workos 0.19.0 → 0.20.2

package/dist/lib/events.d.ts

@@ -1,248 +0,0 @@
-import { EventEmitter } from 'events';
-/**
- * Structured data describing a successful installation, used to render the
- * completion summary and enrich the headless `complete` NDJSON event.
- *
- * Defined here (not in installer-core.types.ts) to avoid an import cycle:
- * installer-core.types.ts already imports from this module, so this module
- * must not import back.
- */
-export interface CompletionData {
-    /** Integration identifier (e.g. 'nextjs') */
-    integration: string;
-    /** Lockfile-aware dev command, e.g. "pnpm run dev" */
-    devCommand: string;
-    /** App URL with the detected port, e.g. "http://localhost:3000" */
-    url: string;
-    /** Changed files (git-relative), full list — display cap lives in the renderer */
-    files: string[];
-    /** Composed concrete + framework next-step lines */
-    nextSteps: string[];
-    /** Per-framework docs URL */
-    docsUrl: string;
-    /** WorkOS dashboard URL */
-    dashboardUrl: string;
-    /** Optional per-framework "add a sign-in link" snippet */
-    signInSnippet?: string;
-}
-export interface InstallerEvents {
-    status: {
-        message: string;
-    };
-    output: {
-        text: string;
-        isError?: boolean;
-    };
-    'file:write': {
-        path: string;
-        content: string;
-    };
-    'file:edit': {
-        path: string;
-        oldContent: string;
-        newContent: string;
-    };
-    'prompt:request': {
-        id: string;
-        message: string;
-        options?: string[];
-    };
-    'prompt:response': {
-        id: string;
-        value: string;
-    };
-    'confirm:request': {
-        id: string;
-        message: string;
-        warning?: string;
-        files?: string[];
-    };
-    'confirm:response': {
-        id: string;
-        confirmed: boolean;
-    };
-    'credentials:request': {
-        requiresApiKey: boolean;
-    };
-    'credentials:response': {
-        apiKey: string;
-        clientId: string;
-    };
-    complete: {
-        success: boolean;
-        summary?: string;
-        completion?: CompletionData;
-    };
-    error: {
-        message: string;
-        stack?: string;
-    };
-    'state:enter': {
-        state: string;
-    };
-    'state:exit': {
-        state: string;
-    };
-    'auth:checking': Record<string, never>;
-    'auth:required': Record<string, never>;
-    'auth:success': Record<string, never>;
-    'auth:failure': {
-        message: string;
-    };
-    'detection:start': Record<string, never>;
-    'detection:complete': {
-        integration: string;
-    };
-    'detection:none': Record<string, never>;
-    'git:checking': Record<string, never>;
-    'git:clean': Record<string, never>;
-    'git:dirty': {
-        files: string[];
-    };
-    'git:dirty:confirmed': Record<string, never>;
-    'git:dirty:cancelled': Record<string, never>;
-    'credentials:gathering': {
-        requiresApiKey: boolean;
-    };
-    'credentials:found': Record<string, never>;
-    'credentials:env:detected': {
-        files: string[];
-    };
-    'credentials:env:prompt': {
-        files: string[];
-    };
-    'credentials:env:scanning': Record<string, never>;
-    'credentials:env:found': {
-        sourcePath: string;
-    };
-    'credentials:env:notfound': Record<string, never>;
-    'device:started': {
-        verificationUri: string;
-        verificationUriComplete: string;
-        userCode: string;
-    };
-    'device:polling': Record<string, never>;
-    'device:success': {
-        email?: string;
-    };
-    'device:timeout': Record<string, never>;
-    'device:error': {
-        message: string;
-    };
-    'staging:fetching': Record<string, never>;
-    'staging:success': {
-        source?: 'device' | 'stored';
-    };
-    'staging:error': {
-        message: string;
-        statusCode?: number;
-    };
-    'config:start': Record<string, never>;
-    'config:complete': Record<string, never>;
-    'agent:start': Record<string, never>;
-    'agent:progress': {
-        step: string;
-        detail?: string;
-    };
-    'agent:success': {
-        summary?: string;
-    };
-    'agent:failure': {
-        message: string;
-        stack?: string;
-    };
-    'agent:retry': {
-        attempt: number;
-        maxRetries: number;
-    };
-    'agent:tool': {
-        kind: 'command';
-        detail: string;
-    };
-    'validation:retry:start': {
-        attempt: number;
-    };
-    'validation:retry:complete': {
-        attempt: number;
-        passed: boolean;
-    };
-    'validation:start': {
-        framework: string;
-    };
-    'validation:issues': {
-        issues: import('./validation/types.js').ValidationIssue[];
-    };
-    'validation:complete': {
-        passed: boolean;
-        issueCount: number;
-        durationMs: number;
-    };
-    'scaffold:checking': Record<string, never>;
-    'scaffold:prompt': {
-        packageManager: string;
-    };
-    'scaffold:start': {
-        packageManager: string;
-    };
-    'scaffold:progress': {
-        text: string;
-    };
-    'scaffold:complete': Record<string, never>;
-    'scaffold:failed': {
-        error: string;
-    };
-    'scaffold:skipped': Record<string, never>;
-    'branch:checking': Record<string, never>;
-    'branch:protected': {
-        branch: string;
-    };
-    'branch:prompt': {
-        branch: string;
-    };
-    'branch:created': {
-        branch: string;
-    };
-    'branch:create:failed': {
-        error: string;
-    };
-    'branch:skipped': Record<string, never>;
-    'postinstall:changes': {
-        files: string[];
-    };
-    'postinstall:nochanges': Record<string, never>;
-    'postinstall:commit:prompt': Record<string, never>;
-    'postinstall:commit:generating': Record<string, never>;
-    'postinstall:commit:committing': {
-        message: string;
-    };
-    'postinstall:commit:success': {
-        message: string;
-    };
-    'postinstall:commit:failed': {
-        error: string;
-    };
-    'postinstall:pr:prompt': Record<string, never>;
-    'postinstall:pr:generating': Record<string, never>;
-    'postinstall:pr:pushing': Record<string, never>;
-    'postinstall:pr:creating': Record<string, never>;
-    'postinstall:pr:success': {
-        url: string;
-    };
-    'postinstall:pr:failed': {
-        error: string;
-    };
-    'postinstall:push:failed': {
-        error: string;
-    };
-    'postinstall:manual': {
-        instructions: string;
-    };
-}
-export type InstallerEventName = keyof InstallerEvents;
-export declare class InstallerEventEmitter extends EventEmitter {
-    emit<K extends InstallerEventName>(event: K, payload: InstallerEvents[K]): boolean;
-    on<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this;
-    off<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this;
-    once<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this;
-}
-export declare function createInstallerEventEmitter(): InstallerEventEmitter;

