workos 0.19.0 → 0.20.2

package/dist/lib/settings.d.ts

@@ -1,60 +0,0 @@
-/**
- * Get version from package.json
- */
-export declare function getVersion(): string;
-export interface InstallerConfig {
-    model: string;
-    doctorModel: string;
-    workos: {
-        clientId: string;
-        authkitDomain: string;
-    };
-    telemetry: {
-        enabled: boolean;
-        eventName: string;
-    };
-    proxy: {
-        refreshThresholdMs: number;
-    };
-    nodeVersion: string;
-    logging: {
-        debugMode: boolean;
-    };
-    documentation: {
-        workosDocsUrl: string;
-        dashboardUrl: string;
-        issuesUrl: string;
-    };
-    frameworks: {
-        [key: string]: {
-            port: number;
-            callbackPath: string;
-        };
-    };
-    legacy: {
-        oauthPort: number;
-    };
-    branding: {
-        showAsciiArt: boolean;
-        asciiArt: string;
-        compactAsciiArt: string;
-        useCompact: boolean;
-    };
-}
-/**
- * Get config
- */
-export declare function getConfig(): InstallerConfig;
-/**
- * Get the CLI auth client ID (from config; not env-overridable).
- */
-export declare function getCliAuthClientId(): string;
-/**
- * Get the AuthKit domain.
- * Env var overrides config default.
- *
- * Note: WorkOS service endpoints (API, dashboard, LLM gateway, telemetry)
- * live in utils/urls.ts. AuthKit's domain stays here because it's config-
- * backed rather than derived from the API host.
- */
-export declare function getAuthkitDomain(): string;

package/dist/lib/settings.js

@@ -1,31 +0,0 @@
-import { config, version } from '../cli.config.js';
-/**
- * Get version from package.json
- */
-export function getVersion() {
-    return version;
-}
-/**
- * Get config
- */
-export function getConfig() {
-    return config;
-}
-/**
- * Get the CLI auth client ID (from config; not env-overridable).
- */
-export function getCliAuthClientId() {
-    return config.workos.clientId;
-}
-/**
- * Get the AuthKit domain.
- * Env var overrides config default.
- *
- * Note: WorkOS service endpoints (API, dashboard, LLM gateway, telemetry)
- * live in utils/urls.ts. AuthKit's domain stays here because it's config-
- * backed rather than derived from the API host.
- */
-export function getAuthkitDomain() {
-    return process.env.WORKOS_AUTHKIT_DOMAIN || config.workos.authkitDomain;
-}
-//# sourceMappingURL=settings.js.map

package/dist/lib/settings.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/lib/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AA0CD;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;AAC1E,CAAC","sourcesContent":["import { config, version } from '../cli.config.js';\n\n/**\n * Get version from package.json\n */\nexport function getVersion(): string {\n  return version;\n}\n\nexport interface InstallerConfig {\n  model: string;\n  doctorModel: string;\n  workos: {\n    clientId: string;\n    authkitDomain: string;\n  };\n  telemetry: {\n    enabled: boolean;\n    eventName: string;\n  };\n  proxy: {\n    refreshThresholdMs: number;\n  };\n  nodeVersion: string;\n  logging: {\n    debugMode: boolean;\n  };\n  documentation: {\n    workosDocsUrl: string;\n    dashboardUrl: string;\n    issuesUrl: string;\n  };\n  frameworks: {\n    [key: string]: {\n      port: number;\n      callbackPath: string;\n    };\n  };\n  legacy: {\n    oauthPort: number;\n  };\n  branding: {\n    showAsciiArt: boolean;\n    asciiArt: string;\n    compactAsciiArt: string;\n    useCompact: boolean;\n  };\n}\n\n/**\n * Get config\n */\nexport function getConfig(): InstallerConfig {\n  return config;\n}\n\n/**\n * Get the CLI auth client ID (from config; not env-overridable).\n */\nexport function getCliAuthClientId(): string {\n  return config.workos.clientId;\n}\n\n/**\n * Get the AuthKit domain.\n * Env var overrides config default.\n *\n * Note: WorkOS service endpoints (API, dashboard, LLM gateway, telemetry)\n * live in utils/urls.ts. AuthKit's domain stays here because it's config-\n * backed rather than derived from the API host.\n */\nexport function getAuthkitDomain(): string {\n  return process.env.WORKOS_AUTHKIT_DOMAIN || config.workos.authkitDomain;\n}\n"]}

