workos 0.19.0 → 0.20.2

package/dist/lib/device-auth.js

@@ -1,176 +0,0 @@
-/**
- * Device Authorization Flow
- *
- * Implements OAuth 2.0 Device Authorization Grant (RFC 8628) for CLI authentication.
- * Extracted from login.ts for reuse in wizard credential gathering.
- */
-import { logInfo, logError } from '../utils/debug.js';
-export class DeviceAuthError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'DeviceAuthError';
-    }
-}
-export class DeviceAuthTimeoutError extends DeviceAuthError {
-    constructor(message) {
-        super(message);
-        this.name = 'DeviceAuthTimeoutError';
-    }
-}
-const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
-const DEFAULT_POLL_INTERVAL_SECONDS = 5;
-const POLL_REQUEST_TIMEOUT_MS = 30_000;
-const DEFAULT_SCOPES = ['openid', 'email', 'staging-environment:credentials:read', 'offline_access'];
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/**
- * Parse JWT payload
- */
-function parseJwt(token) {
-    try {
-        const parts = token.split('.');
-        if (parts.length !== 3)
-            return null;
-        return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Extract expiry time from JWT token
- */
-function getJwtExpiry(token) {
-    const payload = parseJwt(token);
-    if (!payload || typeof payload.exp !== 'number')
-        return null;
-    return payload.exp * 1000;
-}
-/**
- * Request a device code from the OAuth authorization server.
- * Returns the device code, user code, and verification URIs.
- */
-export async function requestDeviceCode(options) {
-    const scopes = options.scopes ?? DEFAULT_SCOPES;
-    const url = `${options.authkitDomain}/oauth2/device_authorization`;
-    logInfo('[device-auth] Requesting device code from:', url);
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), POLL_REQUEST_TIMEOUT_MS);
-    let res;
-    try {
-        res = await fetch(url, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                client_id: options.clientId,
-                scope: scopes.join(' '),
-            }),
-            signal: controller.signal,
-        });
-    }
-    catch (error) {
-        clearTimeout(timeout);
-        if (error instanceof DOMException && error.name === 'AbortError') {
-            throw new DeviceAuthTimeoutError('Device authorization request timed out');
-        }
-        throw new DeviceAuthError(`Device authorization request failed: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-    logInfo('[device-auth] Device code response status:', res.status);
-    if (!res.ok) {
-        const text = await res.text();
-        logError('[device-auth] Device authorization failed:', res.status, text);
-        throw new DeviceAuthError(`Device authorization failed: ${res.status} ${text}`);
-    }
-    const data = (await res.json());
-    logInfo('[device-auth] Device code received, user_code:', data.user_code);
-    return data;
-}
-/**
- * Poll for token after user has authorized in the browser.
- * Handles authorization_pending and slow_down responses per RFC 8628.
- */
-export async function pollForToken(deviceCode, options) {
-    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const startTime = Date.now();
-    let pollInterval = (options.interval || DEFAULT_POLL_INTERVAL_SECONDS) * 1000;
-    const tokenUrl = `${options.authkitDomain}/oauth2/token`;
-    let pollCount = 0;
-    let lastPollSummary = 'no token response received';
-    logInfo('[device-auth] Starting token polling, timeout:', timeoutMs);
-    while (Date.now() - startTime < timeoutMs) {
-        await sleep(pollInterval);
-        pollCount++;
-        options.onPoll?.();
-        let res;
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), POLL_REQUEST_TIMEOUT_MS);
-        try {
-            res = await fetch(tokenUrl, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: new URLSearchParams({
-                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-                    device_code: deviceCode,
-                    client_id: options.clientId,
-                }),
-                signal: controller.signal,
-            });
-        }
-        catch (error) {
-            logInfo('[device-auth] Token poll network error, retrying:', error instanceof Error ? error.message : String(error));
-            continue;
-        }
-        finally {
-            clearTimeout(timeout);
-        }
-        let data;
-        try {
-            data = await res.json();
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            logError('[device-auth] Invalid JSON response from auth server:', message);
-            throw new DeviceAuthError(`Invalid response from auth server: ${message}`);
-        }
-        const errorData = data;
-        const elapsedMs = Date.now() - startTime;
-        lastPollSummary = res.ok
-            ? `${res.status} success`
-            : `${res.status} ${errorData.error ?? 'unknown_error'}${errorData.error_description ? ` (${errorData.error_description})` : ''}`;
-        logInfo('[device-auth] Token poll response:', `attempt=${pollCount}`, `elapsedMs=${elapsedMs}`, lastPollSummary);
-        if (res.ok) {
-            logInfo('[device-auth] Token received successfully');
-            return parseTokenResponse(data);
-        }
-        if (errorData.error === 'authorization_pending') {
-            continue;
-        }
-        if (errorData.error === 'slow_down') {
-            pollInterval += 5000;
-            logInfo('[device-auth] Slowing down, new interval:', pollInterval);
-            options.onSlowDown?.(pollInterval);
-            continue;
-        }
-        logError('[device-auth] Token error:', errorData.error);
-        throw new DeviceAuthError(`Token error: ${errorData.error}`);
-    }
-    logError('[device-auth] Authentication timed out, last poll:', lastPollSummary);
-    throw new DeviceAuthTimeoutError(`Authentication timed out after ${Math.round(timeoutMs / 1000)} seconds (last token response: ${lastPollSummary})`);
-}
-function parseTokenResponse(data) {
-    const idPayload = parseJwt(data.id_token);
-    const jwtExpiry = getJwtExpiry(data.access_token);
-    return {
-        accessToken: data.access_token,
-        idToken: data.id_token,
-        expiresAt: jwtExpiry ?? (data.expires_in ? Date.now() + data.expires_in * 1000 : Date.now() + 15 * 60 * 1000),
-        userId: String(idPayload?.sub ?? 'unknown'),
-        email: idPayload?.email,
-        refreshToken: data.refresh_token,
-    };
-}
-//# sourceMappingURL=device-auth.js.map