package/dist/lib/events.js

@@ -1,19 +0,0 @@
-import { EventEmitter } from 'events';
-export class InstallerEventEmitter extends EventEmitter {
-    emit(event, payload) {
-        return super.emit(event, payload);
-    }
-    on(event, listener) {
-        return super.on(event, listener);
-    }
-    off(event, listener) {
-        return super.off(event, listener);
-    }
-    once(event, listener) {
-        return super.once(event, listener);
-    }
-}
-export function createInstallerEventEmitter() {
-    return new InstallerEventEmitter();
-}
-//# sourceMappingURL=events.js.map

package/dist/lib/events.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/lib/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAiItC,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IACrD,IAAI,CAA+B,KAAQ,EAAE,OAA2B;QACtE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,EAAE,CAA+B,KAAQ,EAAE,QAA+C;QACxF,OAAO,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAA+B,KAAQ,EAAE,QAA+C;QACzF,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAA+B,KAAQ,EAAE,QAA+C;QAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,IAAI,qBAAqB,EAAE,CAAC;AACrC,CAAC","sourcesContent":["import { EventEmitter } from 'events';\n\n/**\n * Structured data describing a successful installation, used to render the\n * completion summary and enrich the headless `complete` NDJSON event.\n *\n * Defined here (not in installer-core.types.ts) to avoid an import cycle:\n * installer-core.types.ts already imports from this module, so this module\n * must not import back.\n */\nexport interface CompletionData {\n  /** Integration identifier (e.g. 'nextjs') */\n  integration: string;\n  /** Lockfile-aware dev command, e.g. \"pnpm run dev\" */\n  devCommand: string;\n  /** App URL with the detected port, e.g. \"http://localhost:3000\" */\n  url: string;\n  /** Changed files (git-relative), full list — display cap lives in the renderer */\n  files: string[];\n  /** Composed concrete + framework next-step lines */\n  nextSteps: string[];\n  /** Per-framework docs URL */\n  docsUrl: string;\n  /** WorkOS dashboard URL */\n  dashboardUrl: string;\n  /** Optional per-framework \"add a sign-in link\" snippet */\n  signInSnippet?: string;\n}\n\nexport interface InstallerEvents {\n  status: { message: string };\n  output: { text: string; isError?: boolean };\n  'file:write': { path: string; content: string };\n  'file:edit': { path: string; oldContent: string; newContent: string };\n  'prompt:request': { id: string; message: string; options?: string[] };\n  'prompt:response': { id: string; value: string };\n  'confirm:request': { id: string; message: string; warning?: string; files?: string[] };\n  'confirm:response': { id: string; confirmed: boolean };\n  'credentials:request': { requiresApiKey: boolean };\n  'credentials:response': { apiKey: string; clientId: string };\n  complete: { success: boolean; summary?: string; completion?: CompletionData };\n  error: { message: string; stack?: string };\n\n  'state:enter': { state: string };\n  'state:exit': { state: string };\n  'auth:checking': Record<string, never>;\n  'auth:required': Record<string, never>;\n  'auth:success': Record<string, never>;\n  'auth:failure': { message: string };\n  'detection:start': Record<string, never>;\n  'detection:complete': { integration: string };\n  'detection:none': Record<string, never>;\n  'git:checking': Record<string, never>;\n  'git:clean': Record<string, never>;\n  'git:dirty': { files: string[] };\n  'git:dirty:confirmed': Record<string, never>;\n  'git:dirty:cancelled': Record<string, never>;\n  'credentials:gathering': { requiresApiKey: boolean };\n  'credentials:found': Record<string, never>;\n  // Credential discovery events\n  'credentials:env:detected': { files: string[] };\n  'credentials:env:prompt': { files: string[] };\n  'credentials:env:scanning': Record<string, never>;\n  'credentials:env:found': { sourcePath: string };\n  'credentials:env:notfound': Record<string, never>;\n  // Device auth events\n  'device:started': { verificationUri: string; verificationUriComplete: string; userCode: string };\n  'device:polling': Record<string, never>;\n  'device:success': { email?: string };\n  'device:timeout': Record<string, never>;\n  'device:error': { message: string };\n  // Staging API events\n  'staging:fetching': Record<string, never>;\n  'staging:success': { source?: 'device' | 'stored' };\n  'staging:error': { message: string; statusCode?: number };\n  'config:start': Record<string, never>;\n  'config:complete': Record<string, never>;\n  'agent:start': Record<string, never>;\n  'agent:progress': { step: string; detail?: string };\n  'agent:success': { summary?: string };\n  'agent:failure': { message: string; stack?: string };\n  'agent:retry': { attempt: number; maxRetries: number };\n  // Surfaced agent tool activity (e.g. Bash commands run during install)\n  'agent:tool': { kind: 'command'; detail: string };\n\n  'validation:retry:start': { attempt: number };\n  'validation:retry:complete': { attempt: number; passed: boolean };\n\n  'validation:start': { framework: string };\n  'validation:issues': { issues: import('./validation/types.js').ValidationIssue[] };\n  'validation:complete': { passed: boolean; issueCount: number; durationMs: number };\n\n  // Scaffold events (empty-directory app scaffolding)\n  'scaffold:checking': Record<string, never>;\n  'scaffold:prompt': { packageManager: string };\n  'scaffold:start': { packageManager: string };\n  'scaffold:progress': { text: string };\n  'scaffold:complete': Record<string, never>;\n  'scaffold:failed': { error: string };\n  'scaffold:skipped': Record<string, never>;\n\n  // Branch check events\n  'branch:checking': Record<string, never>;\n  'branch:protected': { branch: string };\n  'branch:prompt': { branch: string };\n  'branch:created': { branch: string };\n  'branch:create:failed': { error: string };\n  'branch:skipped': Record<string, never>;\n\n  // Post-install events\n  'postinstall:changes': { files: string[] };\n  'postinstall:nochanges': Record<string, never>;\n  'postinstall:commit:prompt': Record<string, never>;\n  'postinstall:commit:generating': Record<string, never>;\n  'postinstall:commit:committing': { message: string };\n  'postinstall:commit:success': { message: string };\n  'postinstall:commit:failed': { error: string };\n  'postinstall:pr:prompt': Record<string, never>;\n  'postinstall:pr:generating': Record<string, never>;\n  'postinstall:pr:pushing': Record<string, never>;\n  'postinstall:pr:creating': Record<string, never>;\n  'postinstall:pr:success': { url: string };\n  'postinstall:pr:failed': { error: string };\n  'postinstall:push:failed': { error: string };\n  'postinstall:manual': { instructions: string };\n}\n\nexport type InstallerEventName = keyof InstallerEvents;\n\nexport class InstallerEventEmitter extends EventEmitter {\n  emit<K extends InstallerEventName>(event: K, payload: InstallerEvents[K]): boolean {\n    return super.emit(event, payload);\n  }\n\n  on<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.on(event, listener);\n  }\n\n  off<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.off(event, listener);\n  }\n\n  once<K extends InstallerEventName>(event: K, listener: (payload: InstallerEvents[K]) => void): this {\n    return super.once(event, listener);\n  }\n}\n\nexport function createInstallerEventEmitter(): InstallerEventEmitter {\n  return new InstallerEventEmitter();\n}\n"]}