package/dist/lib/staging-api.d.ts

@@ -1,22 +0,0 @@
-/**
- * Staging Environment Credentials API Client
- *
- * Fetches WorkOS staging credentials (client_id, api_key) from the staging API.
- * Requires an access token with 'staging-environment:credentials:read' scope.
- */
-export interface StagingCredentials {
-    clientId: string;
-    apiKey: string;
-}
-export declare class StagingApiError extends Error {
-    readonly statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
-}
-/**
- * Fetch staging environment credentials from the WorkOS API.
- *
- * @param accessToken - Bearer token with staging-environment:credentials:read scope
- * @returns StagingCredentials containing clientId and apiKey
- * @throws StagingApiError on auth failure, permission denied, or other HTTP errors
- */
-export declare function fetchStagingCredentials(accessToken: string): Promise<StagingCredentials>;

package/dist/lib/staging-api.js

@@ -1,74 +0,0 @@
-/**
- * Staging Environment Credentials API Client
- *
- * Fetches WorkOS staging credentials (client_id, api_key) from the staging API.
- * Requires an access token with 'staging-environment:credentials:read' scope.
- */
-import { logInfo, logError } from '../utils/debug.js';
-export class StagingApiError extends Error {
-    statusCode;
-    constructor(message, statusCode) {
-        super(message);
-        this.statusCode = statusCode;
-        this.name = 'StagingApiError';
-    }
-}
-const STAGING_API_URL = 'https://api.workos.com/x/installer/staging-environment/credentials';
-const REQUEST_TIMEOUT_MS = 30_000;
-/**
- * Fetch staging environment credentials from the WorkOS API.
- *
- * @param accessToken - Bearer token with staging-environment:credentials:read scope
- * @returns StagingCredentials containing clientId and apiKey
- * @throws StagingApiError on auth failure, permission denied, or other HTTP errors
- */
-export async function fetchStagingCredentials(accessToken) {
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
-    logInfo('[staging-api] Fetching credentials from:', STAGING_API_URL);
-    try {
-        const res = await fetch(STAGING_API_URL, {
-            headers: { Authorization: `Bearer ${accessToken}` },
-            signal: controller.signal,
-        });
-        logInfo('[staging-api] Response status:', res.status);
-        if (!res.ok) {
-            const text = await res.text().catch(() => '');
-            logError('[staging-api] Error response:', res.status, text);
-            if (res.status === 401) {
-                throw new StagingApiError('Authentication expired. Please log in again.', 401);
-            }
-            if (res.status === 403) {
-                throw new StagingApiError('Access denied. Ensure you have the required permissions.', 403);
-            }
-            if (res.status === 404) {
-                throw new StagingApiError('No staging environment found. Create one in the WorkOS dashboard.', 404);
-            }
-            throw new StagingApiError(`Failed to fetch credentials: ${res.status} ${text}`, res.status);
-        }
-        const data = (await res.json());
-        // Handle both camelCase and snake_case responses
-        const clientId = data.clientId || data.client_id;
-        const apiKey = data.apiKey || data.api_key;
-        if (!clientId || !apiKey) {
-            logError('[staging-api] Invalid response: missing credentials');
-            throw new StagingApiError('Invalid response: missing clientId or apiKey');
-        }
-        logInfo('[staging-api] Credentials fetched successfully');
-        return { clientId, apiKey };
-    }
-    catch (error) {
-        if (error instanceof StagingApiError)
-            throw error;
-        if (error instanceof Error && error.name === 'AbortError') {
-            logError('[staging-api] Request timed out');
-            throw new StagingApiError('Request timed out. Check your network connection.');
-        }
-        logError('[staging-api] Network error:', error instanceof Error ? error.message : 'Unknown');
-        throw new StagingApiError(`Network error: ${error instanceof Error ? error.message : 'Unknown error'}`);
-    }
-    finally {
-        clearTimeout(timeoutId);
-    }
-}
-//# sourceMappingURL=staging-api.js.map

