProjectSchema>;
-export declare function fetchUserData(accessToken: string, baseUrl: string): Promise<ApiUser>;
-export declare function fetchProjectData(accessToken: string, projectId: number, baseUrl: string): Promise<ApiProject>;

package/dist/lib/api.js

@@ -1,120 +0,0 @@
-import { z } from 'zod';
-import { analytics } from '../utils/analytics.js';
-export const ApiUserSchema = z.object({
-    distinct_id: z.string(),
-    organizations: z.array(z.object({
-        id: z.uuid(),
-    })),
-    team: z.object({
-        id: z.number(),
-        organization: z.uuid(),
-    }),
-    organization: z.object({
-        id: z.uuid(),
-    }),
-});
-export const ApiProjectSchema = z.object({
-    id: z.number(),
-    uuid: z.uuid(),
-    organization: z.uuid(),
-    api_token: z.string(),
-    name: z.string(),
-});
-class ApiError extends Error {
-    statusCode;
-    endpoint;
-    constructor(message, statusCode, endpoint) {
-        super(message);
-        this.statusCode = statusCode;
-        this.endpoint = endpoint;
-        this.name = 'ApiError';
-    }
-}
-export async function fetchUserData(accessToken, baseUrl) {
-    const endpoint = '/api/users/@me/';
-    try {
-        const response = await fetch(`${baseUrl}${endpoint}`, {
-            headers: {
-                Authorization: `Bearer ${accessToken}`,
-            },
-        });
-        if (!response.ok) {
-            throw await createFetchError(response, endpoint);
-        }
-        const data = await response.json();
-        return ApiUserSchema.parse(data);
-    }
-    catch (error) {
-        const apiError = handleApiError(error, 'fetch user data', endpoint);
-        analytics.captureException(apiError, {
-            endpoint,
-            baseUrl,
-        });
-        throw apiError;
-    }
-}
-export async function fetchProjectData(accessToken, projectId, baseUrl) {
-    const endpoint = `/api/projects/${projectId}/`;
-    try {
-        const response = await fetch(`${baseUrl}${endpoint}`, {
-            headers: {
-                Authorization: `Bearer ${accessToken}`,
-            },
-        });
-        if (!response.ok) {
-            throw await createFetchError(response, endpoint);
-        }
-        const data = await response.json();
-        return ApiProjectSchema.parse(data);
-    }
-    catch (error) {
-        const apiError = handleApiError(error, 'fetch project data', endpoint);
-        analytics.captureException(apiError, {
-            endpoint,
-            baseUrl,
-            projectId,
-        });
-        throw apiError;
-    }
-}
-async function createFetchError(response, endpoint) {
-    let detail;
-    try {
-        const data = await response.json();
-        if (typeof data === 'object' && data !== null && 'detail' in data) {
-            detail = String(data.detail);
-        }
-    }
-    catch {
-        // Response wasn't JSON
-    }
-    const error = new Error(`HTTP ${response.status}`);
-    error.status = response.status;
-    error.endpoint = endpoint;
-    error.detail = detail;
-    return error;
-}
-function isFetchError(error) {
-    return error instanceof Error && 'status' in error && typeof error.status === 'number';
-}
-function handleApiError(error, operation, endpoint) {
-    if (isFetchError(error)) {
-        const { status, detail } = error;
-        if (status === 401) {
-            return new ApiError(`Authentication failed while trying to ${operation}`, status, endpoint);
-        }
-        if (status === 403) {
-            return new ApiError(`Access denied while trying to ${operation}`, status, endpoint);
-        }
-        if (status === 404) {
-            return new ApiError(`Resource not found while trying to ${operation}`, status, endpoint);
-        }
-        const message = detail || `Failed to ${operation}`;
-        return new ApiError(message, status, endpoint);
-    }
-    if (error instanceof z.ZodError) {
-        return new ApiError(`Invalid response format while trying to ${operation}`);
-    }
-    return new ApiError(`Unexpected error while trying to ${operation}: ${error instanceof Error ? error.message : 'Unknown error'}`);
-}
-//# sourceMappingURL=api.js.map