package/dist/lib/framework-config.d.ts

@@ -1,133 +0,0 @@
-import type { InstallerOptions } from '../utils/types.js';
-/**
- * Supported programming languages for framework integrations.
- */
-export type Language = 'javascript' | 'python' | 'ruby' | 'php' | 'go' | 'kotlin' | 'dotnet' | 'elixir';
-/**
- * Configuration interface for framework-specific agent integrations.
- * Each framework exports a FrameworkConfig that the universal runner uses.
- */
-export interface FrameworkConfig {
-    metadata: FrameworkMetadata;
-    detection: FrameworkDetection;
-    environment: EnvironmentConfig;
-    analytics: AnalyticsConfig;
-    prompts: PromptConfig;
-    ui: UIConfig;
-}
-/**
- * Basic framework information and documentation
- */
-export interface FrameworkMetadata {
-    /** Display name (e.g., "Next.js", "React") */
-    name: string;
-    /** Integration identifier (e.g., 'nextjs', 'python'). String, not enum — auto-discovered from registry. */
-    integration: string;
-    /** URL to framework-specific WorkOS AuthKit docs */
-    docsUrl: string;
-    /**
-     * Optional URL to docs for users with unsupported framework versions.
-     * If not provided, defaults to docsUrl.
-     */
-    unsupportedVersionDocsUrl?: string;
-    /**
-     * Optional function to gather framework-specific context before agent runs.
-     * For Next.js: detects router type
-     * For React Native: detects Expo vs bare
-     */
-    gatherContext?: (options: InstallerOptions) => Promise<Record<string, any>>;
-    /**
-     * Name of the framework-specific skill for agent integration.
-     * Skills are located in .claude/skills/{skillName}/SKILL.md
-     */
-    skillName?: string;
-    /** Language ecosystem this integration belongs to */
-    language: Language;
-    /** Stability tier: 'stable' for tested integrations, 'experimental' for new ones */
-    stability: 'stable' | 'experimental';
-    /** Detection priority — higher numbers are checked first */
-    priority: number;
-    /** Default package manager command (e.g., 'pip', 'gem', 'go'). Optional for JS integrations. */
-    packageManager?: string;
-    /** Primary manifest file (e.g., 'pyproject.toml', 'Gemfile'). Optional for JS integrations. */
-    manifestFile?: string;
-    /**
-     * Optional custom detection override for non-JS integrations. When present,
-     * the registry calls this instead of falling back to `manifestFile` existence.
-     * Use when a single manifest file isn't enough (e.g., Django projects may
-     * use `manage.py` + `requirements.txt` without a `pyproject.toml`).
-     */
-    detect?: (options: Pick<InstallerOptions, 'installDir'>) => boolean | Promise<boolean>;
-}
-/**
- * Framework detection and version handling
- */
-export interface FrameworkDetection {
-    /** Package name to check in package.json (e.g., "next", "react") */
-    packageName: string;
-    /** Human-readable name for error messages (e.g., "Next.js") */
-    packageDisplayName: string;
-    /** Extract version from package.json */
-    getVersion: (packageJson: any) => string | undefined;
-    /** Optional: Convert version to analytics bucket (e.g., "15.x") */
-    getVersionBucket?: (version: string) => string;
-}
-/**
- * Environment variable configuration
- */
-export interface EnvironmentConfig {
-    /** Whether to upload env vars to hosting providers post-agent */
-    uploadToHosting: boolean;
-    /** Whether this framework requires API key (false for client-only SDKs) */
-    requiresApiKey: boolean;
-    /**
-     * Build the environment variables object for this framework.
-     * Returns the exact variable names and values to upload to hosting providers.
-     */
-    getEnvVars: (apiKey: string, clientId: string) => Record<string, string>;
-}
-/**
- * Analytics configuration
- */
-export interface AnalyticsConfig {
-    /** Generate tags from context (e.g., { 'nextjs-version': '15.x', 'router': 'app' }) */
-    getTags: (context: any) => Record<string, any>;
-    /** Optional: Additional event properties */
-    getEventProperties?: (context: any) => Record<string, any>;
-}
-/**
- * Prompt configuration
- */
-export interface PromptConfig {
-    /**
-     * Optional: Additional context lines to append to base prompt
-     * For Next.js: "- Router: app"
-     * For React Native: "- Platform: Expo"
-     */
-    getAdditionalContextLines?: (context: any) => string[];
-}
-/**
- * UI messaging configuration
- */
-export interface UIConfig {
-    /** Success message when agent completes */
-    successMessage: string;
-    /** Generate "What the agent did" bullets from context */
-    getOutroChanges: (context: any) => string[];
-    /** Generate "Next steps" bullets from context */
-    getOutroNextSteps: (context: any) => string[];
-    /**
-     * Optional per-framework "add a sign-in link" snippet, surfaced as a next
-     * step in the completion summary. Only defined for frameworks that scaffold
-     * interactive auth UI. Copy must stay accurate to what the agent scaffolds.
-     */
-    getSignInSnippet?: (context: any) => string;
-}
-/**
- * Generate welcome message from framework name
- */
-export declare function getWelcomeMessage(frameworkName: string): string;
-/**
- * Shared spinner message for all frameworks
- */
-export declare const SPINNER_MESSAGE = "Setting up WorkOS AuthKit with login, authentication, and session management...";

package/dist/lib/framework-config.js

@@ -1,11 +0,0 @@
-/**
- * Generate welcome message from framework name
- */
-export function getWelcomeMessage(frameworkName) {
-    return `WorkOS AuthKit ${frameworkName} installer (agent-powered)`;
-}
-/**
- * Shared spinner message for all frameworks
- */
-export const SPINNER_MESSAGE = 'Setting up WorkOS AuthKit with login, authentication, and session management...';
-//# sourceMappingURL=framework-config.js.map