package/dist/lib/staging-api.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"staging-api.js","sourceRoot":"","sources":["../../src/lib/staging-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAOtD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB;IAFlB,YACE,OAAe,EACC,UAAmB;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,eAAU,GAAV,UAAU,CAAS;QAGnC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,eAAe,GAAG,oEAAoE,CAAC;AAC7F,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAE3E,OAAO,CAAC,0CAA0C,EAAE,eAAe,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;YACvC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,gCAAgC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,QAAQ,CAAC,+BAA+B,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,eAAe,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,GAAG,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,eAAe,CAAC,mEAAmE,EAAE,GAAG,CAAC,CAAC;YACtG,CAAC;YAED,MAAM,IAAI,eAAe,CAAC,gCAAgC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiF,CAAC;QAEhH,iDAAiD;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC;QAE3C,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,QAAQ,CAAC,qDAAqD,CAAC,CAAC;YAChE,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,CAAC,gDAAgD,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1D,QAAQ,CAAC,iCAAiC,CAAC,CAAC;YAC5C,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;QACjF,CAAC;QACD,QAAQ,CAAC,8BAA8B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,IAAI,eAAe,CAAC,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1G,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC","sourcesContent":["/**\n * Staging Environment Credentials API Client\n *\n * Fetches WorkOS staging credentials (client_id, api_key) from the staging API.\n * Requires an access token with 'staging-environment:credentials:read' scope.\n */\n\nimport { logInfo, logError } from '../utils/debug.js';\n\nexport interface StagingCredentials {\n  clientId: string;\n  apiKey: string;\n}\n\nexport class StagingApiError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode?: number,\n  ) {\n    super(message);\n    this.name = 'StagingApiError';\n  }\n}\n\nconst STAGING_API_URL = 'https://api.workos.com/x/installer/staging-environment/credentials';\nconst REQUEST_TIMEOUT_MS = 30_000;\n\n/**\n * Fetch staging environment credentials from the WorkOS API.\n *\n * @param accessToken - Bearer token with staging-environment:credentials:read scope\n * @returns StagingCredentials containing clientId and apiKey\n * @throws StagingApiError on auth failure, permission denied, or other HTTP errors\n */\nexport async function fetchStagingCredentials(accessToken: string): Promise<StagingCredentials> {\n  const controller = new AbortController();\n  const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n\n  logInfo('[staging-api] Fetching credentials from:', STAGING_API_URL);\n  try {\n    const res = await fetch(STAGING_API_URL, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n      signal: controller.signal,\n    });\n\n    logInfo('[staging-api] Response status:', res.status);\n    if (!res.ok) {\n      const text = await res.text().catch(() => '');\n      logError('[staging-api] Error response:', res.status, text);\n\n      if (res.status === 401) {\n        throw new StagingApiError('Authentication expired. Please log in again.', 401);\n      }\n      if (res.status === 403) {\n        throw new StagingApiError('Access denied. Ensure you have the required permissions.', 403);\n      }\n      if (res.status === 404) {\n        throw new StagingApiError('No staging environment found. Create one in the WorkOS dashboard.', 404);\n      }\n\n      throw new StagingApiError(`Failed to fetch credentials: ${res.status} ${text}`, res.status);\n    }\n\n    const data = (await res.json()) as { clientId?: string; apiKey?: string; client_id?: string; api_key?: string };\n\n    // Handle both camelCase and snake_case responses\n    const clientId = data.clientId || data.client_id;\n    const apiKey = data.apiKey || data.api_key;\n\n    if (!clientId || !apiKey) {\n      logError('[staging-api] Invalid response: missing credentials');\n      throw new StagingApiError('Invalid response: missing clientId or apiKey');\n    }\n\n    logInfo('[staging-api] Credentials fetched successfully');\n    return { clientId, apiKey };\n  } catch (error) {\n    if (error instanceof StagingApiError) throw error;\n    if (error instanceof Error && error.name === 'AbortError') {\n      logError('[staging-api] Request timed out');\n      throw new StagingApiError('Request timed out. Check your network connection.');\n    }\n    logError('[staging-api] Network error:', error instanceof Error ? error.message : 'Unknown');\n    throw new StagingApiError(`Network error: ${error instanceof Error ? error.message : 'Unknown error'}`);\n  } finally {\n    clearTimeout(timeoutId);\n  }\n}\n"]}

package/dist/lib/startup-notice-gate.d.ts

@@ -1,21 +0,0 @@
-/**
- * One-notice-per-run coordinator for the startup stderr notices.
- *
- * Three middlewares can each want to print a one-line stderr notice at startup:
- * the first-run telemetry notice, the unclaimed-environment warning, and the
- * MCP banner. Stacking two or three boxes on a single command is noise, so this
- * module is the shared latch — whichever fires first calls
- * markStartupNoticeShown(), and the lower-priority MCP banner checks
- * hasStartupNoticeShown() and defers.
- *
- * Ordering IS priority: bin.ts runs the telemetry + unclaimed middlewares before
- * the MCP banner middleware, so those two always win a contested run. In-memory
- * only (a run is a single CLI process); the per-machine "already shown" state is
- * persisted separately by each notice.
- */
-/** Record that a startup notice has displayed this run. */
-export declare function markStartupNoticeShown(): void;
-/** Whether any startup notice has already displayed this run. */
-export declare function hasStartupNoticeShown(): boolean;
-/** Reset the latch (for testing). */
-export declare function resetStartupNoticeGate(): void;