package/dist/lib/api.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,KAAK,CACpB,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;KACb,CAAC,CACH;IACD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;KACvB,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;KACb,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;IACd,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAKH,MAAM,QAAS,SAAQ,KAAK;IAGR;IACA;IAHlB,YACE,OAAe,EACC,UAAmB,EACnB,QAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,eAAU,GAAV,UAAU,CAAS;QACnB,aAAQ,GAAR,QAAQ,CAAS;QAGjC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,WAAmB,EAAE,OAAe;IACtE,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,EAAE;YACpD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACpE,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE;YACnC,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB,EAAE,SAAiB,EAAE,OAAe;IAC5F,MAAM,QAAQ,GAAG,iBAAiB,SAAS,GAAG,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,EAAE;YACpD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QACvE,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE;YACnC,QAAQ;YACR,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC;IACjB,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,gBAAgB,CAAC,QAAkB,EAAE,QAAgB;IAClE,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YAClE,MAAM,GAAG,MAAM,CAAE,IAA4B,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAe,CAAC;IACjE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAQ,KAAoB,CAAC,MAAM,KAAK,QAAQ,CAAC;AACzG,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,SAAiB,EAAE,QAAgB;IACzE,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAEjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,IAAI,QAAQ,CAAC,yCAAyC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,IAAI,QAAQ,CAAC,iCAAiC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,IAAI,QAAQ,CAAC,sCAAsC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,aAAa,SAAS,EAAE,CAAC;QACnD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,IAAI,QAAQ,CAAC,2CAA2C,SAAS,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,IAAI,QAAQ,CACjB,oCAAoC,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC7G,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\nimport { analytics } from '../utils/analytics.js';\n\nexport const ApiUserSchema = z.object({\n  distinct_id: z.string(),\n  organizations: z.array(\n    z.object({\n      id: z.uuid(),\n    }),\n  ),\n  team: z.object({\n    id: z.number(),\n    organization: z.uuid(),\n  }),\n  organization: z.object({\n    id: z.uuid(),\n  }),\n});\n\nexport const ApiProjectSchema = z.object({\n  id: z.number(),\n  uuid: z.uuid(),\n  organization: z.uuid(),\n  api_token: z.string(),\n  name: z.string(),\n});\n\nexport type ApiUser = z.infer<typeof ApiUserSchema>;\nexport type ApiProject = z.infer<typeof ApiProjectSchema>;\n\nclass ApiError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode?: number,\n    public readonly endpoint?: string,\n  ) {\n    super(message);\n    this.name = 'ApiError';\n  }\n}\n\nexport async function fetchUserData(accessToken: string, baseUrl: string): Promise<ApiUser> {\n  const endpoint = '/api/users/@me/';\n  try {\n    const response = await fetch(`${baseUrl}${endpoint}`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw await createFetchError(response, endpoint);\n    }\n\n    const data = await response.json();\n    return ApiUserSchema.parse(data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch user data', endpoint);\n    analytics.captureException(apiError, {\n      endpoint,\n      baseUrl,\n    });\n    throw apiError;\n  }\n}\n\nexport async function fetchProjectData(accessToken: string, projectId: number, baseUrl: string): Promise<ApiProject> {\n  const endpoint = `/api/projects/${projectId}/`;\n  try {\n    const response = await fetch(`${baseUrl}${endpoint}`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw await createFetchError(response, endpoint);\n    }\n\n    const data = await response.json();\n    return ApiProjectSchema.parse(data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch project data', endpoint);\n    analytics.captureException(apiError, {\n      endpoint,\n      baseUrl,\n      projectId,\n    });\n    throw apiError;\n  }\n}\n\ninterface FetchError extends Error {\n  status: number;\n  endpoint: string;\n  detail?: string;\n}\n\nasync function createFetchError(response: Response, endpoint: string): Promise<FetchError> {\n  let detail: string | undefined;\n  try {\n    const data: unknown = await response.json();\n    if (typeof data === 'object' && data !== null && 'detail' in data) {\n      detail = String((data as { detail: unknown }).detail);\n    }\n  } catch {\n    // Response wasn't JSON\n  }\n\n  const error = new Error(`HTTP ${response.status}`) as FetchError;\n  error.status = response.status;\n  error.endpoint = endpoint;\n  error.detail = detail;\n  return error;\n}\n\nfunction isFetchError(error: unknown): error is FetchError {\n  return error instanceof Error && 'status' in error && typeof (error as FetchError).status === 'number';\n}\n\nfunction handleApiError(error: unknown, operation: string, endpoint: string): ApiError {\n  if (isFetchError(error)) {\n    const { status, detail } = error;\n\n    if (status === 401) {\n      return new ApiError(`Authentication failed while trying to ${operation}`, status, endpoint);\n    }\n\n    if (status === 403) {\n      return new ApiError(`Access denied while trying to ${operation}`, status, endpoint);\n    }\n\n    if (status === 404) {\n      return new ApiError(`Resource not found while trying to ${operation}`, status, endpoint);\n    }\n\n    const message = detail || `Failed to ${operation}`;\n    return new ApiError(message, status, endpoint);\n  }\n\n  if (error instanceof z.ZodError) {\n    return new ApiError(`Invalid response format while trying to ${operation}`);\n  }\n\n  return new ApiError(\n    `Unexpected error while trying to ${operation}: ${error instanceof Error ? error.message : 'Unknown error'}`,\n  );\n}\n"]}