package/dist/lib/framework-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"framework-config.js","sourceRoot":"","sources":["../../src/lib/framework-config.ts"],"names":[],"mappings":"AA0JA;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB;IACrD,OAAO,kBAAkB,aAAa,4BAA4B,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iFAAiF,CAAC","sourcesContent":["import type { InstallerOptions } from '../utils/types.js';\n\n/**\n * Supported programming languages for framework integrations.\n */\nexport type Language = 'javascript' | 'python' | 'ruby' | 'php' | 'go' | 'kotlin' | 'dotnet' | 'elixir';\n\n/**\n * Configuration interface for framework-specific agent integrations.\n * Each framework exports a FrameworkConfig that the universal runner uses.\n */\nexport interface FrameworkConfig {\n  metadata: FrameworkMetadata;\n  detection: FrameworkDetection;\n  environment: EnvironmentConfig;\n  analytics: AnalyticsConfig;\n  prompts: PromptConfig;\n  ui: UIConfig;\n}\n\n/**\n * Basic framework information and documentation\n */\nexport interface FrameworkMetadata {\n  /** Display name (e.g., \"Next.js\", \"React\") */\n  name: string;\n\n  /** Integration identifier (e.g., 'nextjs', 'python'). String, not enum — auto-discovered from registry. */\n  integration: string;\n\n  /** URL to framework-specific WorkOS AuthKit docs */\n  docsUrl: string;\n\n  /**\n   * Optional URL to docs for users with unsupported framework versions.\n   * If not provided, defaults to docsUrl.\n   */\n  unsupportedVersionDocsUrl?: string;\n\n  /**\n   * Optional function to gather framework-specific context before agent runs.\n   * For Next.js: detects router type\n   * For React Native: detects Expo vs bare\n   */\n  gatherContext?: (options: InstallerOptions) => Promise<Record<string, any>>;\n\n  /**\n   * Name of the framework-specific skill for agent integration.\n   * Skills are located in .claude/skills/{skillName}/SKILL.md\n   */\n  skillName?: string;\n\n  /** Language ecosystem this integration belongs to */\n  language: Language;\n\n  /** Stability tier: 'stable' for tested integrations, 'experimental' for new ones */\n  stability: 'stable' | 'experimental';\n\n  /** Detection priority — higher numbers are checked first */\n  priority: number;\n\n  /** Default package manager command (e.g., 'pip', 'gem', 'go'). Optional for JS integrations. */\n  packageManager?: string;\n\n  /** Primary manifest file (e.g., 'pyproject.toml', 'Gemfile'). Optional for JS integrations. */\n  manifestFile?: string;\n\n  /**\n   * Optional custom detection override for non-JS integrations. When present,\n   * the registry calls this instead of falling back to `manifestFile` existence.\n   * Use when a single manifest file isn't enough (e.g., Django projects may\n   * use `manage.py` + `requirements.txt` without a `pyproject.toml`).\n   */\n  detect?: (options: Pick<InstallerOptions, 'installDir'>) => boolean | Promise<boolean>;\n}\n\n/**\n * Framework detection and version handling\n */\nexport interface FrameworkDetection {\n  /** Package name to check in package.json (e.g., \"next\", \"react\") */\n  packageName: string;\n\n  /** Human-readable name for error messages (e.g., \"Next.js\") */\n  packageDisplayName: string;\n\n  /** Extract version from package.json */\n  getVersion: (packageJson: any) => string | undefined;\n\n  /** Optional: Convert version to analytics bucket (e.g., \"15.x\") */\n  getVersionBucket?: (version: string) => string;\n}\n\n/**\n * Environment variable configuration\n */\nexport interface EnvironmentConfig {\n  /** Whether to upload env vars to hosting providers post-agent */\n  uploadToHosting: boolean;\n\n  /** Whether this framework requires API key (false for client-only SDKs) */\n  requiresApiKey: boolean;\n\n  /**\n   * Build the environment variables object for this framework.