workos 0.19.0 → 0.20.2

package/dist/lib/credential-store.js

@@ -1,236 +0,0 @@
-/**
- * Credential storage abstraction with keyring support and file fallback.
- *
- * Storage priority:
- * 1. If --insecure-storage: use file only
- * 2. Try keyring, fall back to file with warning if unavailable
- */
-import { Entry } from '@napi-rs/keyring';
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import { logWarn } from '../utils/debug.js';
-import { observeHostFailure } from './host-probe.js';
-const SERVICE_NAME = 'workos-cli';
-const ACCOUNT_NAME = 'credentials';
-let fallbackWarningShown = false;
-let forceInsecureStorage = false;
-let migrationAttempted = false;
-export function setInsecureStorage(value) {
-    forceInsecureStorage = value;
-    migrationAttempted = false;
-}
-function getCredentialsDir() {
-    return path.join(os.homedir(), '.workos');
-}
-function getCredentialsPath() {
-    return path.join(getCredentialsDir(), 'credentials.json');
-}
-function fileExists() {
-    return fs.existsSync(getCredentialsPath());
-}
-function readFromFile() {
-    if (!fileExists())
-        return null;
-    const filePath = getCredentialsPath();
-    try {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        return JSON.parse(content);
-    }
-    catch (error) {
-        observeHostFailure('home-fs', error, {
-            operation: 'read',
-            target: filePath,
-            label: 'credential fallback file',
-        });
-        logWarn('Failed to read credentials file:', error);
-        return null;
-    }
-}
-function writeToFile(creds) {
-    const dir = getCredentialsDir();
-    const filePath = getCredentialsPath();
-    try {
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        }
-        fs.writeFileSync(filePath, JSON.stringify(creds, null, 2), {
-            mode: 0o600,
-        });
-    }
-    catch (error) {
-        observeHostFailure('home-fs', error, {
-            operation: 'write',
-            target: filePath,
-            label: 'credential fallback file',
-        });
-        throw error;
-    }
-}
-function deleteFile() {
-    const filePath = getCredentialsPath();
-    if (fileExists()) {
-        try {
-            fs.unlinkSync(filePath);
-        }
-        catch (error) {
-            observeHostFailure('home-fs', error, {
-                operation: 'delete',
-                target: filePath,
-                label: 'credential fallback file',
-            });
-            throw error;
-        }
-    }
-}
-function getKeyringEntry() {
-    return new Entry(SERVICE_NAME, ACCOUNT_NAME);
-}
-function readFromKeyring() {
-    try {
-        const entry = getKeyringEntry();
-        const data = entry.getPassword();
-        if (!data) {
-            logWarn('[credential-store] keyring: entry exists but data is null/empty');
-            return null;
-        }
-        return JSON.parse(data);
-    }
-    catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        logWarn(`[credential-store] keyring read failed: ${msg}`);
-        observeHostFailure('keychain', error, {
-            operation: 'read',
-            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-            label: 'credential keychain entry',
-        });
-        return null;
-    }
-}
-function writeToKeyring(creds) {
-    try {
-        const entry = getKeyringEntry();
-        entry.setPassword(JSON.stringify(creds));
-        return true;
-    }
-    catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        logWarn(`[credential-store] keyring write failed: ${msg}`);
-        observeHostFailure('keychain', error, {
-            operation: 'write',
-            target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-            label: 'credential keychain entry',
-        });
-        return false;
-    }
-}
-function deleteFromKeyring() {
-    try {
-        const entry = getKeyringEntry();
-        entry.deletePassword();
-    }
-    catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        if (!msg.includes('not found') && !msg.includes('No such')) {
-            logWarn('Failed to delete from keyring:', error);
-            observeHostFailure('keychain', error, {
-                operation: 'delete',
-                target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,
-                label: 'credential keychain entry',
-            });
-        }
-    }
-}
-function showFallbackWarning() {
-    if (fallbackWarningShown || forceInsecureStorage)
-        return;
-    fallbackWarningShown = true;
-    logWarn('Unable to store credentials in system keyring. Using file storage.', 'Credentials saved to ~/.workos/credentials.json', 'Use --insecure-storage to suppress this warning.');
-}
-export function hasCredentials() {
-    if (forceInsecureStorage) {
-        return fileExists();
-    }
-    return readFromKeyring() !== null || fileExists();
-}
-export function getCredentials() {
-    if (forceInsecureStorage)
-        return readFromFile();
-    const keyringCreds = readFromKeyring();
-    if (keyringCreds)
-        return keyringCreds;
-    const fileCreds = readFromFile();
-    if (fileCreds) {
-        if (!migrationAttempted) {
-            migrationAttempted = true;
-            writeToKeyring(fileCreds);
-        }
-        return fileCreds;
-    }
-    return null;
-}
-export function saveCredentials(creds) {
-    if (forceInsecureStorage)
-        return writeToFile(creds);
-    if (!writeToKeyring(creds)) {
-        showFallbackWarning();
-        writeToFile(creds);
-    }
-}
-export function clearCredentials() {
-    deleteFromKeyring();
-    deleteFile();
-    migrationAttempted = false;
-}
-export function updateTokens(accessToken, expiresAt, refreshToken) {
-    const creds = getCredentials();
-    if (!creds) {
-        throw new Error('No existing credentials to update');
-    }
-    const updated = {
-        ...creds,
-        accessToken,
-        expiresAt,
-        ...(refreshToken && { refreshToken }),
-    };
-    saveCredentials(updated);
-}
-/**
- * Diagnostic info about credential storage state — for debugging auth failures.
- */
-export function diagnoseCredentials() {
-    const lines = [];
-    const filePath = getCredentialsPath();
-    const filePresent = fileExists();
-    lines.push(`file: ${filePath} (exists=${filePresent})`);
-    if (filePresent) {
-        try {
-            const content = fs.readFileSync(filePath, 'utf-8');
-            const parsed = JSON.parse(content);
-            const expired = parsed.expiresAt ? Date.now() >= parsed.expiresAt : 'unknown';
-            lines.push(`file creds: userId=${parsed.userId ?? 'missing'}, expired=${expired}, hasRefreshToken=${!!parsed.refreshToken}`);
-        }
-        catch (e) {
-            lines.push(`file creds: parse error — ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }
-    try {
-        const entry = getKeyringEntry();
-        const data = entry.getPassword();
-        if (data) {
-            const parsed = JSON.parse(data);
-            const expired = parsed.expiresAt ? Date.now() >= parsed.expiresAt : 'unknown';
-            lines.push(`keyring: found, userId=${parsed.userId ?? 'missing'}, expired=${expired}, hasRefreshToken=${!!parsed.refreshToken}`);
-        }
-        else {
-            lines.push('keyring: empty (getPassword returned null)');
-        }
-    }
-    catch (e) {
-        lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);
-    }
-    lines.push(`insecureStorage=${forceInsecureStorage}`);
-    return lines;
-}
-export { getCredentialsPath };
-//# sourceMappingURL=credential-store.js.map