package/dist/lib/device-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../src/lib/device-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AA0CtD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IACzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACtD,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE,gBAAgB,CAAC,CAAC;AAErG,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA0B;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,aAAa,8BAA8B,CAAC;IAEnE,OAAO,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAC9E,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjE,MAAM,IAAI,sBAAsB,CAAC,wCAAwC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjG,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,4CAA4C,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,4CAA4C,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,IAAI,eAAe,CAAC,gCAAgC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;IACtD,OAAO,CAAC,gDAAgD,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,OAAiD;IAEjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,YAAY,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,6BAA6B,CAAC,GAAG,IAAI,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,aAAa,eAAe,CAAC;IACzD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,eAAe,GAAG,4BAA4B,CAAC;IAEnD,OAAO,CAAC,gDAAgD,EAAE,SAAS,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAEnB,IAAI,GAAa,CAAC;QAClB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBAC1B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU;oBACvB,SAAS,EAAE,OAAO,CAAC,QAAQ;iBAC5B,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CACL,mDAAmD,EACnD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACF,SAAS;QACX,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,uDAAuD,EAAE,OAAO,CAAC,CAAC;YAC3E,MAAM,IAAI,eAAe,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,GAAG,IAAyB,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACzC,eAAe,GAAG,GAAG,CAAC,EAAE;YACtB,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,UAAU;YACzB,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,IAAI,eAAe,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACnI,OAAO,CAAC,oCAAoC,EAAE,WAAW,SAAS,EAAE,EAAE,aAAa,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;QACjH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,CAAC,2CAA2C,CAAC,CAAC;YACrD,OAAO,kBAAkB,CAAC,IAAqB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,SAAS,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACpC,YAAY,IAAI,IAAI,CAAC;YACrB,OAAO,CAAC,2CAA2C,EAAE,YAAY,CAAC,CAAC;YACnE,OAAO,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,4BAA4B,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,IAAI,eAAe,CAAC,gBAAgB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,QAAQ,CAAC,oDAAoD,EAAE,eAAe,CAAC,CAAC;IAChF,MAAM,IAAI,sBAAsB,CAC9B,kCAAkC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,kCAAkC,eAAe,GAAG,CACnH,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAmB;IAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAElD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,SAAS,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC7G,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC;QAC3C,KAAK,EAAE,SAAS,EAAE,KAA2B;QAC7C,YAAY,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Device Authorization Flow\n *\n * Implements OAuth 2.0 Device Authorization Grant (RFC 8628) for CLI authentication.\n * Extracted from login.ts for reuse in wizard credential gathering.\n */\n\nimport { logInfo, logError } from '../utils/debug.js';\n\nexport interface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete: string;\n  expires_in: number;\n  interval: number;\n}\n\nexport interface DeviceAuthOptions {\n  clientId: string;\n  authkitDomain: string;\n  scopes?: string[];\n  timeoutMs?: number;\n  onPoll?: () => void;\n  onSlowDown?: (newIntervalMs: number) => void;\n}\n\nexport interface DeviceAuthResult {\n  accessToken: string;\n  idToken: string;\n  expiresAt: number;\n  userId: string;\n  email?: string;\n  refreshToken?: string;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  id_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token?: string;\n}\n\ninterface AuthErrorResponse {\n  error: string;\n  error_description?: string;\n}\n\nexport class DeviceAuthError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'DeviceAuthError';\n  }\n}\n\nexport class DeviceAuthTimeoutError extends DeviceAuthError {\n  constructor(message: string) {\n    super(message);\n    this.name = 'DeviceAuthTimeoutError';\n  }\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes\nconst DEFAULT_POLL_INTERVAL_SECONDS = 5;\nconst POLL_REQUEST_TIMEOUT_MS = 30_000;\nconst DEFAULT_SCOPES = ['openid', 'email', 'staging-environment:credentials:read', 'offline_access'];\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Parse JWT payload\n */\nfunction parseJwt(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Extract expiry time from JWT token\n */\nfunction getJwtExpiry(token: string): number | null {\n  const payload = parseJwt(token);\n  if (!payload || typeof payload.exp !