package/dist/lib/background-refresh.d.ts

@@ -1,29 +0,0 @@
-/**
- * Background token refresh loop.
- * Runs in main wizard process, refreshes tokens before expiry,
- * writes to credentials file for proxy to read.
- */
-export interface BackgroundRefreshOptions {
-    /** AuthKit domain for refresh endpoint */
-    authkitDomain: string;
-    /** OAuth client ID */
-    clientId: string;
-    /** Check interval in ms (default: 30000) */
-    intervalMs?: number;
-    /** Refresh threshold in ms before expiry (default: 120000 = 2 min) */
-    refreshThresholdMs?: number;
-    /** Callback when refresh fails permanently */
-    onRefreshExpired?: () => void;
-    /** Callback when refresh succeeds */
-    onRefreshSuccess?: () => void;
-}
-export interface BackgroundRefreshHandle {
-    /** Stop the refresh loop */
-    stop: () => void;
-    /** Check if the loop is running */
-    isRunning: () => boolean;
-}
-/**
- * Start background token refresh loop.
- */
-export declare function startBackgroundRefresh(options: BackgroundRefreshOptions): BackgroundRefreshHandle;

package/dist/lib/background-refresh.js

@@ -1,95 +0,0 @@
-/**
- * Background token refresh loop.
- * Runs in main wizard process, refreshes tokens before expiry,
- * writes to credentials file for proxy to read.
- */
-import { logInfo, logError, logWarn } from '../utils/debug.js';
-import { getCredentials, updateTokens } from './credentials.js';
-import { refreshAccessToken, tokenNeedsRefresh } from './token-refresh-client.js';
-import { analytics } from '../utils/analytics.js';
-/**
- * Start background token refresh loop.
- */
-export function startBackgroundRefresh(options) {
-    const { authkitDomain, clientId, intervalMs = 30_000, refreshThresholdMs = 2 * 60 * 1000, onRefreshExpired, onRefreshSuccess, } = options;
-    let isRunning = true;
-    let intervalId = null;
-    let consecutiveFailures = 0;
-    const MAX_CONSECUTIVE_FAILURES = 3;
-    const checkAndRefresh = async () => {
-        if (!isRunning)
-            return;
-        const creds = getCredentials();
-        if (!creds?.refreshToken) {
-            logWarn('[background-refresh] No refresh token available');
-            return;
-        }
-        if (!tokenNeedsRefresh(creds.expiresAt, refreshThresholdMs)) {
-            // Token still valid, nothing to do
-            const timeUntilExpiry = creds.expiresAt - Date.now();
-            logInfo(`[background-refresh] Token valid for ${Math.round(timeUntilExpiry / 1000)}s`);
-            return;
-        }
-        logInfo('[background-refresh] Token needs refresh, initiating...');
-        analytics.capture('installer.token.refresh', {
-            action: 'refresh_attempt',
-            trigger: 'proactive',
-            time_until_expiry_ms: creds.expiresAt - Date.now(),
-        });
-        const startTime = Date.now();
-        const result = await refreshAccessToken(authkitDomain, clientId);
-        if (result.success && result.accessToken && result.expiresAt) {
-            // Update credentials file atomically
-            updateTokens(result.accessToken, result.expiresAt, result.refreshToken);
-            consecutiveFailures = 0;
-            const durationMs = Date.now() - startTime;
-            logInfo(`[background-refresh] Token refreshed in ${durationMs}ms, new expiry: ${new Date(result.expiresAt).toISOString()}`);
-            analytics.capture('installer.token.refresh', {
-                action: 'refresh_success',
-                duration_ms: durationMs,
-                token_rotated: !!result.refreshToken,
-            });
-            onRefreshSuccess?.();
-        }
-        else {
-            consecutiveFailures++;
-            logError(`[background-refresh] Refresh failed: ${result.error}`);
-            analytics.capture('installer.token.refresh', {
-                action: 'refresh_failure',
-                error_type: result.errorType || 'unknown',
-                error_message: result.error || 'Unknown error',
-                consecutive_failures: consecutiveFailures,
-            });
-            // Handle permanent failure (refresh token expired)
-            if (result.errorType === 'invalid_grant') {
-                logError('[background-refresh] Refresh token expired, stopping refresh loop');
-                stop();
-                onRefreshExpired?.();
-                return;
-            }
-            // Handle too many consecutive transient failures
-            if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {
-                logError(`[background-refresh] ${MAX_CONSECUTIVE_FAILURES} consecutive failures, stopping`);
-                stop();
-                onRefreshExpired?.();
-            }
-        }
-    };
-    const stop = () => {
-        isRunning = false;
-        if (intervalId) {
-            clearInterval(intervalId);
-            intervalId = null;
-        }
-        logInfo('[background-refresh] Stopped');
-    };
-    // Run immediately, then on interval
-    checkAndRefresh();
-    intervalId = setInterval(checkAndRefresh, intervalMs);
-    logInfo(`[background-refresh] Started, checking every ${intervalMs}ms`);
-    return {
-        stop,
-        isRunning: () => isRunning,
-    };
-}
-//# sourceMappingURL=background-refresh.js.map