package/dist/lib/credential-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/lib/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAiBrD,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,oBAAoB,GAAG,KAAK,CAAC;IAC7B,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,0BAA0B;SAClC,CAAC,CAAC;QACH,OAAO,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACzD,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,0BAA0B;SAClC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE;gBACnC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,0BAA0B;aAClC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,iEAAiE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QAC1D,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,2BAA2B;SACnC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAkB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;QAC3D,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;YACpC,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;YACzC,KAAK,EAAE,2BAA2B;SACnC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACjD,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE;gBACpC,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,YAAY,IAAI,YAAY,EAAE;gBACzC,KAAK,EAAE,2BAA2B;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,oEAAoE,EACpE,iDAAiD,EACjD,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,eAAe,EAAE,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,CAAC;YAC1B,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,SAAiB,EAAE,YAAqB;IACxF,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,GAAG,KAAK;QACR,WAAW;QACX,SAAS;QACT,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;KACtC,CAAC;IAEF,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IAEjC,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,YAAY,WAAW,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyB,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,KAAK,CAAC,IAAI,CACR,sBAAsB,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CACjH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;YACxD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,KAAK,CAAC,IAAI,CACR,0BAA0B,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CACrH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,mBAAmB,oBAAoB,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/**\n * Credential storage abstraction with keyring support and file fallback.\n *\n * Storage priority:\n * 1. If --insecure-storage: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\nimport { observeHostFailure } from './host-probe.js';\n\nexport interface StagingCache {\n  clientId: string;\n  apiKey: string;\n  fetchedAt: number;\n}\n\nexport interface Credentials {\n  accessToken: string;\n  expiresAt: number;\n  userId: string;\n  email?: string;\n  staging?: StagingCache;\n  refreshToken?: string;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'credentials';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\nlet migrationAttempted = false;\n\nexport function setInsecureStorage(value: boolean): void {\n  forceInsecureStorage = value;\n  migrationAttempted = false;\n}\n\nfunction getCredentialsDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getCredentialsPath(): string {\n  return path.join(getCredentialsDir(), 'credentials.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getCredentialsPath());\n}\n\nfunction readFromFile(): Credentials | null {\n  if (!fileExists()) return null;\n  const filePath = getCredentialsPath();\n  try {\n    const content = fs.readFileSync(filePath, 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'read',\n      target: filePath,\n      label: 'credential fallback file',\n    });\n    logWarn('Failed to read credentials file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(creds: Credentials): void {\n  const dir = getCredentialsDir();\n  const filePath = getCredentialsPath();\n  try {\n    if (!fs.existsSync(dir)) {\n      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    fs.writeFileSync(filePath, JSON.stringify(creds, null, 2), {\n      mode: 0o600,\n    });\n  } catch (error) {\n    observeHostFailure('home-fs', error, {\n      operation: 'write',\n      target: filePath,\n      label: 'credential fallback file',\n    });\n    throw error;\n  }\n}\n\nfunction deleteFile(): void {\n  const filePath = getCredentialsPath();\n  if (fileExists()) {\n    try {\n      fs.unlinkSync(filePath);\n    } catch (error) {\n      