== 'number') return null;\n  return payload.exp * 1000;\n}\n\n/**\n * Request a device code from the OAuth authorization server.\n * Returns the device code, user code, and verification URIs.\n */\nexport async function requestDeviceCode(options: DeviceAuthOptions): Promise<DeviceAuthResponse> {\n  const scopes = options.scopes ?? DEFAULT_SCOPES;\n  const url = `${options.authkitDomain}/oauth2/device_authorization`;\n\n  logInfo('[device-auth] Requesting device code from:', url);\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), POLL_REQUEST_TIMEOUT_MS);\n  let res: Response;\n  try {\n    res = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: options.clientId,\n        scope: scopes.join(' '),\n      }),\n      signal: controller.signal,\n    });\n  } catch (error) {\n    clearTimeout(timeout);\n    if (error instanceof DOMException && error.name === 'AbortError') {\n      throw new DeviceAuthTimeoutError('Device authorization request timed out');\n    }\n    throw new DeviceAuthError(\n      `Device authorization request failed: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  } finally {\n    clearTimeout(timeout);\n  }\n\n  logInfo('[device-auth] Device code response status:', res.status);\n  if (!res.ok) {\n    const text = await res.text();\n    logError('[device-auth] Device authorization failed:', res.status, text);\n    throw new DeviceAuthError(`Device authorization failed: ${res.status} ${text}`);\n  }\n\n  const data = (await res.json()) as DeviceAuthResponse;\n  logInfo('[device-auth] Device code received, user_code:', data.user_code);\n  return data;\n}\n\n/**\n * Poll for token after user has authorized in the browser.\n * Handles authorization_pending and slow_down responses per RFC 8628.\n */\nexport async function pollForToken(\n  deviceCode: string,\n  options: DeviceAuthOptions & { interval: number },\n): Promise<DeviceAuthResult> {\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const startTime = Date.now();\n  let pollInterval = (options.interval || DEFAULT_POLL_INTERVAL_SECONDS) * 1000;\n  const tokenUrl = `${options.authkitDomain}/oauth2/token`;\n  let pollCount = 0;\n  let lastPollSummary = 'no token response received';\n\n  logInfo('[device-auth] Starting token polling, timeout:', timeoutMs);\n  while (Date.now() - startTime < timeoutMs) {\n    await sleep(pollInterval);\n    pollCount++;\n    options.onPoll?.();\n\n    let res: Response;\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), POLL_REQUEST_TIMEOUT_MS);\n    try {\n      res = await fetch(tokenUrl, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n          device_code: deviceCode,\n          client_id: options.clientId,\n        }),\n        signal: controller.signal,\n      });\n    } catch (error) {\n      logInfo(\n        '[device-auth] Token poll network error, retrying:',\n        error instanceof Error ? error.message : String(error),\n      );\n      continue;\n    } finally {\n      clearTimeout(timeout);\n    }\n\n    let data;\n    try {\n      data = await res.json();\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      logError('[device-auth] Invalid JSON response from auth server:', message);\n      throw new DeviceAuthError(`Invalid response from auth server: ${message}`);\n    }\n\n    const errorData = data as AuthErrorResponse;\n    const elapsedMs = Date.now() - startTime;\n    lastPollSummary = res.ok\n      ? `${res.status} success`\n      : `${res.status} ${errorData.error ?? 'unknown_error'}${errorData.error_description ? ` (${errorData.error_description})` : ''}`;\n    logInfo('[device-auth] Token poll response:', `attempt=${pollCount}`, `elapsedMs=${elapsedMs}`, lastPollSummary);\n    if (res.ok) {\n      logInfo('[device-auth] Token received successfully');\n      return parseTokenResponse(data as TokenResponse);\n    }\n\n    if (errorData.error === 'authorization_pending') {\n      continue;\n    }\n\n    if (errorData.error === 'slow_down') {\n      pollInterval += 5000;\n      logInfo('[device-auth] Slowing down, new interval:', pollInterval);\n      options.onSlowDown?.(pollInterval);\n      continue;\n    }\n\n    logError('[device-auth] Token error:', errorData.error);\n    throw new DeviceAuthError(`Token error: ${errorData.error}`);\n  }\n\n  logError('[device-auth] Authentication timed out, last poll:', lastPollSummary);\n  throw new DeviceAuthTimeoutError(\n    `Authentication timed out after ${Math.round(timeoutMs / 1000)} seconds (last token response: ${lastPollSummary})`,\n  );\n}\n\nfunction parseTokenResponse(data: TokenResponse): DeviceAuthResult {\n  const idPayload = parseJwt(data.id_token);\n  const jwtExpiry = getJwtExpiry(data.access_token);\n\n  return {\n    accessToken: data.access_token,\n    idToken: data.id_token,\n    expiresAt: jwtExpiry ?? (data.expires_in ? Date.now() + data.expires_in * 1000 : Date.now() + 15 * 60 * 1000),\n    userId: String(idPayload?.sub ?? 'unknown'),\n    email: idPayload?.email as string | undefined,\n    refreshToken: data.refresh_token,\n  };\n}\n"]}