package/dist/lib/startup-notice-gate.js

@@ -1,29 +0,0 @@
-/**
- * One-notice-per-run coordinator for the startup stderr notices.
- *
- * Three middlewares can each want to print a one-line stderr notice at startup:
- * the first-run telemetry notice, the unclaimed-environment warning, and the
- * MCP banner. Stacking two or three boxes on a single command is noise, so this
- * module is the shared latch — whichever fires first calls
- * markStartupNoticeShown(), and the lower-priority MCP banner checks
- * hasStartupNoticeShown() and defers.
- *
- * Ordering IS priority: bin.ts runs the telemetry + unclaimed middlewares before
- * the MCP banner middleware, so those two always win a contested run. In-memory
- * only (a run is a single CLI process); the per-machine "already shown" state is
- * persisted separately by each notice.
- */
-let shown = false;
-/** Record that a startup notice has displayed this run. */
-export function markStartupNoticeShown() {
-    shown = true;
-}
-/** Whether any startup notice has already displayed this run. */
-export function hasStartupNoticeShown() {
-    return shown;
-}
-/** Reset the latch (for testing). */
-export function resetStartupNoticeGate() {
-    shown = false;
-}
-//# sourceMappingURL=startup-notice-gate.js.map

package/dist/lib/startup-notice-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-notice-gate.js","sourceRoot":"","sources":["../../src/lib/startup-notice-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,IAAI,KAAK,GAAG,KAAK,CAAC;AAElB,2DAA2D;AAC3D,MAAM,UAAU,sBAAsB;IACpC,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,sBAAsB;IACpC,KAAK,GAAG,KAAK,CAAC;AAChB,CAAC","sourcesContent":["/**\n * One-notice-per-run coordinator for the startup stderr notices.\n *\n * Three middlewares can each want to print a one-line stderr notice at startup:\n * the first-run telemetry notice, the unclaimed-environment warning, and the\n * MCP banner. Stacking two or three boxes on a single command is noise, so this\n * module is the shared latch — whichever fires first calls\n * markStartupNoticeShown(), and the lower-priority MCP banner checks\n * hasStartupNoticeShown() and defers.\n *\n * Ordering IS priority: bin.ts runs the telemetry + unclaimed middlewares before\n * the MCP banner middleware, so those two always win a contested run. In-memory\n * only (a run is a single CLI process); the per-machine \"already shown\" state is\n * persisted separately by each notice.\n */\n\nlet shown = false;\n\n/** Record that a startup notice has displayed this run. */\nexport function markStartupNoticeShown(): void {\n  shown = true;\n}\n\n/** Whether any startup notice has already displayed this run. */\nexport function hasStartupNoticeShown(): boolean {\n  return shown;\n}\n\n/** Reset the latch (for testing). */\nexport function resetStartupNoticeGate(): void {\n  shown = false;\n}\n"]}

package/dist/lib/telemetry-notice.d.ts

@@ -1,25 +0,0 @@
-/**
- * First-run telemetry notice.
- *
- * Prints a one-time, stderr-only notice telling the user that anonymous CLI
- * usage telemetry is being collected and how to turn it off. Shown at most once
- * ever (backed by the persisted `noticeShownAt` timestamp in preferences.json),
- * only in interactive human mode, and never on the machine-readable path.
- *
- * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,
- * a `!isJsonMode()` gate, the shared renderStderrNotice helper, and a never-throws
- * contract so it can never block command execution. The one structural
- * difference is persistence — this notice writes `noticeShownAt` the first time
- * it actually displays so it never re-shows across runs.
- */
-/**
- * Show the first-run telemetry notice if it has never been displayed.
- *
- * Gate order is load-bearing: every suppression check runs BEFORE
- * markNoticeShown(), so a non-human first run (--json / piped / CI) never
- * consumes the one-time display. The flag is set only when the box is actually
- * rendered, so a real human eventually sees it. Never throws.
- */
-export declare function maybeShowTelemetryNotice(): void;
-/** Reset session state (for testing). */
-export declare function resetTelemetryNoticeState(): void;