observeHostFailure('home-fs', error, {\n        operation: 'delete',\n        target: filePath,\n        label: 'credential fallback file',\n      });\n      throw error;\n    }\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): Credentials | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) {\n      logWarn('[credential-store] keyring: entry exists but data is null/empty');\n      return null;\n    }\n    return JSON.parse(data);\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    logWarn(`[credential-store] keyring read failed: ${msg}`);\n    observeHostFailure('keychain', error, {\n      operation: 'read',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'credential keychain entry',\n    });\n    return null;\n  }\n}\n\nfunction writeToKeyring(creds: Credentials): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(creds));\n    return true;\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    logWarn(`[credential-store] keyring write failed: ${msg}`);\n    observeHostFailure('keychain', error, {\n      operation: 'write',\n      target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n      label: 'credential keychain entry',\n    });\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete from keyring:', error);\n      observeHostFailure('keychain', error, {\n        operation: 'delete',\n        target: `${SERVICE_NAME}/${ACCOUNT_NAME}`,\n        label: 'credential keychain entry',\n      });\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store credentials in system keyring. Using file storage.',\n    'Credentials saved to ~/.workos/credentials.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function hasCredentials(): boolean {\n  if (forceInsecureStorage) {\n    return fileExists();\n  }\n  return readFromKeyring() !== null || fileExists();\n}\n\nexport function getCredentials(): Credentials | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringCreds = readFromKeyring();\n  if (keyringCreds) return keyringCreds;\n\n  const fileCreds = readFromFile();\n  if (fileCreds) {\n    if (!migrationAttempted) {\n      migrationAttempted = true;\n      writeToKeyring(fileCreds);\n    }\n    return fileCreds;\n  }\n\n  return null;\n}\n\nexport function saveCredentials(creds: Credentials): void {\n  if (forceInsecureStorage) return writeToFile(creds);\n\n  if (!writeToKeyring(creds)) {\n    showFallbackWarning();\n    writeToFile(creds);\n  }\n}\n\nexport function clearCredentials(): void {\n  deleteFromKeyring();\n  deleteFile();\n  migrationAttempted = false;\n}\n\nexport function updateTokens(accessToken: string, expiresAt: number, refreshToken?: string): void {\n  const creds = getCredentials();\n  if (!creds) {\n    throw new Error('No existing credentials to update');\n  }\n\n  const updated: Credentials = {\n    ...creds,\n    accessToken,\n    expiresAt,\n    ...(refreshToken && { refreshToken }),\n  };\n\n  saveCredentials(updated);\n}\n\n/**\n * Diagnostic info about credential storage state — for debugging auth failures.\n */\nexport function diagnoseCredentials(): string[] {\n  const lines: string[] = [];\n  const filePath = getCredentialsPath();\n  const filePresent = fileExists();\n\n  lines.push(`file: ${filePath} (exists=${filePresent})`);\n\n  if (filePresent) {\n    try {\n      const content = fs.readFileSync(filePath, 'utf-8');\n      const parsed = JSON.parse(content) as Partial<Credentials>;\n      const expired = parsed.expiresAt ? Date.now() >= parsed.expiresAt : 'unknown';\n      lines.push(\n        `file creds: userId=${parsed.userId ?? 'missing'}, expired=${expired}, hasRefreshToken=${!!parsed.refreshToken}`,\n      );\n    } catch (e) {\n      lines.push(`file creds: parse error — ${e instanceof Error ? e.message : String(e)}`);\n    }\n  }\n\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (data) {\n      const parsed = JSON.parse(data) as Partial<Credentials>;\n      const expired = parsed.expiresAt ? Date.now() >= parsed.expiresAt : 'unknown';\n      lines.push(\n        `keyring: found, userId=${parsed.userId ?? 'missing'}, expired=${expired}, hasRefreshToken=${!!parsed.refreshToken}`,\n      );\n    } else {\n      lines.push('keyring: empty (getPassword returned null)');\n    }\n  } catch (e) {\n    lines.push(`keyring: error — ${e instanceof Error ? e.message : String(e)}`);\n  }\n\n  lines.push(`insecureStorage=${forceInsecureStorage}`);\n  return lines;\n}\n\nexport { getCredentialsPath };\n"]}