package/dist/lib/device-id.d.ts

@@ -1,25 +0,0 @@
-/**
- * Persistent device identifier for telemetry correlation.
- *
- * Stored at ~/.workos/device-id as a plain UTF-8 UUID string. Not a secret
- * — this is a convenience identifier that survives keyring unavailability.
- * Any IO failure falls through to a one-shot UUID for the current session.
- */
-/**
- * Asynchronously resolve (and lazily create) the device id without blocking
- * the event loop. Memoized: the first call performs the IO, concurrent and
- * later callers await the same promise. Populates the shared cache that the
- * synchronous getDeviceId() reads, so prewarming this at startup keeps the
- * synchronous telemetry path off blocking fs IO. Never rejects.
- */
-export declare function loadDeviceId(): Promise<string>;
-/**
- * Synchronous accessor for the telemetry event path. Returns the prewarmed
- * value when loadDeviceId() has run; otherwise falls back to a one-time
- * synchronous read of the same file (returning the persisted id, so the value
- * never diverges from the async path). On any IO failure, returns a one-shot
- * UUID scoped to the current process — never throws.
- */
-export declare function getDeviceId(): string;
-/** Test seam — resets the in-memory cache between test cases. */
-export declare function __resetDeviceIdCache(): void;

package/dist/lib/device-id.js

@@ -1,102 +0,0 @@
-/**
- * Persistent device identifier for telemetry correlation.
- *
- * Stored at ~/.workos/device-id as a plain UTF-8 UUID string. Not a secret
- * — this is a convenience identifier that survives keyring unavailability.
- * Any IO failure falls through to a one-shot UUID for the current session.
- */
-import fs from 'node:fs';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import os from 'node:os';
-import crypto from 'node:crypto';
-// RFC 4122 v4 format — matches what `crypto.randomUUID()` produces.
-// Rejects non-UUID strings like "------------------------------------".
-const UUID_V4_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-let cached;
-let pending;
-function getDeviceIdPath() {
-    return path.join(os.homedir(), '.workos', 'device-id');
-}
-/**
- * Asynchronously resolve (and lazily create) the device id without blocking
- * the event loop. Memoized: the first call performs the IO, concurrent and
- * later callers await the same promise. Populates the shared cache that the
- * synchronous getDeviceId() reads, so prewarming this at startup keeps the
- * synchronous telemetry path off blocking fs IO. Never rejects.
- */
-export function loadDeviceId() {
-    if (cached)
-        return Promise.resolve(cached);
-    if (pending)
-        return pending;
-    pending = (async () => {
-        const filePath = getDeviceIdPath();
-        try {
-            try {
-                const raw = (await readFile(filePath, 'utf8')).trim();
-                if (UUID_V4_REGEX.test(raw)) {
-                    cached = raw;
-                    return raw;
-                }
-            }
-            catch {
-                // Missing/unreadable file — fall through and create it.
-            }
-            const id = crypto.randomUUID();
-            await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
-            await writeFile(filePath, id, { encoding: 'utf8', mode: 0o600 });
-            cached = id;
-            return id;
-        }
-        catch {
-            // IO failure (readonly FS, permission denied, etc.) — fall through to
-            // a session-scoped UUID, cached for the rest of this process.
-            cached = crypto.randomUUID();
-            return cached;
-        }
-        finally {
-            pending = undefined;
-        }
-    })();
-    return pending;
-}
-/**
- * Synchronous accessor for the telemetry event path. Returns the prewarmed
- * value when loadDeviceId() has run; otherwise falls back to a one-time
- * synchronous read of the same file (returning the persisted id, so the value
- * never diverges from the async path). On any IO failure, returns a one-shot
- * UUID scoped to the current process — never throws.
- */
-export function getDeviceId() {
-    if (cached)
-        return cached;
-    const filePath = getDeviceIdPath();
-    try {
-        if (fs.existsSync(filePath)) {
-            const raw = fs.readFileSync(filePath, 'utf8').trim();
-            if (UUID_V4_REGEX.test(raw)) {
-                cached = raw;
-                return raw;
-            }
-        }
-        const id = crypto.randomUUID();
-        fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
-        fs.writeFileSync(filePath, id, { encoding: 'utf8', mode: 0o600 });
-        cached = id;
-        return id;
-    }
-    catch {
-        // IO failure (readonly FS, permission denied, etc.) — fall through to
-        // a session-scoped UUID. Cache it so subsequent calls in this process
-        // return the same value; the next process run will retry IO.
-        cached = crypto.randomUUID();
-        return cached;
-    }
-}
-/** Test seam — resets the in-memory cache between test cases. */
-export function __resetDeviceIdCache() {
-    cached = undefined;
-    pending = undefined;
-}
-//# sourceMappingURL=device-id.js.map

package/dist/lib/device-id.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"device-id.js","sourceRoot":"","sources":["../../src/lib/device-id.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,oEAAoE;AACpE,wEAAwE;AACxE,MAAM,aAAa,GAAG,wEAAwE,CAAC;AAE/F,IAAI,MAA0B,CAAC;AAC/B,IAAI,OAAoC,CAAC;AAEzC,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,CAAC;oBACb,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YAED,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,MAAM,GAAG,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW;IACzB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACrD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,CAAC;gBACb,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,GAAG,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,SAAS,CAAC;IACnB,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC","sourcesContent":["/**\n * Persistent device identifier for telemetry correlation.\n *\n * Stored at ~/.workos/device-id as a plain UTF-8 UUID string. Not a secret\n * — this is a convenience identifier that survives keyring unavailability.\n * Any IO failure falls through to a one-shot UUID for the current session.\n */\n\nimport fs from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport path from 'node:path';\nimport os from 'node:os';\nimport crypto from 'node:crypto';\n\n// RFC 4122 v4 format — matches what `crypto.randomUUID()` produces.\n// Rejects non-UUID strings like \"------------------------------------\".\nconst UUID_V4_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nlet cached: string | undefined;\nlet pending: Promise<string> | undefined;\n\nfunction getDeviceIdPath(): string {\n  return path.join(os.homedir(), '.workos', 'device-id');\n}\n\n/**\n * Asynchronously resolve (and lazily create) the device id without blocking\n * the event loop. Memoized: the first call performs the IO, concurrent and\n * later callers await the same promise. Populates the shared cache that the\n * synchronous getDeviceId() reads, so prewarming this at startup keeps the\n * synchronous telemetry path off blocking fs IO. Never rejects.\n */\nexport function loadDeviceId(): Promise<string> {\n  if (cached) return Promise.resolve(cached);\n  if (pending) return pending;\n\n  pending = (async () => {\n    const filePath = getDeviceIdPath();\n    try {\n      try {\n        const raw = (await readFile(filePath, 'utf8')).trim();\n        if (UUID_V4_REGEX.test(raw)) {\n          cached = raw;\n          return raw;\n        }\n      } catch {\n        // Missing/unreadable file — fall through and create it.\n      }\n\n      const id = crypto.randomUUID();\n      await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });\n      await writeFile(filePath, id, { encoding: 'utf8', mode: 0o600 });\n      cached = id;\n      return id;\n    } catch {\n      // IO failure (readonly FS, permission denied, etc.) — fall through to\n      // a session-scoped UUID, cached for the rest of this process.\n      cached = crypto.randomUUID();\n      return cached;\n    } finally {\n      pending = undefined;\n    }\n  })();\n\n  return pending;\n}\n\n/**\n * Synchronous accessor for the telemetry event path. Returns the prewarmed\n * value when loadDeviceId() has run; otherwise falls back to a one-time\n * synchronous read of the same file (returning the persisted id, so the value\n * never diverges from the async path). On any IO failure, returns a one-shot\n * UUID scoped to the current process — never throws.\n */\nexport function getDeviceId(): string {\n  if (cached) return cached;\n\n  const filePath = getDeviceIdPath();\n  try {\n    if (fs.existsSync(filePath)) {\n      const raw = fs.readFileSync(filePath, 'utf8').trim();\n      if (UUID_V4_REGEX.test(raw)) {\n        cached = raw;\n        return raw;\n      }\n    }\n\n    const id = crypto.randomUUID();\n    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });\n    fs.writeFileSync(filePath, id, { encoding: 'utf8', mode: 0o600 });\n    cached = id;\n    return id;\n  } catch {\n    // IO failure (readonly FS, permission denied, etc.) — fall through to\n    // a session-scoped UUID. Cache it so subsequent calls in this process\n    // return the same value; the next process run will retry IO.\n    cached = crypto.randomUUID();\n    return cached;\n  }\n}\n\n/** Test seam — resets the in-memory cache between test cases. */\nexport function __resetDeviceIdCache(): void {\n  cached = undefined;\n  pending = undefined;\n}\n"]}