\n   * Returns the exact variable names and values to upload to hosting providers.\n   */\n  getEnvVars: (apiKey: string, clientId: string) => Record<string, string>;\n}\n\n/**\n * Analytics configuration\n */\nexport interface AnalyticsConfig {\n  /** Generate tags from context (e.g., { 'nextjs-version': '15.x', 'router': 'app' }) */\n  getTags: (context: any) => Record<string, any>;\n\n  /** Optional: Additional event properties */\n  getEventProperties?: (context: any) => Record<string, any>;\n}\n\n/**\n * Prompt configuration\n */\nexport interface PromptConfig {\n  /**\n   * Optional: Additional context lines to append to base prompt\n   * For Next.js: \"- Router: app\"\n   * For React Native: \"- Platform: Expo\"\n   */\n  getAdditionalContextLines?: (context: any) => string[];\n}\n\n/**\n * UI messaging configuration\n */\nexport interface UIConfig {\n  /** Success message when agent completes */\n  successMessage: string;\n\n  /** Generate \"What the agent did\" bullets from context */\n  getOutroChanges: (context: any) => string[];\n\n  /** Generate \"Next steps\" bullets from context */\n  getOutroNextSteps: (context: any) => string[];\n\n  /**\n   * Optional per-framework \"add a sign-in link\" snippet, surfaced as a next\n   * step in the completion summary. Only defined for frameworks that scaffold\n   * interactive auth UI. Copy must stay accurate to what the agent scaffolds.\n   */\n  getSignInSnippet?: (context: any) => string;\n}\n\n/**\n * Generate welcome message from framework name\n */\nexport function getWelcomeMessage(frameworkName: string): string {\n  return `WorkOS AuthKit ${frameworkName} installer (agent-powered)`;\n}\n\n/**\n * Shared spinner message for all frameworks\n */\nexport const SPINNER_MESSAGE = 'Setting up WorkOS AuthKit with login, authentication, and session management...';\n"]}

package/dist/lib/helper-functions.d.ts

@@ -1 +0,0 @@
-export declare const sleep: (ms: number) => Promise<unknown>;

package/dist/lib/helper-functions.js

@@ -1,2 +0,0 @@
-export const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-//# sourceMappingURL=helper-functions.js.map

package/dist/lib/helper-functions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"helper-functions.js","sourceRoot":"","sources":["../../src/lib/helper-functions.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC","sourcesContent":["export const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\n"]}

package/dist/lib/host-probe.d.ts

@@ -1,28 +0,0 @@
-/**
- * Host capability probes for non-interactive / sandboxed environments.
- *
- * When the CLI runs inside an AI agent sandbox (Claude Code, Codex, Cursor),
- * the keyring, home directory, network, or browser may be unavailable.
- * These helpers detect that situation and emit a single actionable warning
- * per session instead of letting opaque EPERM errors confuse the agent.
- */
-export type HostCapability = 'home-fs' | 'keychain' | 'network' | 'browser-launch' | 'localhost-bind';
-export type HostOperation = 'read' | 'write' | 'delete' | 'connect' | 'open' | 'listen';
-export interface HostCapabilityDetails {
-    operation?: HostOperation;
-    target?: string;
-    label?: string;
-}
-export interface ProbeFailure extends HostCapabilityDetails {
-    capability: HostCapability;
-    detail: string;
-}
-export interface ProbeResult {
-    ok: boolean;
-    failures: ProbeFailure[];
-}
-export declare function formatHostProbeFailure(failure: ProbeFailure): string;
-export declare function runHostProbe(): Promise<ProbeResult>;
-export declare function warnIfSandboxed(): Promise<void>;
-export declare function observeHostFailure(capability: HostCapability, error: unknown, details?: HostCapabilityDetails): void;
-export declare function _resetProbeState(): void;