package/dist/lib/credentials.d.ts

@@ -1,13 +0,0 @@
-export type { StagingCache, Credentials } from './credential-store.js';
-export { hasCredentials, getCredentials, saveCredentials, clearCredentials, updateTokens, getCredentialsPath, setInsecureStorage, diagnoseCredentials, } from './credential-store.js';
-import type { Credentials } from './credential-store.js';
-export declare function isTokenExpired(creds: Credentials): boolean;
-export declare function getAccessToken(): string | null;
-export declare function saveStagingCredentials(staging: {
-    clientId: string;
-    apiKey: string;
-}): void;
-export declare function getStagingCredentials(): {
-    clientId: string;
-    apiKey: string;
-} | null;

package/dist/lib/credentials.js

@@ -1,34 +0,0 @@
-export { hasCredentials, getCredentials, saveCredentials, clearCredentials, updateTokens, getCredentialsPath, setInsecureStorage, diagnoseCredentials, } from './credential-store.js';
-import { getCredentials, saveCredentials } from './credential-store.js';
-export function isTokenExpired(creds) {
-    return Date.now() >= creds.expiresAt;
-}
-export function getAccessToken() {
-    const creds = getCredentials();
-    if (!creds)
-        return null;
-    if (isTokenExpired(creds))
-        return null;
-    return creds.accessToken;
-}
-export function saveStagingCredentials(staging) {
-    const creds = getCredentials();
-    if (!creds)
-        return;
-    saveCredentials({
-        ...creds,
-        staging: {
-            ...staging,
-            fetchedAt: Date.now(),
-        },
-    });
-}
-export function getStagingCredentials() {
-    const creds = getCredentials();
-    if (!creds?.staging)
-        return null;
-    if (isTokenExpired(creds))
-        return null;
-    return { clientId: creds.staging.clientId, apiKey: creds.staging.apiKey };
-}
-//# sourceMappingURL=credentials.js.map

