workos 0.3.2 → 0.4.5

package/dist/bin.js

@@ -11,6 +11,7 @@ import { getConfig } from './lib/settings.js';
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
 import { ensureAuthenticated } from './lib/ensure-auth.js';
+import { checkForUpdates } from './lib/version-check.js';
 const NODE_VERSION_RANGE = getConfig().nodeVersion;
 // Have to run this above the other imports because they are importing clack that
 // has the problematic imports.
@@ -20,7 +21,21 @@ if (!satisfies(process.version, NODE_VERSION_RANGE)) {
 }
 import { isNonInteractiveEnvironment } from './utils/environment.js';
 import clack from './utils/clack.js';
-// Shared options for wizard commands (default and dashboard)
+/** Apply insecure storage flag if set */
+async function applyInsecureStorage(insecureStorage) {
+    if (insecureStorage) {
+        const { setInsecureStorage } = await import('./lib/credentials.js');
+        setInsecureStorage(true);
+    }
+}
+/** Shared insecure-storage option for commands that access credentials */
+const insecureStorageOption = {
+    'insecure-storage': {
+        default: false,
+        describe: 'Store credentials in plaintext file instead of system keyring',
+        type: 'boolean',
+    },
+};
 /**
  * Wrap a command handler with authentication check.
  * Ensures valid auth before executing the handler.
@@ -28,9 +43,10 @@ import clack from './utils/clack.js';
  */
 function withAuth(handler) {
     return async (argv) => {
-        if (!argv.skipAuth) {
+        const typedArgv = argv;
+        await applyInsecureStorage(typedArgv.insecureStorage);
+        if (!typedArgv.skipAuth)
             await ensureAuthenticated();
-        }
         await handler(argv);
     };
 }
@@ -46,6 +62,7 @@ const installerOptions = {
         describe: 'Enable verbose logging',
         type: 'boolean',
     },
+    ...insecureStorageOption,
     // Hidden dev/automation flags (use env vars)
     local: {
         default: false,
@@ -110,14 +127,18 @@ const installerOptions = {
         type: 'boolean',
     },
 };
+// Check for updates (blocks up to 500ms)
+await checkForUpdates();
 yargs(hideBin(process.argv))
     .env('WORKOS_INSTALLER')
-    .command('login', 'Authenticate with WorkOS', {}, async () => {
+    .command('login', 'Authenticate with WorkOS', insecureStorageOption, async (argv) => {
+    await applyInsecureStorage(argv.insecureStorage);
     const { runLogin } = await import('./commands/login.js');
     await runLogin();
     process.exit(0);
 })
-    .command('logout', 'Remove stored credentials', {}, async () => {
+    .command('logout', 'Remove stored credentials', insecureStorageOption, async (argv) => {
+    await applyInsecureStorage(argv.insecureStorage);
     const { runLogout } = await import('./commands/logout.js');
     await runLogout();
 })
@@ -157,7 +178,7 @@ yargs(hideBin(process.argv))
     const { handleInstall } = await import('./commands/install.js');
     await handleInstall({ ...argv, dashboard: true });
 }))
-    .command(['$0'], 'WorkOS AuthKit CLI', (yargs) => yargs, async () => {
+    .command(['$0'], 'WorkOS AuthKit CLI', (yargs) => yargs.options(insecureStorageOption), async (argv) => {
     // Non-TTY: show help
     if (isNonInteractiveEnvironment()) {
         yargs(hideBin(process.argv)).showHelp();
@@ -171,6 +192,7 @@ yargs(hideBin(process.argv))
         process.exit(0);
     }
     // Auth check happens HERE, after user confirms
+    await applyInsecureStorage(argv.insecureStorage);
     await ensureAuthenticated();
     const { handleInstall } = await import('./commands/install.js');
     await handleInstall({ dashboard: false });