package/dist/lib/ensure-auth.d.ts

@@ -1,12 +0,0 @@
-/**
- * Startup auth guard - ensures valid authentication before command execution.
- */
-export interface EnsureAuthResult {
-    /** Whether auth is now valid */
-    authenticated: boolean;
-    /** Whether login flow was triggered */
-    loginTriggered: boolean;
-    /** Whether token was refreshed */
-    tokenRefreshed: boolean;
-}
-export declare function ensureAuthenticated(): Promise<EnsureAuthResult>;

package/dist/lib/ensure-auth.js

@@ -1,111 +0,0 @@
-/**
- * Startup auth guard - ensures valid authentication before command execution.
- */
-import { getCredentials, updateTokens, isTokenExpired, clearCredentials } from './credentials.js';
-import { refreshAccessToken } from './token-refresh-client.js';
-import { getCliAuthClientId, getAuthkitDomain } from './settings.js';
-import { runLogin } from '../commands/login.js';
-import { logInfo } from '../utils/debug.js';
-import { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';
-import { exitWithAuthRequired } from '../utils/exit-codes.js';
-import { formatWorkOSCommand } from '../utils/command-invocation.js';
-import { warnIfSandboxed } from './host-probe.js';
-/**
- * Ensure valid authentication before command execution.
- *
- * - No credentials: triggers login flow
- * - Expired access token (valid refresh): silently refreshes
- * - Expired refresh token: triggers login flow
- *
- * @returns Result indicating what actions were taken
- * @throws Error if login fails or refresh fails unexpectedly
- */
-function exitForAuthRequired(message) {
-    if (isCiMode()) {
-        exitWithAuthRequired(message ?? 'Not authenticated. Set WORKOS_API_KEY or configure credentials before running in CI.');
-    }
-    if (isAgentMode()) {
-        exitWithAuthRequired(message ??
-            `Not authenticated. Run \`${formatWorkOSCommand('auth login')}\` on the host shell or set WORKOS_API_KEY.`);
-    }
-    exitWithAuthRequired(message);
-}
-export async function ensureAuthenticated() {
-    const result = {
-        authenticated: false,
-        loginTriggered: false,
-        tokenRefreshed: false,
-    };
-    await warnIfSandboxed();
-    // Case 1: No credentials or invalid credentials
-    const creds = getCredentials();
-    if (!creds) {
-        clearCredentials(); // Clean up any corrupt/empty files
-        if (!isPromptAllowed()) {
-            exitForAuthRequired();
-        }
-        logInfo('[ensure-auth] No valid credentials found, triggering login');
-        await runLogin();
-        result.loginTriggered = true;
-        result.authenticated = getCredentials() !== null;
-        return result;
-    }
-    // Case 2: Access token still valid
-    if (!isTokenExpired(creds)) {
-        result.authenticated = true;
-        return result;
-    }
-    // Case 3: Access token expired, try refresh
-    if (creds.refreshToken) {
-        logInfo('[ensure-auth] Access token expired, attempting refresh');
-        const clientId = getCliAuthClientId();
-        const authkitDomain = getAuthkitDomain();
-        if (clientId && authkitDomain) {
-            const refreshResult = await refreshAccessToken(authkitDomain, clientId);
-            if (refreshResult.success && refreshResult.accessToken && refreshResult.expiresAt) {
-                updateTokens(refreshResult.accessToken, refreshResult.expiresAt, refreshResult.refreshToken);
-                result.tokenRefreshed = true;
-                result.authenticated = true;
-                return result;
-            }
-            // Refresh failed - check if it's recoverable
-            if (refreshResult.errorType === 'invalid_grant') {
-                clearCredentials();
-                if (!isPromptAllowed()) {
-                    exitForAuthRequired(isCiMode()
-                        ? 'Session expired. Refresh credentials before running in CI, or set WORKOS_API_KEY.'
-                        : `Session expired. Run \`${formatWorkOSCommand('auth login')}\` on the host shell or set WORKOS_API_KEY.`);
-                }
-                logInfo('[ensure-auth] Refresh token expired, triggering login');
-                await runLogin();
-                result.loginTriggered = true;
-                result.authenticated = getCredentials() !== null;
-                return result;
-            }
-            // Network or server error - keep credentials intact for retry
-            if (!isPromptAllowed()) {
-                exitForAuthRequired(isCiMode()
-                    ? `Authentication refresh failed (${refreshResult.errorType}). Refresh credentials before running in CI, or set WORKOS_API_KEY.`
-                    : `Authentication refresh failed (${refreshResult.errorType}). Run \`${formatWorkOSCommand('auth login')}\` on the host shell or set WORKOS_API_KEY.`);
-            }
-            logInfo(`[ensure-auth] Refresh failed (${refreshResult.errorType}), triggering login`);
-            await runLogin();
-            result.loginTriggered = true;
-            result.authenticated = getCredentials() !== null;
-            return result;
-        }
-    }
-    // Case 4: No refresh token available — clear stale creds, must login
-    clearCredentials();
-    if (!isPromptAllowed()) {
-        exitForAuthRequired(isCiMode()
-            ? 'Session expired. Refresh credentials before running in CI, or set WORKOS_API_KEY.'
-            : `Session expired. Run \`${formatWorkOSCommand('auth login')}\` on the host shell or set WORKOS_API_KEY.`);
-    }
-    logInfo('[ensure-auth] No refresh token, triggering login');
-    await runLogin();
-    result.loginTriggered = true;
-    result.authenticated = getCredentials() !== null;
-    return result;
-}
-//# sourceMappingURL=ensure-auth.js.map