package/dist/lib/background-refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"background-refresh.js","sourceRoot":"","sources":["../../src/lib/background-refresh.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAwBlD;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACtE,MAAM,EACJ,aAAa,EACb,QAAQ,EACR,UAAU,GAAG,MAAM,EACnB,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAClC,gBAAgB,EAChB,gBAAgB,GACjB,GAAG,OAAO,CAAC;IAEZ,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,MAAM,wBAAwB,GAAG,CAAC,CAAC;IAEnC,MAAM,eAAe,GAAG,KAAK,IAAI,EAAE;QACjC,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAE/B,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YACzB,OAAO,CAAC,iDAAiD,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC5D,mCAAmC;YACnC,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrD,OAAO,CAAC,wCAAwC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,yDAAyD,CAAC,CAAC;QAEnE,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAC3C,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,WAAW;YACpB,oBAAoB,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7D,qCAAqC;YACrC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAExE,mBAAmB,GAAG,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,OAAO,CACL,2CAA2C,UAAU,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACnH,CAAC;YAEF,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;gBAC3C,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE,UAAU;gBACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;aACrC,CAAC,CAAC;YAEH,gBAAgB,EAAE,EAAE,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,mBAAmB,EAAE,CAAC;YAEtB,QAAQ,CAAC,wCAAwC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAEjE,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;gBAC3C,MAAM,EAAE,iBAAiB;gBACzB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe;gBAC9C,oBAAoB,EAAE,mBAAmB;aAC1C,CAAC,CAAC;YAEH,mDAAmD;YACnD,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;gBACzC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;gBAC9E,IAAI,EAAE,CAAC;gBACP,gBAAgB,EAAE,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,iDAAiD;YACjD,IAAI,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;gBACpD,QAAQ,CAAC,wBAAwB,wBAAwB,iCAAiC,CAAC,CAAC;gBAC5F,IAAI,EAAE,CAAC;gBACP,gBAAgB,EAAE,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,SAAS,GAAG,KAAK,CAAC;QAClB,IAAI,UAAU,EAAE,CAAC;YACf,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1B,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,oCAAoC;IACpC,eAAe,EAAE,CAAC;IAClB,UAAU,GAAG,WAAW,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAEtD,OAAO,CAAC,gDAAgD,UAAU,IAAI,CAAC,CAAC;IAExE,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Background token refresh loop.\n * Runs in main wizard process, refreshes tokens before expiry,\n * writes to credentials file for proxy to read.\n */\n\nimport { logInfo, logError, logWarn } from '../utils/debug.js';\nimport { getCredentials, updateTokens } from './credentials.js';\nimport { refreshAccessToken, tokenNeedsRefresh } from './token-refresh-client.js';\nimport { analytics } from '../utils/analytics.js';\n\nexport interface BackgroundRefreshOptions {\n  /** AuthKit domain for refresh endpoint */\n  authkitDomain: string;\n  /** OAuth client ID */\n  clientId: string;\n  /** Check interval in ms (default: 30000) */\n  intervalMs?: number;\n  /** Refresh threshold in ms before expiry (default: 120000 = 2 min) */\n  refreshThresholdMs?: number;\n  /** Callback when refresh fails permanently */\n  onRefreshExpired?: () => void;\n  /** Callback when refresh succeeds */\n  onRefreshSuccess?: () => void;\n}\n\nexport interface BackgroundRefreshHandle {\n  /** Stop the refresh loop */\n  stop: () => void;\n  /** Check if the loop is running */\n  isRunning: () => boolean;\n}\n\n/**\n * Start background token refresh loop.