package/dist/lib/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/lib/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExE,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA6C;IAClF,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,eAAe,CAAC;QACd,GAAG,KAAK;QACR,OAAO,EAAE;YACP,GAAG,OAAO;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["export type { StagingCache, Credentials } from './credential-store.js';\n\nexport {\n  hasCredentials,\n  getCredentials,\n  saveCredentials,\n  clearCredentials,\n  updateTokens,\n  getCredentialsPath,\n  setInsecureStorage,\n  diagnoseCredentials,\n} from './credential-store.js';\n\nimport type { Credentials } from './credential-store.js';\nimport { getCredentials, saveCredentials } from './credential-store.js';\n\nexport function isTokenExpired(creds: Credentials): boolean {\n  return Date.now() >= creds.expiresAt;\n}\n\nexport function getAccessToken(): string | null {\n  const creds = getCredentials();\n  if (!creds) return null;\n  if (isTokenExpired(creds)) return null;\n  return creds.accessToken;\n}\n\nexport function saveStagingCredentials(staging: { clientId: string; apiKey: string }): void {\n  const creds = getCredentials();\n  if (!creds) return;\n\n  saveCredentials({\n    ...creds,\n    staging: {\n      ...staging,\n      fetchedAt: Date.now(),\n    },\n  });\n}\n\nexport function getStagingCredentials(): { clientId: string; apiKey: string } | null {\n  const creds = getCredentials();\n  if (!creds?.staging) return null;\n  if (isTokenExpired(creds)) return null;\n  return { clientId: creds.staging.clientId, apiKey: creds.staging.apiKey };\n}\n"]}

package/dist/lib/dev-command.d.ts

@@ -1,26 +0,0 @@
-export interface DevCommandResult {
-    command: string;
-    args: string[];
-    framework: string | null;
-}
-interface PackageJson {
-    scripts?: Record<string, string>;
-    dependencies?: Record<string, string>;
-    devDependencies?: Record<string, string>;
-}
-declare function readPackageJson(projectDir: string): PackageJson | null;
-/**
- * Resolve the dev command for a project directory.
- *
- * Priority:
- * 1. `scripts.dev` from package.json (developer's config is authoritative)
- * 2. Framework-specific default based on dependency detection
- * 3. Non-JS framework detection (Django, Rails, Go)
- * 4. Error — no dev command could be resolved
- */
-export declare function resolveDevCommand(projectDir: string): Promise<DevCommandResult>;
-/**
- * Detect the package manager used in the project.
- */
-declare function detectPackageManager(projectDir: string): string;
-export { readPackageJson as _readPackageJson, detectPackageManager as _detectPackageManager };