package/dist/lib/host-probe.js

@@ -1,154 +0,0 @@
-/**
- * Host capability probes for non-interactive / sandboxed environments.
- *
- * When the CLI runs inside an AI agent sandbox (Claude Code, Codex, Cursor),
- * the keyring, home directory, network, or browser may be unavailable.
- * These helpers detect that situation and emit a single actionable warning
- * per session instead of letting opaque EPERM errors confuse the agent.
- */
-import { promises as fs } from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import { Entry } from '@napi-rs/keyring';
-import { isAgentMode, isCiMode } from '../utils/interaction-mode.js';
-import { logInfo, logVisibleWarn } from '../utils/debug.js';
-let warnedThisSession = false;
-let cachedProbe;
-const KEYCHAIN_SERVICE = 'workos-cli';
-const KEYCHAIN_PROBE_ACCOUNT = 'probe';
-const PERMISSION_PATTERNS = [
-    /\bEPERM\b/i,
-    /\bEACCES\b/i,
-    /operation not permitted/i,
-    /permission denied/i,
-    /\bsandboxd?\b/i,
-    /interaction is not allowed/i,
-    /access denied/i,
-];
-function isPermissionError(error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    return PERMISSION_PATTERNS.some((p) => p.test(msg));
-}
-function isLikelyHostFailure(capability, error) {
-    if (capability === 'browser-launch' || capability === 'localhost-bind') {
-        return true;
-    }
-    return isPermissionError(error);
-}
-function isMissingEntryError(error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    return msg.includes('not found') || msg.includes('No such');
-}
-async function probeHomeFs() {
-    const dir = path.join(os.homedir(), '.workos');
-    const probePath = path.join(dir, `.probe-${process.pid}-${crypto.randomUUID()}`);
-    try {
-        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
-        await fs.writeFile(probePath, new Date().toISOString(), { mode: 0o600 });
-        return null;
-    }
-    catch (error) {
-        // Only treat permission-class errors as sandbox indicators. Transient
-        // errors like ENOSPC/EIO would otherwise produce a misleading "sandboxed
-        // environment" warning. Mirrors the gating in observeHostFailure().
-        if (!isPermissionError(error))
-            return null;
-        const detail = error instanceof Error ? error.message : String(error);
-        return { capability: 'home-fs', detail, operation: 'write', target: dir, label: 'WorkOS home directory' };
-    }
-    finally {
-        // Best-effort cleanup so a successful write never leaves an orphan file
-        // behind. Ignore unlink failures: if the file was never created the
-        // unlink will fail with ENOENT, and any other failure is unrelated to
-        // the probe's purpose (which is checking write access, not delete).
-        await fs.unlink(probePath).catch(() => { });
-    }
-}
-function probeKeychain() {
-    try {
-        const entry = new Entry(KEYCHAIN_SERVICE, KEYCHAIN_PROBE_ACCOUNT);
-        entry.getPassword();
-        return null;
-    }
-    catch (error) {
-        // A "not found" / "No such" error means the keychain is reachable but the
-        // probe entry simply doesn't exist — that's a healthy state, not a failure.
-        if (isMissingEntryError(error)) {
-            return null;
-        }
-        // Only treat permission-class errors as sandbox indicators. A user-canceled
-        // macOS prompt or a transient keyring daemon hiccup would otherwise produce
-        // a misleading "sandboxed environment" warning. Mirrors probeHomeFs() and
-        // observeHostFailure().
-        if (!isPermissionError(error))
-            return null;
-        const detail = error instanceof Error ? error.message : String(error);
-        return {
-            capability: 'keychain',
-            detail,
-            operation: 'read',
-            target: `${KEYCHAIN_SERVICE}/${KEYCHAIN_PROBE_ACCOUNT}`,
-            label: 'WorkOS keychain probe',
-        };
-    }
-}
-export function formatHostProbeFailure(failure) {
-    const parts = [failure.label ?? failure.capability];
-    if (failure.operation)
-        parts.push(`operation=${failure.operation}`);
-    if (failure.target)
-        parts.push(`target=${failure.target}`);
-    parts.push(`error=${failure.detail}`);
-    return parts.join(', ');
-}
-function formatHostFailureContext(capability, details, detail) {
-    return formatHostProbeFailure({ capability, ...details, detail });
-}
-export async function runHostProbe() {
-    if (cachedProbe)
-        return cachedProbe;
-    const failures = [];
-    const fsResult = await probeHomeFs();
-    if (fsResult)
-        failures.push(fsResult);
-    const keychainResult = probeKeychain();
-    if (keychainResult)
-        failures.push(keychainResult);
-    cachedProbe = { ok: failures.length === 0, failures };
-    return cachedProbe;
-}
-function shouldWarnForHostTrust() {
-    return isAgentMode() || isCiMode();
-}
-export async function warnIfSandboxed() {
-    if (warnedThisSession)
-        return;
-    if (!shouldWarnForHostTrust())
-        return;
-    const probe = await runHostProbe();
-    if (probe.ok)
-        return;
-    warnedThisSession = true;
-    const caps = probe.failures.map((f) => f.capability).join(', ');
-    logVisibleWarn(`Host capabilities may be unavailable (${caps}). This may be a sandboxed environment.`, 'Re-run this command on the host shell before trusting auth or API failures.');
-    for (const f of probe.failures) {
-        logInfo(`[host-probe] ${formatHostProbeFailure(f)}`);
-    }
-}
-export function observeHostFailure(capability, error, details = {}) {
-    if (warnedThisSession)
-        return;
-    if (!shouldWarnForHostTrust())
-        return;
-    if (!isLikelyHostFailure(capability, error))
-        return;
-    warnedThisSession = true;
-    const detail = error instanceof Error ? error.message : String(error);
-    logVisibleWarn(`Host capability "${capability}" failed (${detail}). This may be a sandboxed environment.`, 'Re-run this command on the host shell before trusting auth or API failures.');
-    logInfo(`[host-probe] ${formatHostFailureContext(capability, details, detail)}`);
-}
-export function _resetProbeState() {
-    cachedProbe = undefined;
-    warnedThisSession = false;
-}
-//# sourceMappingURL=host-probe.js.map