\n */\nexport function startBackgroundRefresh(options: BackgroundRefreshOptions): BackgroundRefreshHandle {\n  const {\n    authkitDomain,\n    clientId,\n    intervalMs = 30_000,\n    refreshThresholdMs = 2 * 60 * 1000,\n    onRefreshExpired,\n    onRefreshSuccess,\n  } = options;\n\n  let isRunning = true;\n  let intervalId: NodeJS.Timeout | null = null;\n  let consecutiveFailures = 0;\n  const MAX_CONSECUTIVE_FAILURES = 3;\n\n  const checkAndRefresh = async () => {\n    if (!isRunning) return;\n\n    const creds = getCredentials();\n\n    if (!creds?.refreshToken) {\n      logWarn('[background-refresh] No refresh token available');\n      return;\n    }\n\n    if (!tokenNeedsRefresh(creds.expiresAt, refreshThresholdMs)) {\n      // Token still valid, nothing to do\n      const timeUntilExpiry = creds.expiresAt - Date.now();\n      logInfo(`[background-refresh] Token valid for ${Math.round(timeUntilExpiry / 1000)}s`);\n      return;\n    }\n\n    logInfo('[background-refresh] Token needs refresh, initiating...');\n\n    analytics.capture('installer.token.refresh', {\n      action: 'refresh_attempt',\n      trigger: 'proactive',\n      time_until_expiry_ms: creds.expiresAt - Date.now(),\n    });\n\n    const startTime = Date.now();\n    const result = await refreshAccessToken(authkitDomain, clientId);\n\n    if (result.success && result.accessToken && result.expiresAt) {\n      // Update credentials file atomically\n      updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n\n      consecutiveFailures = 0;\n      const durationMs = Date.now() - startTime;\n\n      logInfo(\n        `[background-refresh] Token refreshed in ${durationMs}ms, new expiry: ${new Date(result.expiresAt).toISOString()}`,\n      );\n\n      analytics.capture('installer.token.refresh', {\n        action: 'refresh_success',\n        duration_ms: durationMs,\n        token_rotated: !!result.refreshToken,\n      });\n\n      onRefreshSuccess?.();\n    } else {\n      consecutiveFailures++;\n\n      logError(`[background-refresh] Refresh failed: ${result.error}`);\n\n      analytics.capture('installer.token.refresh', {\n        action: 'refresh_failure',\n        error_type: result.errorType || 'unknown',\n        error_message: result.error || 'Unknown error',\n        consecutive_failures: consecutiveFailures,\n      });\n\n      // Handle permanent failure (refresh token expired)\n      if (result.errorType === 'invalid_grant') {\n        logError('[background-refresh] Refresh token expired, stopping refresh loop');\n        stop();\n        onRefreshExpired?.();\n        return;\n      }\n\n      // Handle too many consecutive transient failures\n      if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {\n        logError(`[background-refresh] ${MAX_CONSECUTIVE_FAILURES} consecutive failures, stopping`);\n        stop();\n        onRefreshExpired?.();\n      }\n    }\n  };\n\n  const stop = () => {\n    isRunning = false;\n    if (intervalId) {\n      clearInterval(intervalId);\n      intervalId = null;\n    }\n    logInfo('[background-refresh] Stopped');\n  };\n\n  // Run immediately, then on interval\n  checkAndRefresh();\n  intervalId = setInterval(checkAndRefresh, intervalMs);\n\n  logInfo(`[background-refresh] Started, checking every ${intervalMs}ms`);\n\n  return {\n    stop,\n    isRunning: () => isRunning,\n  };\n}\n"]}