package/dist/lib/dev-command.js

@@ -1,129 +0,0 @@
-import { readFileSync, existsSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { IS_WINDOWS } from '../utils/platform.js';
-/**
- * Framework-to-dev-command mapping. Checked in order after package.json detection.
- * Each entry maps a dependency name to a framework display name and default dev command.
- */
-const FRAMEWORK_DEV_COMMANDS = [
-    { dep: 'next', framework: 'Next.js', command: 'next', args: ['dev'] },
-    { dep: '@remix-run/dev', framework: 'Remix', command: 'remix', args: ['dev'] },
-    { dep: 'react-router', framework: 'React Router', command: 'react-router', args: ['dev'] },
-    { dep: '@tanstack/react-start', framework: 'TanStack Start', command: 'vinxi', args: ['dev'] },
-    { dep: '@sveltejs/kit', framework: 'SvelteKit', command: 'vite', args: ['dev'] },
-    { dep: 'vite', framework: 'Vite', command: 'vite', args: ['dev'] },
-    { dep: 'nuxt', framework: 'Nuxt', command: 'nuxt', args: ['dev'] },
-    { dep: 'express', framework: 'Express', command: 'node', args: ['index.js'] },
-];
-/**
- * Non-JS framework detection: checks for well-known files in the project directory.
- */
-const NON_JS_FRAMEWORKS = [
-    { file: 'manage.py', framework: 'Django', command: 'python', args: ['manage.py', 'runserver'] },
-    { file: 'Gemfile', framework: 'Rails', command: 'rails', args: ['server'] },
-    { file: 'go.mod', framework: 'Go', command: 'go', args: ['run', '.'] },
-];
-function readPackageJson(projectDir) {
-    const pkgPath = resolve(projectDir, 'package.json');
-    if (!existsSync(pkgPath))
-        return null;
-    try {
-        return JSON.parse(readFileSync(pkgPath, 'utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
-function hasDependency(pkg, dep) {
-    return !!(pkg.dependencies?.[dep] || pkg.devDependencies?.[dep]);
-}
-/**
- * Resolve the npx-style command for a given binary.
- * Returns the binary path under node_modules/.bin if it exists,
- * otherwise returns the bare command name (assumes it's globally available).
- */
-function resolveNodeBin(projectDir, command) {
-    const binDir = join(projectDir, 'node_modules', '.bin');
-    if (IS_WINDOWS) {
-        const cmdPath = join(binDir, `${command}.cmd`);
-        if (existsSync(cmdPath))
-            return cmdPath;
-    }
-    const binPath = join(binDir, command);
-    if (existsSync(binPath))
-        return binPath;
-    return command;
-}
-/**
- * Resolve the dev command for a project directory.
- *
- * Priority:
- * 1. `scripts.dev` from package.json (developer's config is authoritative)
- * 2. Framework-specific default based on dependency detection
- * 3. Non-JS framework detection (Django, Rails, Go)
- * 4. Error — no dev command could be resolved
- */
-export async function resolveDevCommand(projectDir) {
-    const pkg = readPackageJson(projectDir);
-    if (pkg) {
-        // Detect framework from dependencies first (for display purposes)
-        let detectedFramework = null;
-        for (const entry of FRAMEWORK_DEV_COMMANDS) {
-            if (hasDependency(pkg, entry.dep)) {
-                detectedFramework = entry.framework;
-                break;
-            }
-        }
-        // Priority 1: scripts.dev from package.json
-        if (pkg.scripts?.dev) {
-            // Use the package manager's run command to execute scripts.dev
-            const packageManager = detectPackageManager(projectDir);
-            return {
-                command: packageManager,
-                args: ['run', 'dev'],
-                framework: detectedFramework,
-            };
-        }
-        // Priority 2: Framework-specific default
-        for (const entry of FRAMEWORK_DEV_COMMANDS) {
-            if (hasDependency(pkg, entry.dep)) {
-                return {
-                    command: resolveNodeBin(projectDir, entry.command),
-                    args: entry.args,
-                    framework: entry.framework,
-                };
-            }
-        }
-    }
-    // Priority 3: Non-JS frameworks
-    for (const entry of NON_JS_FRAMEWORKS) {
-        if (existsSync(resolve(projectDir, entry.file))) {
-            return {
-                command: entry.command,
-                args: entry.args,
-                framework: entry.framework,
-            };
-        }
-    }
-    // No framework or scripts.dev found
-    return {
-        command: 'npm',
-        args: ['run', 'dev'],
-        framework: null,
-    };
-}
-/**
- * Detect the package manager used in the project.
- */
-function detectPackageManager(projectDir) {
-    if (existsSync(resolve(projectDir, 'pnpm-lock.yaml')))
-        return 'pnpm';
-    if (existsSync(resolve(projectDir, 'yarn.lock')))
-        return 'yarn';
-    if (existsSync(resolve(projectDir, 'bun.lockb')) || existsSync(resolve(projectDir, 'bun.lock')))
-        return 'bun';
-    return 'npm';
-}
-// Export for testing
-export { readPackageJson as _readPackageJson, detectPackageManager as _detectPackageManager };
-//# sourceMappingURL=dev-command.js.map