package/dist/lib/ensure-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ensure-auth.js","sourceRoot":"","sources":["../../src/lib/ensure-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAWlD;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,oBAAoB,CAClB,OAAO,IAAI,sFAAsF,CAClG,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,EAAE,CAAC;QAClB,oBAAoB,CAClB,OAAO;YACL,4BAA4B,mBAAmB,CAAC,YAAY,CAAC,6CAA6C,CAC7G,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,MAAM,GAAqB;QAC/B,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,KAAK;KACtB,CAAC;IAEF,MAAM,eAAe,EAAE,CAAC;IAExB,gDAAgD;IAChD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,gBAAgB,EAAE,CAAC,CAAC,mCAAmC;QACvD,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACvB,mBAAmB,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,4DAA4D,CAAC,CAAC;QACtE,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,wDAAwD,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QAEzC,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAExE,IAAI,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,WAAW,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;gBAClF,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC7F,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,6CAA6C;YAC7C,IAAI,aAAa,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;gBAChD,gBAAgB,EAAE,CAAC;gBACnB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;oBACvB,mBAAmB,CACjB,QAAQ,EAAE;wBACR,CAAC,CAAC,mFAAmF;wBACrF,CAAC,CAAC,0BAA0B,mBAAmB,CAAC,YAAY,CAAC,6CAA6C,CAC7G,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,uDAAuD,CAAC,CAAC;gBACjE,MAAM,QAAQ,EAAE,CAAC;gBACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,8DAA8D;YAC9D,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBACvB,mBAAmB,CACjB,QAAQ,EAAE;oBACR,CAAC,CAAC,kCAAkC,aAAa,CAAC,SAAS,qEAAqE;oBAChI,CAAC,CAAC,kCAAkC,aAAa,CAAC,SAAS,YAAY,mBAAmB,CAAC,YAAY,CAAC,6CAA6C,CACxJ,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iCAAiC,aAAa,CAAC,SAAS,qBAAqB,CAAC,CAAC;YACvF,MAAM,QAAQ,EAAE,CAAC;YACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;YACjD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,gBAAgB,EAAE,CAAC;IACnB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,mBAAmB,CACjB,QAAQ,EAAE;YACR,CAAC,CAAC,mFAAmF;YACrF,CAAC,CAAC,0BAA0B,mBAAmB,CAAC,YAAY,CAAC,6CAA6C,CAC7G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAC5D,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Startup auth guard - ensures valid authentication before command execution.\n */\n\nimport { getCredentials, updateTokens, isTokenExpired, clearCredentials } from './credentials.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\nimport { getCliAuthClientId, getAuthkitDomain } from './settings.js';\nimport { runLogin } from '../commands/login.js';\nimport { logInfo } from '../utils/debug.js';\nimport { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';\nimport { exitWithAuthRequired } from '../utils/exit-codes.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { warnIfSandboxed } from './host-probe.js';\n\nexport interface EnsureAuthResult {\n  /** Whether auth is now valid */\n  authenticated: boolean;\n  /** Whether login flow was triggered */\n  loginTriggered: boolean;\n  /** Whether token was refreshed */\n  tokenRefreshed: boolean;\n}\n\n/**\n * Ensure valid authentication before command execution.\n *\n * - No credentials: triggers login flow\n * - Expired access token (valid refresh): silently refreshes\n * - Expired refresh token: triggers login flow\n *\n * @returns Result indicating what actions were taken\n * @throws Error if login fails or refresh fails unexpectedly\n */\nfunction exitForAuthRequired(message?: string): never {\n  if (isCiMode()) {\n    exitWithAuthRequired(\n      message ?? 'Not authenticated. Set WORKOS_API_KEY or configure credentials before running in CI.',\n    );\n  }\n\n  if (isAgentMode()) {\n    exitWithAuthRequired(\n      message ??\n        `Not authenticated. Run \\`${formatWorkOSCommand('auth login')}\\` on the host shell or set WORKOS_API_KEY.`,\n    );\n  }\n\n  exitWithAuthRequired(message);\n}\n\nexport async function ensureAuthenticated(): Promise<EnsureAuthResult> {\n  const result: EnsureAuthResult = {\n    authenticated: false,\n    loginTriggered: false,\n    tokenRefreshed: false,\n  };\n\n  await warnIfSandboxed();\n\n  // Case 1: No credentials or invalid credentials\n  const creds = getCredentials();\n  if (!creds) {\n    clearCredentials(); // Clean up any corrupt/empty files\n    if (!isPromptAllowed()) {\n      exitForAuthRequired();\n    }\n    logInfo('[ensure-auth] No valid credentials found, triggering login');\n    await runLogin();\n    result.loginTriggered = true;\n    result.authenticated = getCredentials() !== null;\n    return result;\n  }\n\n  // Case 2: Access token still valid\n  if (!isTokenExpired(creds)) {\n    result.authenticated = true;\n    return result;\n  }\n\n  // Case 3: Access token expired, try refresh\n  if (creds.refreshToken) {\n    logInfo('[ensure-auth] Access token expired, attempting refresh');\n\n    const clientId = getCliAuthClientId();\n    const authkitDomain = getAuthkitDomain();\n\n    if (clientId && authkitDomain) {\n      const refreshResult = await refreshAccessToken(authkitDomain, clientId);\n\n      if (refreshResult.success && refreshResult.accessToken && refreshResult.expiresAt) {\n        updateTokens(refreshResult.accessToken, refreshResult.expiresAt, refreshResult.refreshToken);\n        result.tokenRefreshed = true;\n        result.authenticated = true;\n        return result;\n      }\n\n      // Refresh failed - check if it's recoverable\n      if (refreshResult.errorType === 'invalid_grant') {\n        clearCredentials();\n        if (!isPromptAllowed()) {\n          exitForAuthRequired(\n            isCiMode()\n              ? 'Session expired. Refresh credentials before running in CI, or set WORKOS_API_KEY.'\n              : `Session expired. Run \\`${formatWorkOSCommand('auth login')}\\` on the host shell or set WORKOS_API_KEY.`,\n          );\n        }\n        logInfo('[ensure-auth] Refresh token expired, triggering login');\n        await runLogin();\n        result.loginTriggered = true;\n        result.authenticated = getCredentials() !== null;\n        return result;\n      }\n\n      // Network or server error - keep credentials intact for retry\n      if (!isPromptAllowed()) {\n        exitForAuthRequired(\n          isCiMode()\n            ? `Authentication refresh failed (${refreshResult.errorType}). Refresh credentials before running in CI, or set WORKOS_API_KEY.`\n            : `Authentication refresh failed (${refreshResult.errorType}). Run \\`${formatWorkOSCommand('auth login')}\\` on the host shell or set WORKOS_API_KEY.`,\n        );\n      }\n      logInfo(`[ensure-auth] Refresh failed (${refreshResult.errorType}), triggering login`);\n      await runLogin();\n      result.loginTriggered = true;\n      result.authenticated = getCredentials() !== null;\n      return result;\n    }\n  }\n\n  // Case 4: No refresh token available — clear stale creds, must login\n  clearCredentials();\n  if (!isPromptAllowed()) {\n    exitForAuthRequired(\n      isCiMode()\n        ? 'Session expired. Refresh credentials before running in CI, or set WORKOS_API_KEY.'\n        : `Session expired. Run \\`${formatWorkOSCommand('auth login')}\\` on the host shell or set WORKOS_API_KEY.`,\n    );\n  }\n  logInfo('[ensure-auth] No refresh token, triggering login');\n  await runLogin();\n  result.loginTriggered = true;\n  result.authenticated = getCredentials() !== null;\n  return result;\n}\n"]}