package/dist/lib/host-probe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-probe.js","sourceRoot":"","sources":["../../src/lib/host-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAqB5D,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,WAAoC,CAAC;AAEzC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC,MAAM,mBAAmB,GAAG;IAC1B,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,oBAAoB;IACpB,gBAAgB;IAChB,6BAA6B;IAC7B,gBAAgB;CACjB,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAA0B,EAAE,KAAc;IACrE,IAAI,UAAU,KAAK,gBAAgB,IAAI,UAAU,KAAK,gBAAgB,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEjF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAC5G,CAAC;YAAS,CAAC;QACT,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;QAClE,KAAK,CAAC,WAAW,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,4EAA4E;QAC5E,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,wBAAwB;QACxB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,MAAM;YACN,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,gBAAgB,IAAI,sBAAsB,EAAE;YACvD,KAAK,EAAE,uBAAuB;SAC/B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAqB;IAC1D,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,wBAAwB,CAAC,UAA0B,EAAE,OAA8B,EAAE,MAAc;IAC1G,OAAO,sBAAsB,CAAC,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,IAAI,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,cAAc,GAAG,aAAa,EAAE,CAAC;IACvC,IAAI,cAAc;QAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAElD,WAAW,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,WAAW,EAAE,IAAI,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,IAAI,CAAC,sBAAsB,EAAE;QAAE,OAAO;IAEtC,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO;IAErB,iBAAiB,GAAG,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,cAAc,CACZ,yCAAyC,IAAI,yCAAyC,EACtF,6EAA6E,CAC9E,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,gBAAgB,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAA0B,EAC1B,KAAc,EACd,UAAiC,EAAE;IAEnC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,IAAI,CAAC,sBAAsB,EAAE;QAAE,OAAO;IACtC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC;QAAE,OAAO;IAEpD,iBAAiB,GAAG,IAAI,CAAC;IAEzB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,cAAc,CACZ,oBAAoB,UAAU,aAAa,MAAM,yCAAyC,EAC1F,6EAA6E,CAC9E,CAAC;IACF,OAAO,CAAC,gBAAgB,wBAAwB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,WAAW,GAAG,SAAS,CAAC;IACxB,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC","sourcesContent":["/**\n * Host capability probes for non-interactive / sandboxed environments.\n *\n * When the CLI runs inside an AI agent sandbox (Claude Code, Codex, Cursor),\n * the keyring, home directory, network, or browser may be unavailable.\n * These helpers detect that situation and emit a single actionable warning\n * per session instead of letting opaque EPERM errors confuse the agent.\n */\n\nimport { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { Entry } from '@napi-rs/keyring';\nimport { isAgentMode, isCiMode } from '../utils/interaction-mode.js';\nimport { logInfo, logVisibleWarn } from '../utils/debug.js';\n\nexport type HostCapability = 'home-fs' | 'keychain' | 'network' | 'browser-launch' | 'localhost-bind';\nexport type HostOperation = 'read' | 'write' | 'delete' | 'connect' | 'open' | 'listen';\n\nexport interface HostCapabilityDetails {\n  operation?: HostOperation;\n  target?: string;\n  label?: string;\n}\n\nexport interface ProbeFailure extends HostCapabilityDetails {\n  capability: HostCapability;\n  detail: string;\n}\n\nexport interface ProbeResult {\n  ok: boolean;\n  failures: ProbeFailure[];\n}\n\nlet warnedThisSession = false;\nlet cachedProbe: ProbeResult | undefined;\n\nconst KEYCHAIN_SERVICE = 'workos-cli';\nconst KEYCHAIN_PROBE_ACCOUNT = 'probe';\n\nconst PERMISSION_PATTERNS = [\n  /\\bEPERM\\b/i,\n  /\\bEACCES\\b/i,\n  /operation not permitted/i,\n  /permission denied/i,\n  /\\bsandboxd?\\b/i,\n  /interaction is not allowed/i,\n  /access denied/i,\n];\n\nfunction isPermissionError(error: unknown): boolean {\n  const msg = error instanceof Error ? error.message : String(error);\n  return PERMISSION_PATTERNS.some((p) => p.test(msg));\n}\n\nfunction isLikelyHostFailure(capability: HostCapability, error: unknown): boolean {\n  if (capability === 'browser-launch' || capability === 'localhost-bind') {\n    return true;\n  }\n\n  return isPermissionError(error);\n}\n\nfunction isMissingEntryError(error: unknown): boolean {\n  const msg = error instanceof Error ? error.message : String(error);\n  return msg.includes('not found') || msg.includes('No such');\n}\n\nasync function probeHomeFs(): Promise<ProbeFailure | null> {\n  const dir = path.join(os.homedir(), '.workos');\n  const probePath = path.join(dir, `.probe-${process.pid}-${crypto.randomUUID()}`);\n\n  try {\n    await fs.mkdir(dir, { recursive: true, mode: 0o700 });\n    await fs.writeFile(probePath, new Date().toISOString(), { mode: 0o600 });\n    return null;\n  } catch (error) {\n    // Only treat permission-class errors as sandbox indicators. Transient\n    // errors like ENOSPC/EIO would otherwise produce a misleading \"sandboxed\n    // environment\" warning. Mirrors the gating in observeHostFailure().