package/dist/lib/dev-command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-command.js","sourceRoot":"","sources":["../../src/lib/dev-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAclD;;;GAGG;AACH,MAAM,sBAAsB,GAKvB;IACH,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IACrE,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC9E,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC1F,EAAE,GAAG,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAC9F,EAAE,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAChF,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAClE,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;IAClE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE;CAC9E,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAKlB;IACH,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;IAC/F,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC3E,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;CACvE,CAAC;AAEF,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAgB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,GAAW;IAClD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,UAAkB,EAAE,OAAe;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,GAAG,EAAE,CAAC;QACR,kEAAkE;QAClE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;YAC3C,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YACrB,+DAA+D;YAC/D,MAAM,cAAc,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;gBACpB,SAAS,EAAE,iBAAiB;aAC7B,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;YAC3C,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;oBAClD,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QACpB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACrE,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAChE,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qBAAqB;AACrB,OAAO,EAAE,eAAe,IAAI,gBAAgB,EAAE,oBAAoB,IAAI,qBAAqB,EAAE,CAAC","sourcesContent":["import { readFileSync, existsSync } from 'node:fs';\nimport { resolve, join } from 'node:path';\nimport { IS_WINDOWS } from '../utils/platform.js';\n\nexport interface DevCommandResult {\n  command: string;\n  args: string[];\n  framework: string | null;\n}\n\ninterface PackageJson {\n  scripts?: Record<string, string>;\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n}\n\n/**\n * Framework-to-dev-command mapping. Checked in order after package.json detection.\n * Each entry maps a dependency name to a framework display name and default dev command.\n */\nconst FRAMEWORK_DEV_COMMANDS: Array<{\n  dep: string;\n  framework: string;\n  command: string;\n  args: string[];\n}> = [\n  { dep: 'next', framework: 'Next.js', command: 'next', args: ['dev'] },\n  { dep: '@remix-run/dev', framework: 'Remix', command: 'remix', args: ['dev'] },\n  { dep: 'react-router', framework: 'React Router', command: 'react-router', args: ['dev'] },\n  { dep: '@tanstack/react-start', framework: 'TanStack Start', command: 'vinxi', args: ['dev'] },\n  { dep: '@sveltejs/kit', framework: 'SvelteKit', command: 'vite', args: ['dev'] },\n  { dep: 'vite', framework: 'Vite', command: 'vite', args: ['dev'] },\n  { dep: 'nuxt', framework: 'Nuxt', command: 'nuxt', args: ['dev'] },\n  { dep: 'express', framework: 'Express', command: 'node', args: ['index.js'] },\n];\n\n/**\n * Non-JS framework detection: checks for well-known files in the project directory.\n */\nconst NON_JS_FRAMEWORKS: Array<{\n  file: string;\n  framework: string;\n  command: string;\n  args: string[];\n}> = [\n  { file: 'manage.py', framework: 'Django', command: 'python', args: ['manage.py', 'runserver'] },\n  { file: 'Gemfile', framework: 'Rails', command: 'rails', args: ['server'] },\n  { file: 'go.mod', framework: 'Go', command: 'go', args: ['run', '.'] },\n];\n\nfunction readPackageJson(projectDir: string): PackageJson | null {\n  const pkgPath = resolve(projectDir, 'package.json');\n  if (!existsSync(pkgPath)) return null;\n  try {\n    return JSON.parse(readFileSync(pkgPath, 'utf-8')) as PackageJson;\n  } catch {\n    return null;\n  }\n}\n\nfunction hasDependency(pkg: PackageJson, dep: string): boolean {\n  return !!(pkg.dependencies?.[dep] || pkg.devDependencies?.[dep]);\n}\n\n/**\n * Resolve the npx-style command for a given binary.\n * Returns the binary path under node_modules/.bin if it exists,\n * otherwise returns the bare command name (assumes it's globally available).\n */\nfunction resolveNodeBin(projectDir: string, command: string): string {\n  const binDir = join(projectDir, 'node_modules', '.bin');\n  if (IS_WINDOWS) {\n    const cmdPath = join(binDir, `${command}.cmd`);\n    if (existsSync(cmdPath)) return cmdPath;\n  }\n  const binPath = join(binDir, command);\n  if (existsSync(binPath)) return binPath;\n  return command;\n}\n\n/**\n * Resolve the dev command for a project directory.\n *\n * Priority:\n * 1. `scripts.dev` from package.json (developer's config is authoritative)\n * 2. Framework-specific default based on dependency detection\n * 3. Non-JS framework detection (Django, Rails, Go)\n * 4. Error — no dev command could be resolved\n */\nexport async function resolveDevCommand(projectDir: string): Promise<DevCommandResult> {\n  const pkg = readPackageJson(projectDir);\n\n  if (pkg) {\n    // Detect framework from dependencies first (for display purposes)\n    let detectedFramework: string | null = null;\n    for (const entry of FRAMEWORK_DEV_COMMANDS) {\n      if (hasDependency(pkg, entry.dep)) {\n        detectedFramework = entry.framework;\n        break;\n      }\n    }\n\n    // Priority 1: scripts.dev from package.json\n    if (pkg.scripts?.dev) {\n      // Use the package manager's run command to execute scripts.dev\n      const packageManager = detectPackageManager(projectDir);\n      return {\n        command: packageManager,\n        args: ['run', 'dev'],\n        framework: detectedFramework,\n      };\n    }\n\n    // Priority 2: Framework-specific default\n    for (const entry of FRAMEWORK_DEV_COMMANDS) {\n      if (hasDependency(pkg, entry.dep)) {\n        return {\n          command: resolveNodeBin(projectDir, entry.command),\n          args: entry.args,\n          framework: entry.framework,\n        };\n      }\n    }\n  }\n\n  // Priority 3: Non-JS frameworks\n  for (const entry of NON_JS_FRAMEWORKS) {\n    if (existsSync(resolve(projectDir, entry.file))) {\n      return {\n        command: entry.command,\n        args: entry.args,\n        framework: entry.framework,\n      };\n    }\n  }\n\n  // No framework or scripts.dev found\n  return {\n    command: 'npm',\n    args: ['run', 'dev'],\n    framework: null,\n  };\n}\n\n/**\n * Detect the package manager used in the project.\n */\nfunction detectPackageManager(projectDir: string): string {\n  if (existsSync(resolve(projectDir, 'pnpm-lock.yaml'))) return 'pnpm';\n  if (existsSync(resolve(projectDir, 'yarn.lock'))) return 'yarn';\n  if (existsSync(resolve(projectDir, 'bun.lockb')) || existsSync(resolve(projectDir, 'bun.lock'))) return 'bun';\n  return 'npm';\n}\n\n// Export for testing\nexport { readPackageJson as _readPackageJson, detectPackageManager as _detectPackageManager };\n"]}