package/dist/lib/telemetry-notice.js

@@ -1,58 +0,0 @@
-/**
- * First-run telemetry notice.
- *
- * Prints a one-time, stderr-only notice telling the user that anonymous CLI
- * usage telemetry is being collected and how to turn it off. Shown at most once
- * ever (backed by the persisted `noticeShownAt` timestamp in preferences.json),
- * only in interactive human mode, and never on the machine-readable path.
- *
- * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,
- * a `!isJsonMode()` gate, the shared renderStderrNotice helper, and a never-throws
- * contract so it can never block command execution. The one structural
- * difference is persistence — this notice writes `noticeShownAt` the first time
- * it actually displays so it never re-shows across runs.
- */
-import chalk from 'chalk';
-import { isJsonMode } from '../utils/output.js';
-import { renderStderrNotice } from '../utils/box.js';
-import { formatWorkOSCommand } from '../utils/command-invocation.js';
-import { isNoticeShown, markNoticeShown, isTelemetryOptedOut } from './preferences.js';
-import { markStartupNoticeShown } from './startup-notice-gate.js';
-let shownThisSession = false;
-/**
- * Show the first-run telemetry notice if it has never been displayed.
- *
- * Gate order is load-bearing: every suppression check runs BEFORE
- * markNoticeShown(), so a non-human first run (--json / piped / CI) never
- * consumes the one-time display. The flag is set only when the box is actually
- * rendered, so a real human eventually sees it. Never throws.
- */
-export function maybeShowTelemetryNotice() {
-    try {
-        if (shownThisSession)
-            return;
-        if (isJsonMode())
-            return; // suppress in --json / non-TTY / CI (output auto-switches to json)
-        if (isTelemetryOptedOut())
-            return; // already opted out — nothing to inform
-        if (isNoticeShown())
-            return; // already shown once, ever
-        const optOut = chalk.cyan(formatWorkOSCommand('telemetry opt-out'));
-        renderStderrNotice(`${chalk.cyan('ℹ')} ${chalk.dim('Anonymous CLI usage telemetry is on.')} ${chalk.dim('Disable:')} ${optOut}`);
-        // Set the per-session guard and persist ONLY after a successful render, so a
-        // render failure (caught below) lets a later command in this process retry
-        // rather than silently suppressing the notice for the rest of the session.
-        shownThisSession = true;
-        markNoticeShown();
-        // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.
-        markStartupNoticeShown();
-    }
-    catch {
-        // Never block command execution.
-    }
-}
-/** Reset session state (for testing). */
-export function resetTelemetryNoticeState() {
-    shownThisSession = false;
-}
-//# sourceMappingURL=telemetry-notice.js.map

package/dist/lib/telemetry-notice.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"telemetry-notice.js","sourceRoot":"","sources":["../../src/lib/telemetry-notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,IAAI,gBAAgB;YAAE,OAAO;QAC7B,IAAI,UAAU,EAAE;YAAE,OAAO,CAAC,mEAAmE;QAC7F,IAAI,mBAAmB,EAAE;YAAE,OAAO,CAAC,wCAAwC;QAC3E,IAAI,aAAa,EAAE;YAAE,OAAO,CAAC,2BAA2B;QAExD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACpE,kBAAkB,CAChB,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,EAAE,CAC7G,CAAC;QACF,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,gBAAgB,GAAG,IAAI,CAAC;QACxB,eAAe,EAAE,CAAC;QAClB,6EAA6E;QAC7E,sBAAsB,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,yBAAyB;IACvC,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * First-run telemetry notice.\n *\n * Prints a one-time, stderr-only notice telling the user that anonymous CLI\n * usage telemetry is being collected and how to turn it off. Shown at most once\n * ever (backed by the persisted `noticeShownAt` timestamp in preferences.json),\n * only in interactive human mode, and never on the machine-readable path.\n *\n * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,\n * a `!isJsonMode()` gate, the shared renderStderrNotice helper, and a never-throws\n * contract so it can never block command execution. The one structural\n * difference is persistence — this notice writes `noticeShownAt` the first time\n * it actually displays so it never re-shows across runs.\n */\n\nimport chalk from 'chalk';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrNotice } from '../utils/box.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { isNoticeShown, markNoticeShown, isTelemetryOptedOut } from './preferences.js';\nimport { markStartupNoticeShown } from './startup-notice-gate.js';\n\nlet shownThisSession = false;\n\n/**\n * Show the first-run telemetry notice if it has never been displayed.\n *\n * Gate order is load-bearing: every suppression check runs BEFORE\n * markNoticeShown(), so a non-human first run (--json / piped / CI) never\n * consumes the one-time display. The flag is set only when the box is actually\n * rendered, so a real human eventually sees it. Never throws.\n */\nexport function maybeShowTelemetryNotice(): void {\n  try {\n    if (shownThisSession) return;\n    if (isJsonMode()) return; // suppress in --json / non-TTY / CI (output auto-switches to json)\n    if (isTelemetryOptedOut()) return; // already opted out — nothing to inform\n    if (isNoticeShown()) return; // already shown once, ever\n\n    const optOut = chalk.cyan(formatWorkOSCommand('telemetry opt-out'));\n    renderStderrNotice(\n      `${chalk.cyan('ℹ')} ${chalk.dim('Anonymous CLI usage telemetry is on.')} ${chalk.dim('Disable:')} ${optOut}`,\n    );\n    // Set the per-session guard and persist ONLY after a successful render, so a\n    // render failure (caught below) lets a later command in this process retry\n    // rather than silently suppressing the notice for the rest of the session.\n    shownThisSession = true;\n    markNoticeShown();\n    // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.\n    markStartupNoticeShown();\n  } catch {\n    // Never block command execution.\n  }\n}\n\n/** Reset session state (for testing). */\nexport function resetTelemetryNoticeState(): void {\n  shownThisSession = false;\n}\n"]}