\n    if (!isPermissionError(error)) return null;\n    const detail = error instanceof Error ? error.message : String(error);\n    return { capability: 'home-fs', detail, operation: 'write', target: dir, label: 'WorkOS home directory' };\n  } finally {\n    // Best-effort cleanup so a successful write never leaves an orphan file\n    // behind. Ignore unlink failures: if the file was never created the\n    // unlink will fail with ENOENT, and any other failure is unrelated to\n    // the probe's purpose (which is checking write access, not delete).\n    await fs.unlink(probePath).catch(() => {});\n  }\n}\n\nfunction probeKeychain(): ProbeFailure | null {\n  try {\n    const entry = new Entry(KEYCHAIN_SERVICE, KEYCHAIN_PROBE_ACCOUNT);\n    entry.getPassword();\n    return null;\n  } catch (error) {\n    // A \"not found\" / \"No such\" error means the keychain is reachable but the\n    // probe entry simply doesn't exist — that's a healthy state, not a failure.\n    if (isMissingEntryError(error)) {\n      return null;\n    }\n    // Only treat permission-class errors as sandbox indicators. A user-canceled\n    // macOS prompt or a transient keyring daemon hiccup would otherwise produce\n    // a misleading \"sandboxed environment\" warning. Mirrors probeHomeFs() and\n    // observeHostFailure().\n    if (!isPermissionError(error)) return null;\n    const detail = error instanceof Error ? error.message : String(error);\n    return {\n      capability: 'keychain',\n      detail,\n      operation: 'read',\n      target: `${KEYCHAIN_SERVICE}/${KEYCHAIN_PROBE_ACCOUNT}`,\n      label: 'WorkOS keychain probe',\n    };\n  }\n}\n\nexport function formatHostProbeFailure(failure: ProbeFailure): string {\n  const parts = [failure.label ?? failure.capability];\n  if (failure.operation) parts.push(`operation=${failure.operation}`);\n  if (failure.target) parts.push(`target=${failure.target}`);\n  parts.push(`error=${failure.detail}`);\n  return parts.join(', ');\n}\n\nfunction formatHostFailureContext(capability: HostCapability, details: HostCapabilityDetails, detail: string): string {\n  return formatHostProbeFailure({ capability, ...details, detail });\n}\n\nexport async function runHostProbe(): Promise<ProbeResult> {\n  if (cachedProbe) return cachedProbe;\n\n  const failures: ProbeFailure[] = [];\n\n  const fsResult = await probeHomeFs();\n  if (fsResult) failures.push(fsResult);\n\n  const keychainResult = probeKeychain();\n  if (keychainResult) failures.push(keychainResult);\n\n  cachedProbe = { ok: failures.length === 0, failures };\n  return cachedProbe;\n}\n\nfunction shouldWarnForHostTrust(): boolean {\n  return isAgentMode() || isCiMode();\n}\n\nexport async function warnIfSandboxed(): Promise<void> {\n  if (warnedThisSession) return;\n  if (!shouldWarnForHostTrust()) return;\n\n  const probe = await runHostProbe();\n  if (probe.ok) return;\n\n  warnedThisSession = true;\n\n  const caps = probe.failures.map((f) => f.capability).join(', ');\n  logVisibleWarn(\n    `Host capabilities may be unavailable (${caps}). This may be a sandboxed environment.`,\n    'Re-run this command on the host shell before trusting auth or API failures.',\n  );\n\n  for (const f of probe.failures) {\n    logInfo(`[host-probe] ${formatHostProbeFailure(f)}`);\n  }\n}\n\nexport function observeHostFailure(\n  capability: HostCapability,\n  error: unknown,\n  details: HostCapabilityDetails = {},\n): void {\n  if (warnedThisSession) return;\n  if (!shouldWarnForHostTrust()) return;\n  if (!isLikelyHostFailure(capability, error)) return;\n\n  warnedThisSession = true;\n\n  const detail = error instanceof Error ? error.message : String(error);\n  logVisibleWarn(\n    `Host capability \"${capability}\" failed (${detail}). This may be a sandboxed environment.`,\n    'Re-run this command on the host shell before trusting auth or API failures.',\n  );\n  logInfo(`[host-probe] ${formatHostFailureContext(capability, details, detail)}`);\n}\n\nexport function _resetProbeState(): void {\n  cachedProbe = undefined;\n  warnedThisSession = false;\n}\n"]}