package/dist/lib/env-writer.d.ts

@@ -1,25 +0,0 @@
-interface EnvVars {
-    WORKOS_API_KEY?: string;
-    WORKOS_CLIENT_ID: string;
-    WORKOS_REDIRECT_URI?: string;
-    NEXT_PUBLIC_WORKOS_REDIRECT_URI?: string;
-    WORKOS_COOKIE_PASSWORD?: string;
-    WORKOS_CLAIM_TOKEN?: string;
-}
-/**
- * Write environment variables to .env.local before agent runs.
- * Merges with existing .env.local if present (new vars take precedence).
- * Auto-generates WORKOS_COOKIE_PASSWORD if not provided.
- */
-export declare function writeEnvLocal(installDir: string, envVars: Partial<EnvVars>): void;
-/**
- * Write WorkOS credentials to the appropriate env file for the project.
- * Picks `.env.local` for JS projects (package.json present) or `.env` for
- * everything else (Python/Django, Ruby/Rails, Go, ...). Skips cookie password
- * generation outside the JS branch — non-JS SDKs don't use it.
- *
- * Used by pre-detection flows that write credentials before the framework
- * integration is known (unclaimed env provisioning).
- */
-export declare function writeCredentialsEnv(installDir: string, envVars: Partial<EnvVars>): void;
-export {};

package/dist/lib/env-writer.js

@@ -1,90 +0,0 @@
-import { existsSync, readFileSync, writeFileSync } from 'fs';
-import { join } from 'path';
-import { parseEnvFile } from '../utils/env-parser.js';
-const ENV_LOCAL_COVERING_PATTERNS = ['.env.local', '.env*.local', '.env*'];
-const ENV_COVERING_PATTERNS = ['.env', '.env*'];
-/**
- * Ensure the given env filename is in .gitignore.
- * Creates .gitignore if it doesn't exist.
- * No-ops if a covering pattern is already present.
- */
-function ensureGitignore(installDir, filename) {
-    const gitignorePath = join(installDir, '.gitignore');
-    const coveringPatterns = filename === '.env' ? ENV_COVERING_PATTERNS : ENV_LOCAL_COVERING_PATTERNS;
-    if (!existsSync(gitignorePath)) {
-        writeFileSync(gitignorePath, `${filename}\n`);
-        return;
-    }
-    const content = readFileSync(gitignorePath, 'utf-8');
-    const lines = content.split('\n').map((line) => line.trim());
-    if (lines.some((line) => coveringPatterns.includes(line))) {
-        return;
-    }
-    const separator = content.endsWith('\n') ? '' : '\n';
-    writeFileSync(gitignorePath, `${content}${separator}${filename}\n`);
-}
-/**
- * Generate a cryptographically secure cookie password.
- * Returns 32-char hex string (16 random bytes).
- * Uses Web Crypto API available in Node.js 20+
- */
-function generateCookiePassword() {
-    const array = new Uint8Array(16);
-    crypto.getRandomValues(array);
-    return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join('');
-}
-/**
- * Write environment variables to .env.local before agent runs.
- * Merges with existing .env.local if present (new vars take precedence).
- * Auto-generates WORKOS_COOKIE_PASSWORD if not provided.
- */
-export function writeEnvLocal(installDir, envVars) {
-    const envPath = join(installDir, '.env.local');
-    // Read existing env if present
-    let existingEnv = {};
-    if (existsSync(envPath)) {
-        const content = readFileSync(envPath, 'utf-8');
-        existingEnv = parseEnvFile(content);
-    }
-    // Merge with new vars (new vars take precedence)
-    const merged = { ...existingEnv, ...envVars };
-    // Generate cookie password if not provided
-    if (!merged.WORKOS_COOKIE_PASSWORD) {
-        merged.WORKOS_COOKIE_PASSWORD = generateCookiePassword();
-    }
-    // Write back
-    const content = Object.entries(merged)
-        .map(([key, value]) => `${key}=${value}`)
-        .join('\n');
-    ensureGitignore(installDir, '.env.local');
-    writeFileSync(envPath, content + '\n');
-}
-/**
- * Write WorkOS credentials to the appropriate env file for the project.
- * Picks `.env.local` for JS projects (package.json present) or `.env` for
- * everything else (Python/Django, Ruby/Rails, Go, ...). Skips cookie password
- * generation outside the JS branch — non-JS SDKs don't use it.
- *
- * Used by pre-detection flows that write credentials before the framework
- * integration is known (unclaimed env provisioning).
- */
-export function writeCredentialsEnv(installDir, envVars) {
-    const hasPackageJson = existsSync(join(installDir, 'package.json'));
-    if (hasPackageJson) {
-        writeEnvLocal(installDir, envVars);
-        return;
-    }
-    const envPath = join(installDir, '.env');
-    let existingEnv = {};
-    if (existsSync(envPath)) {
-        const content = readFileSync(envPath, 'utf-8');
-        existingEnv = parseEnvFile(content);
-    }
-    const merged = { ...existingEnv, ...envVars };
-    const content = Object.entries(merged)
-        .map(([key, value]) => `${key}=${value}`)
-        .join('\n');
-    ensureGitignore(installDir, '.env');
-    writeFileSync(envPath, content + '\n');
-}
-//# sourceMappingURL=env-writer.js.map