package/dist/lib/command-aliases.d.ts

@@ -1,8 +0,0 @@
-/**
- * Shared canonical command alias map.
- * Single source of truth for both telemetry and help-json.
- *
- * Keys are user-facing aliases, values are canonical command names.
- * Adding an alias here updates both metrics aggregation and --help --json output.
- */
-export declare const COMMAND_ALIASES: Record<string, string>;

package/dist/lib/command-aliases.js

@@ -1,12 +0,0 @@
-/**
- * Shared canonical command alias map.
- * Single source of truth for both telemetry and help-json.
- *
- * Keys are user-facing aliases, values are canonical command names.
- * Adding an alias here updates both metrics aggregation and --help --json output.
- */
-export const COMMAND_ALIASES = {
-    org: 'organization',
-    claim: 'env.claim',
-};
-//# sourceMappingURL=command-aliases.js.map

package/dist/lib/command-aliases.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"command-aliases.js","sourceRoot":"","sources":["../../src/lib/command-aliases.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,GAAG,EAAE,cAAc;IACnB,KAAK,EAAE,WAAW;CACnB,CAAC","sourcesContent":["/**\n * Shared canonical command alias map.\n * Single source of truth for both telemetry and help-json.\n *\n * Keys are user-facing aliases, values are canonical command names.\n * Adding an alias here updates both metrics aggregation and --help --json output.\n */\nexport const COMMAND_ALIASES: Record<string, string> = {\n  org: 'organization',\n  claim: 'env.claim',\n};\n"]}

package/dist/lib/completion-data.d.ts

@@ -1,33 +0,0 @@
-import type { CompletionData } from './events.js';
-import type { DevCommandResult } from './dev-command.js';
-import type { Integration } from './constants.js';
-/**
- * Machine-context slice needed to build completion data.
- */
-export interface CompletionContext {
-    integration: string;
-    changedFiles?: string[];
-    installDir: string;
-}
-/**
- * Injected dependencies. The impure lookups (registry/settings) are resolved by
- * the caller and passed as plain values so the builder stays pure + unit-testable.
- */
-export interface CompletionDataDeps {
-    resolveDevCommand: (dir: string) => Promise<DevCommandResult>;
-    detectPort: (integration: Integration, dir: string) => number;
-    docsUrl: string;
-    dashboardUrl: string;
-    /** Enriched getOutroNextSteps copy for the framework */
-    frameworkNextSteps?: string[];
-    /** Per-framework "add a sign-in link" snippet */
-    signInSnippet?: string;
-}
-/**
- * Build the structured completion payload for a successful install.
- *
- * Deterministic given its inputs. The dev command is derived from the
- * lockfile-aware `resolveDevCommand` (never from context.packageManager, which
- * is flag/env-derived and unreliable). Copy fields are injected by the caller.
- */
-export declare function buildCompletionData(ctx: CompletionContext, deps: CompletionDataDeps): Promise<CompletionData>;