package/dist/lib/token-refresh-client.d.ts

@@ -1,23 +0,0 @@
-/**
- * Token refresh client for WorkOS OAuth
- */
-export interface RefreshResult {
-    success: boolean;
-    accessToken?: string;
-    refreshToken?: string;
-    expiresAt?: number;
-    error?: string;
-    errorType?: 'invalid_grant' | 'network' | 'server' | 'unknown';
-}
-/**
- * Refresh access token using stored refresh token.
- *
- * @param authkitDomain - The AuthKit domain (e.g., https://auth.workos.com)
- * @param clientId - OAuth client ID
- * @returns RefreshResult with new tokens or error details
- */
-export declare function refreshAccessToken(authkitDomain: string, clientId: string): Promise<RefreshResult>;
-/**
- * Check if token needs refresh (expires within threshold).
- */
-export declare function tokenNeedsRefresh(expiresAt: number, thresholdMs?: number): boolean;

package/dist/lib/token-refresh-client.js

@@ -1,89 +0,0 @@
-/**
- * Token refresh client for WorkOS OAuth
- */
-import { logInfo, logError } from '../utils/debug.js';
-import { getCredentials } from './credentials.js';
-import { formatWorkOSCommand } from '../utils/command-invocation.js';
-const REFRESH_TIMEOUT_MS = 30_000;
-/**
- * Refresh access token using stored refresh token.
- *
- * @param authkitDomain - The AuthKit domain (e.g., https://auth.workos.com)
- * @param clientId - OAuth client ID
- * @returns RefreshResult with new tokens or error details
- */
-export async function refreshAccessToken(authkitDomain, clientId) {
-    const creds = getCredentials();
-    if (!creds?.refreshToken) {
-        return {
-            success: false,
-            error: 'No refresh token available',
-            errorType: 'invalid_grant',
-        };
-    }
-    const tokenUrl = `${authkitDomain}/oauth2/token`;
-    logInfo('[token-refresh] Attempting token refresh');
-    try {
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);
-        const response = await fetch(tokenUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                grant_type: 'refresh_token',
-                refresh_token: creds.refreshToken,
-                client_id: clientId,
-            }),
-            signal: controller.signal,
-        });
-        clearTimeout(timeout);
-        if (!response.ok) {
-            const errorData = (await response.json());
-            logError('[token-refresh] Refresh failed:', errorData.error);
-            if (errorData.error === 'invalid_grant') {
-                return {
-                    success: false,
-                    error: `Session expired. Run \`${formatWorkOSCommand('auth login')}\` to re-authenticate.`,
-                    errorType: 'invalid_grant',
-                };
-            }
-            return {
-                success: false,
-                error: errorData.error_description || errorData.error,
-                errorType: 'server',
-            };
-        }
-        const data = (await response.json());
-        const expiresAt = Date.now() + data.expires_in * 1000;
-        logInfo('[token-refresh] Token refreshed successfully, expires:', new Date(expiresAt).toISOString());
-        return {
-            success: true,
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token, // May be rotated
-            expiresAt,
-        };
-    }
-    catch (error) {
-        if (error instanceof Error && error.name === 'AbortError') {
-            logError('[token-refresh] Refresh timed out');
-            return {
-                success: false,
-                error: 'Token refresh timed out',
-                errorType: 'network',
-            };
-        }
-        logError('[token-refresh] Network error:', error);
-        return {
-            success: false,
-            error: `Network error: ${error.message}`,
-            errorType: 'network',
-        };
-    }
-}
-/**
- * Check if token needs refresh (expires within threshold).
- */
-export function tokenNeedsRefresh(expiresAt, thresholdMs = 2 * 60 * 1000) {
-    return Date.now() + thresholdMs >= expiresAt;
-}
-//# sourceMappingURL=token-refresh-client.js.map