package/dist/lib/env-writer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env-writer.js","sourceRoot":"","sources":["../../src/lib/env-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,2BAA2B,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAC3E,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;GAIG;AACH,SAAS,eAAe,CAAC,UAAkB,EAAE,QAA+B;IAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,2BAA2B,CAAC;IAEnG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,aAAa,CAAC,aAAa,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,aAAa,CAAC,aAAa,EAAE,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,IAAI,CAAC,CAAC;AACtE,CAAC;AAWD;;;;GAIG;AACH,SAAS,sBAAsB;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,OAAyB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAE/C,+BAA+B;IAC/B,IAAI,WAAW,GAA2B,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,iDAAiD;IACjD,MAAM,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;IAE9C,2CAA2C;IAC3C,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,MAAM,CAAC,sBAAsB,GAAG,sBAAsB,EAAE,CAAC;IAC3D,CAAC;IAED,aAAa;IACb,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAE1C,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,OAAyB;IAC/E,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IACpE,IAAI,cAAc,EAAE,CAAC;QACnB,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,GAA2B,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEpC,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;AACzC,CAAC","sourcesContent":["import { existsSync, readFileSync, writeFileSync } from 'fs';\nimport { join } from 'path';\nimport { parseEnvFile } from '../utils/env-parser.js';\n\nconst ENV_LOCAL_COVERING_PATTERNS = ['.env.local', '.env*.local', '.env*'];\nconst ENV_COVERING_PATTERNS = ['.env', '.env*'];\n\n/**\n * Ensure the given env filename is in .gitignore.\n * Creates .gitignore if it doesn't exist.\n * No-ops if a covering pattern is already present.\n */\nfunction ensureGitignore(installDir: string, filename: '.env' | '.env.local'): void {\n  const gitignorePath = join(installDir, '.gitignore');\n  const coveringPatterns = filename === '.env' ? ENV_COVERING_PATTERNS : ENV_LOCAL_COVERING_PATTERNS;\n\n  if (!existsSync(gitignorePath)) {\n    writeFileSync(gitignorePath, `${filename}\\n`);\n    return;\n  }\n\n  const content = readFileSync(gitignorePath, 'utf-8');\n  const lines = content.split('\\n').map((line) => line.trim());\n\n  if (lines.some((line) => coveringPatterns.includes(line))) {\n    return;\n  }\n\n  const separator = content.endsWith('\\n') ? '' : '\\n';\n  writeFileSync(gitignorePath, `${content}${separator}${filename}\\n`);\n}\n\ninterface EnvVars {\n  WORKOS_API_KEY?: string;\n  WORKOS_CLIENT_ID: string;\n  WORKOS_REDIRECT_URI?: string;\n  NEXT_PUBLIC_WORKOS_REDIRECT_URI?: string;\n  WORKOS_COOKIE_PASSWORD?: string;\n  WORKOS_CLAIM_TOKEN?: string;\n}\n\n/**\n * Generate a cryptographically secure cookie password.\n * Returns 32-char hex string (16 random bytes).\n * Uses Web Crypto API available in Node.js 20+\n */\nfunction generateCookiePassword(): string {\n  const array = new Uint8Array(16);\n  crypto.getRandomValues(array);\n  return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Write environment variables to .env.local before agent runs.\n * Merges with existing .env.local if present (new vars take precedence).\n * Auto-generates WORKOS_COOKIE_PASSWORD if not provided.\n */\nexport function writeEnvLocal(installDir: string, envVars: Partial<EnvVars>): void {\n  const envPath = join(installDir, '.env.local');\n\n  // Read existing env if present\n  let existingEnv: Record<string, string> = {};\n  if (existsSync(envPath)) {\n    const content = readFileSync(envPath, 'utf-8');\n    existingEnv = parseEnvFile(content);\n  }\n\n  // Merge with new vars (new vars take precedence)\n  const merged = { ...existingEnv, ...envVars };\n\n  // Generate cookie password if not provided\n  if (!merged.WORKOS_COOKIE_PASSWORD) {\n    merged.WORKOS_COOKIE_PASSWORD = generateCookiePassword();\n  }\n\n  // Write back\n  const content = Object.entries(merged)\n    .map(([key, value]) => `${key}=${value}`)\n    .join('\\n');\n\n  ensureGitignore(installDir, '.env.local');\n\n  writeFileSync(envPath, content + '\\n');\n}\n\n/**\n * Write WorkOS credentials to the appropriate env file for the project.\n * Picks `.env.local` for JS projects (package.json present) or `.env` for\n * everything else (Python/Django, Ruby/Rails, Go, ...). Skips cookie password\n * generation outside the JS branch — non-JS SDKs don't use it.\n *\n * Used by pre-detection flows that write credentials before the framework\n * integration is known (unclaimed env provisioning).\n */\nexport function writeCredentialsEnv(installDir: string, envVars: Partial<EnvVars>): void {\n  const hasPackageJson = existsSync(join(installDir, 'package.json'));\n  if (hasPackageJson) {\n    writeEnvLocal(installDir, envVars);\n    return;\n  }\n\n  const envPath = join(installDir, '.env');\n  let existingEnv: Record<string, string> = {};\n  if (existsSync(envPath)) {\n    const content = readFileSync(envPath, 'utf-8');\n    existingEnv = parseEnvFile(content);\n  }\n\n  const merged = { ...existingEnv, ...envVars };\n  const content = Object.entries(merged)\n    .map(([key, value]) => `${key}=${value}`)\n    .join('\\n');\n\n  ensureGitignore(installDir, '.env');\n\n  writeFileSync(envPath, content + '\\n');\n}\n"]}