package/dist/lib/completion-data.js

@@ -1,33 +0,0 @@
-/**
- * Build the structured completion payload for a successful install.
- *
- * Deterministic given its inputs. The dev command is derived from the
- * lockfile-aware `resolveDevCommand` (never from context.packageManager, which
- * is flag/env-derived and unreliable). Copy fields are injected by the caller.
- */
-export async function buildCompletionData(ctx, deps) {
-    const dev = await deps.resolveDevCommand(ctx.installDir);
-    const devCommand = [dev.command, ...dev.args].join(' ');
-    const port = deps.detectPort(ctx.integration, ctx.installDir);
-    const url = `http://localhost:${port}`;
-    const files = ctx.changedFiles ?? [];
-    const concrete = [
-        `Run \`${devCommand}\` to start your dev server`,
-        `Open ${url} to test authentication`,
-        ...(deps.signInSnippet ? [deps.signInSnippet] : []),
-    ];
-    // Drop the framework's generic "start dev server" line — the concrete step
-    // above already names the exact lockfile-aware command.
-    const framework = (deps.frameworkNextSteps ?? []).filter((s) => !/start .*dev(elopment)? server/i.test(s));
-    return {
-        integration: ctx.integration,
-        devCommand,
-        url,
-        files,
-        nextSteps: [...concrete, ...framework],
-        docsUrl: deps.docsUrl,
-        dashboardUrl: deps.dashboardUrl,
-        signInSnippet: deps.signInSnippet,
-    };
-}
-//# sourceMappingURL=completion-data.js.map

package/dist/lib/completion-data.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"completion-data.js","sourceRoot":"","sources":["../../src/lib/completion-data.ts"],"names":[],"mappings":"AA4BA;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAsB,EAAE,IAAwB;IACxF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAA0B,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IAErC,MAAM,QAAQ,GAAG;QACf,SAAS,UAAU,6BAA6B;QAChD,QAAQ,GAAG,yBAAyB;QACpC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;IACF,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3G,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU;QACV,GAAG;QACH,KAAK;QACL,SAAS,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC;AACJ,CAAC","sourcesContent":["import type { CompletionData } from './events.js';\nimport type { DevCommandResult } from './dev-command.js';\nimport type { Integration } from './constants.js';\n\n/**\n * Machine-context slice needed to build completion data.\n */\nexport interface CompletionContext {\n  integration: string;\n  changedFiles?: string[];\n  installDir: string;\n}\n\n/**\n * Injected dependencies. The impure lookups (registry/settings) are resolved by\n * the caller and passed as plain values so the builder stays pure + unit-testable.\n */\nexport interface CompletionDataDeps {\n  resolveDevCommand: (dir: string) => Promise<DevCommandResult>;\n  detectPort: (integration: Integration, dir: string) => number;\n  docsUrl: string;\n  dashboardUrl: string;\n  /** Enriched getOutroNextSteps copy for the framework */\n  frameworkNextSteps?: string[];\n  /** Per-framework \"add a sign-in link\" snippet */\n  signInSnippet?: string;\n}\n\n/**\n * Build the structured completion payload for a successful install.\n *\n * Deterministic given its inputs. The dev command is derived from the\n * lockfile-aware `resolveDevCommand` (never from context.packageManager, which\n * is flag/env-derived and unreliable). Copy fields are injected by the caller.\n */\nexport async function buildCompletionData(ctx: CompletionContext, deps: CompletionDataDeps): Promise<CompletionData> {\n  const dev = await deps.resolveDevCommand(ctx.installDir);\n  const devCommand = [dev.command, ...dev.args].join(' ');\n  const port = deps.detectPort(ctx.integration as Integration, ctx.installDir);\n  const url = `http://localhost:${port}`;\n  const files = ctx.changedFiles ?? [];\n\n  const concrete = [\n    `Run \\`${devCommand}\\` to start your dev server`,\n    `Open ${url} to test authentication`,\n    ...(deps.signInSnippet ? [deps.signInSnippet] : []),\n  ];\n  // Drop the framework's generic \"start dev server\" line — the concrete step\n  // above already names the exact lockfile-aware command.\n  const framework = (deps.frameworkNextSteps ?? []).filter((s) => !/start .*dev(elopment)? server/i.test(s));\n\n  return {\n    integration: ctx.integration,\n    devCommand,\n    url,\n    files,\n    nextSteps: [...concrete, ...framework],\n    docsUrl: deps.docsUrl,\n    dashboardUrl: deps.dashboardUrl,\n    signInSnippet: deps.signInSnippet,\n  };\n}\n"]}