package/dist/lib/device-auth.d.ts

@@ -1,48 +0,0 @@
-/**
- * Device Authorization Flow
- *
- * Implements OAuth 2.0 Device Authorization Grant (RFC 8628) for CLI authentication.
- * Extracted from login.ts for reuse in wizard credential gathering.
- */
-export interface DeviceAuthResponse {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-    expires_in: number;
-    interval: number;
-}
-export interface DeviceAuthOptions {
-    clientId: string;
-    authkitDomain: string;
-    scopes?: string[];
-    timeoutMs?: number;
-    onPoll?: () => void;
-    onSlowDown?: (newIntervalMs: number) => void;
-}
-export interface DeviceAuthResult {
-    accessToken: string;
-    idToken: string;
-    expiresAt: number;
-    userId: string;
-    email?: string;
-    refreshToken?: string;
-}
-export declare class DeviceAuthError extends Error {
-    constructor(message: string);
-}
-export declare class DeviceAuthTimeoutError extends DeviceAuthError {
-    constructor(message: string);
-}
-/**
- * Request a device code from the OAuth authorization server.
- * Returns the device code, user code, and verification URIs.
- */
-export declare function requestDeviceCode(options: DeviceAuthOptions): Promise<DeviceAuthResponse>;
-/**
- * Poll for token after user has authorized in the browser.
- * Handles authorization_pending and slow_down responses per RFC 8628.
- */
-export declare function pollForToken(deviceCode: string, options: DeviceAuthOptions & {
-    interval: number;
-}): Promise<DeviceAuthResult>;