package/dist/lib/token-refresh-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-refresh-client.js","sourceRoot":"","sources":["../../src/lib/token-refresh-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAuBrE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,QAAgB;IAC9E,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,4BAA4B;YACnC,SAAS,EAAE,eAAe;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,aAAa,eAAe,CAAC;IACjD,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAEzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,SAAS,EAAE,QAAQ;aACpB,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAChE,QAAQ,CAAC,iCAAiC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAE7D,IAAI,SAAS,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACxC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,0BAA0B,mBAAmB,CAAC,YAAY,CAAC,wBAAwB;oBAC1F,SAAS,EAAE,eAAe;iBAC3B,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK;gBACrD,SAAS,EAAE,QAAQ;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEtD,OAAO,CAAC,wDAAwD,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAErG,OAAO;YACL,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,iBAAiB;YACnD,SAAS;SACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1D,QAAQ,CAAC,mCAAmC,CAAC,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;gBAChC,SAAS,EAAE,SAAS;aACrB,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kBAAmB,KAAe,CAAC,OAAO,EAAE;YACnD,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,cAAsB,CAAC,GAAG,EAAE,GAAG,IAAI;IACtF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,IAAI,SAAS,CAAC;AAC/C,CAAC","sourcesContent":["/**\n * Token refresh client for WorkOS OAuth\n */\n\nimport { logInfo, logError } from '../utils/debug.js';\nimport { getCredentials } from './credentials.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nexport interface RefreshResult {\n  success: boolean;\n  accessToken?: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  error?: string;\n  errorType?: 'invalid_grant' | 'network' | 'server' | 'unknown';\n}\n\ninterface TokenRefreshResponse {\n  access_token: string;\n  refresh_token?: string;\n  token_type: string;\n  expires_in: number;\n}\n\ninterface TokenErrorResponse {\n  error: string;\n  error_description?: string;\n}\n\nconst REFRESH_TIMEOUT_MS = 30_000;\n\n/**\n * Refresh access token using stored refresh token.\n *\n * @param authkitDomain - The AuthKit domain (e.g., https://auth.workos.com)\n * @param clientId - OAuth client ID\n * @returns RefreshResult with new tokens or error details\n */\nexport async function refreshAccessToken(authkitDomain: string, clientId: string): Promise<RefreshResult> {\n  const creds = getCredentials();\n\n  if (!creds?.refreshToken) {\n    return {\n      success: false,\n      error: 'No refresh token available',\n      errorType: 'invalid_grant',\n    };\n  }\n\n  const tokenUrl = `${authkitDomain}/oauth2/token`;\n  logInfo('[token-refresh] Attempting token refresh');\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: creds.refreshToken,\n        client_id: clientId,\n      }),\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (!response.ok) {\n      const errorData = (await response.json()) as TokenErrorResponse;\n      logError('[token-refresh] Refresh failed:', errorData.error);\n\n      if (errorData.error === 'invalid_grant') {\n        return {\n          success: false,\n          error: `Session expired. Run \\`${formatWorkOSCommand('auth login')}\\` to re-authenticate.`,\n          errorType: 'invalid_grant',\n        };\n      }\n\n      return {\n        success: false,\n        error: errorData.error_description || errorData.error,\n        errorType: 'server',\n      };\n    }\n\n    const data = (await response.json()) as TokenRefreshResponse;\n    const expiresAt = Date.now() + data.expires_in * 1000;\n\n    logInfo('[token-refresh] Token refreshed successfully, expires:', new Date(expiresAt).toISOString());\n\n    return {\n      success: true,\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token, // May be rotated\n      expiresAt,\n    };\n  } catch (error) {\n    if (error instanceof Error && error.name === 'AbortError') {\n      logError('[token-refresh] Refresh timed out');\n      return {\n        success: false,\n        error: 'Token refresh timed out',\n        errorType: 'network',\n      };\n    }\n\n    logError('[token-refresh] Network error:', error);\n    return {\n      success: false,\n      error: `Network error: ${(error as Error).message}`,\n      errorType: 'network',\n    };\n  }\n}\n\n/**\n * Check if token needs refresh (expires within threshold).\n */\nexport function tokenNeedsRefresh(expiresAt: number, thresholdMs: number = 2 * 60 * 1000): boolean {\n  return Date.now() + thresholdMs >= expiresAt;\n}\n"]}

package/dist/lib/token-refresh.d.ts

@@ -1,12 +0,0 @@
-import { Credentials } from './credentials.js';
-export interface TokenValidationResult {
-    success: boolean;
-    credentials?: Credentials;
-    error?: string;
-}
-/**
- * Check if the current token is valid.
- * If expired, returns an error prompting re-authentication.
- * No refresh is attempted here; callers decide whether to refresh or re-authenticate.
- */
-export declare function ensureValidToken(): Promise<TokenValidationResult>;

package/dist/lib/token-refresh.js

@@ -1,27 +0,0 @@
-import { getCredentials, isTokenExpired } from './credentials.js';
-import { logInfo } from '../utils/debug.js';
-import { formatWorkOSCommand } from '../utils/command-invocation.js';
-/**
- * Check if the current token is valid.
- * If expired, returns an error prompting re-authentication.
- * No refresh is attempted here; callers decide whether to refresh or re-authenticate.
- */
-export async function ensureValidToken() {
-    const creds = getCredentials();
-    if (!creds) {
-        logInfo('[ensureValidToken] No credentials found');
-        return { success: false, error: 'Not authenticated' };
-    }
-    logInfo(`[ensureValidToken] Token expiresAt: ${new Date(creds.expiresAt).toISOString()}`);
-    logInfo(`[ensureValidToken] Current time: ${new Date().toISOString()}`);
-    if (isTokenExpired(creds)) {
-        logInfo('[ensureValidToken] Token expired, re-authentication required');
-        return {
-            success: false,
-            error: `Session expired. Run \`${formatWorkOSCommand('auth login')}\` to re-authenticate.`,
-        };
-    }
-    logInfo('[ensureValidToken] Token valid');
-    return { success: true, credentials: creds };
-}
-//# sourceMappingURL=token-refresh.js.map

package/dist/lib/token-refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/lib/token-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAe,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAQrE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,yCAAyC,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,uCAAuC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,CAAC,oCAAoC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAExE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,8DAA8D,CAAC,CAAC;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0BAA0B,mBAAmB,CAAC,YAAY,CAAC,wBAAwB;SAC3F,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { getCredentials, isTokenExpired, Credentials } from './credentials.js';\nimport { logInfo } from '../utils/debug.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nexport interface TokenValidationResult {\n  success: boolean;\n  credentials?: Credentials;\n  error?: string;\n}\n\n/**\n * Check if the current token is valid.\n * If expired, returns an error prompting re-authentication.\n * No refresh is attempted here; callers decide whether to refresh or re-authenticate.\n */\nexport async function ensureValidToken(): Promise<TokenValidationResult> {\n  const creds = getCredentials();\n\n  if (!creds) {\n    logInfo('[ensureValidToken] No credentials found');\n    return { success: false, error: 'Not authenticated' };\n  }\n\n  logInfo(`[ensureValidToken] Token expiresAt: ${new Date(creds.expiresAt).toISOString()}`);\n  logInfo(`[ensureValidToken] Current time: ${new Date().toISOString()}`);\n\n  if (isTokenExpired(creds)) {\n    logInfo('[ensureValidToken] Token expired, re-authentication required');\n    return {\n      success: false,\n      error: `Session expired. Run \\`${formatWorkOSCommand('auth login')}\\` to re-authenticate.`,\n    };\n  }\n\n  logInfo('[ensureValidToken] Token valid');\n  return { success: true, credentials: creds };\n}\n"]}

package/dist/lib/unclaimed-env-api.d.ts

@@ -1,42 +0,0 @@
-/**
- * Unclaimed Environment Provisioning API Client
- *
- * Provisions unauthenticated unclaimed environments and generates claim nonces.
- * No authentication required for provisioning — claim tokens are used for
- * subsequent claim operations.
- */
-export interface UnclaimedEnvProvisionResult {
-    clientId: string;
-    apiKey: string;
-    claimToken: string;
-    authkitDomain: string;
-}
-export interface ClaimNonceResult {
-    nonce: string;
-    alreadyClaimed: false;
-}
-export interface AlreadyClaimedResult {
-    alreadyClaimed: true;
-}
-export type ClaimNonceResponse = ClaimNonceResult | AlreadyClaimedResult;
-export declare class UnclaimedEnvApiError extends Error {
-    readonly statusCode?: number | undefined;
-    constructor(message: string, statusCode?: number | undefined);
-}
-/**
- * Provision a new unclaimed environment. No authentication required.
- *
- * @returns UnclaimedEnvProvisionResult containing clientId, apiKey, claimToken, and authkitDomain
- * @throws UnclaimedEnvApiError on rate limit, network failure, timeout, or server error
- */
-export declare function provisionUnclaimedEnvironment(): Promise<UnclaimedEnvProvisionResult>;
-/**
- * Generate a claim nonce from a claim token + client ID.
- * Returns { alreadyClaimed: true } if environment was already claimed.
- *
- * @param clientId - The client ID of the unclaimed environment
- * @param claimToken - The claim token from provisioning
- * @returns ClaimNonceResponse — either a nonce or already-claimed indicator
- * @throws UnclaimedEnvApiError on invalid token, not found, or server error
- */
-export declare function createClaimNonce(clientId: string, claimToken: string): Promise<ClaimNonceResponse>;