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,kEAAkE;AAClE,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,wEAAwE;IACxE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,kBAAkB,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;AAEnD,iFAAiF;AACjF,+BAA+B;AAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC;IACpD,GAAG,CACD,6CAA6C,kBAAkB,2BAA2B,OAAO,CAAC,OAAO,wCAAwC,CAClJ,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,MAAM,kBAAkB,CAAC;AAErC,6DAA6D;AAC7D;;;;GAIG;AACH,SAAS,QAAQ,CAAI,OAAmC;IACtD,OAAO,KAAK,EAAE,IAAO,EAAE,EAAE;QACvB,IAAI,CAAE,IAA+B,CAAC,QAAQ,EAAE,CAAC;YAC/C,MAAM,mBAAmB,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE;QACN,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,qDAAqD;QAC/D,IAAI,EAAE,SAAkB;KACzB;IACD,KAAK,EAAE;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,wBAAwB;QAClC,IAAI,EAAE,SAAkB;KACzB;IACD,6CAA6C;IAC7C,KAAK,EAAE;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,EAAE,EAAE;QACF,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,WAAW,EAAE;QACX,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,SAAS,EAAE;QACT,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,IAAI;KACb;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,IAAI;KACb;IACD,OAAO,EAAE;QACP,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,oBAAoB;IACpB,cAAc,EAAE;QACd,QAAQ,EAAE,mEAAmE;QAC7E,IAAI,EAAE,QAAiB;KACxB;IACD,cAAc,EAAE;QACd,QAAQ,EAAE,qEAAqE;QAC/E,IAAI,EAAE,QAAiB;KACxB;IACD,aAAa,EAAE;QACb,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,0DAA0D;QACpE,IAAI,EAAE,SAAkB;KACzB;IACD,aAAa,EAAE;QACb,QAAQ,EAAE,wCAAwC;QAClD,IAAI,EAAE,QAAiB;KACxB;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,CAAU;QACrF,IAAI,EAAE,QAAiB;KACxB;IACD,eAAe,EAAE;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,4DAA4D;QACtE,IAAI,EAAE,SAAkB;KACzB;IACD,SAAS,EAAE;QACT,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,gCAAgC;QAC1C,IAAI,EAAE,SAAkB;KACzB;CACF,CAAC;AAEF,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,GAAG,CAAC,kBAAkB,CAAC;KACvB,OAAO,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACzD,MAAM,QAAQ,EAAE,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;KACD,OAAO,CAAC,QAAQ,EAAE,2BAA2B,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;KACD,OAAO,CACN,eAAe,EACf,iDAAiD,EACjD,CAAC,KAAK,EAAE,EAAE;IACR,OAAO,KAAK;SACT,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,2BAA2B;KACzC,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,6DAA6D;KAC3E,CAAC,CAAC;AACP,CAAC,EACD,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACxE,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,IAA2B;QACtC,KAAK,EAAE,IAAI,CAAC,KAA6B;QACzC,KAAK,EAAE,IAAI,CAAC,KAA6B;KAC1C,CAAC,CAAC;AACL,CAAC,CAAC,CACH;KACA,OAAO,CACN,SAAS,EACT,0CAA0C,EAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC1C,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC,CACH;KACA,OAAO,CACN,WAAW,EACX,KAAK,EAAE,mBAAmB;AAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC1C,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC,CAAC,CACH;KACA,OAAO,CACN,CAAC,IAAI,CAAC,EACN,oBAAoB,EACpB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAChB,KAAK,IAAI,EAAE;IACT,qBAAqB;IACrB,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IAED,0CAA0C;IAC1C,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;QACxC,OAAO,EAAE,4BAA4B;KACtC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+CAA+C;IAC/C,MAAM,mBAAmB,EAAE,CAAC;IAE5B,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAS,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF;KACA,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;KAClB,OAAO,EAAE;KACT,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;KACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC","sourcesContent":["#!/usr/bin/env node\n\n// Load .env.local for local development when --local flag is used\nif (process.argv.includes('--local') || process.env.INSTALLER_DEV) {\n  const { config } = await import('dotenv');\n  // bin.ts compiles to dist/bin.js, so go up one level to find .env.local\n  config({ path: new URL('../.env.local', import.meta.url).pathname });\n}\n\nimport { satisfies } from 'semver';\nimport { red } from './utils/logging.js';\nimport { getConfig } from './lib/settings.js';\n\nimport yargs from 'yargs';\nimport { hideBin } from 'yargs/helpers';\nimport chalk from 'chalk';\nimport { ensureAuthenticated } from './lib/ensure-auth.js';\n\nconst NODE_VERSION_RANGE = getConfig().nodeVersion;\n\n// Have to run this above the other imports because they are importing clack that\n// has the problematic imports.\nif (!satisfies(process.version, NODE_VERSION_RANGE)) {\n  red(\n    `WorkOS AuthKit installer requires Node.js ${NODE_VERSION_RANGE}. You are using Node.js ${process.version}. Please upgrade your Node.js version.`,\n  );\n  process.exit(1);\n}\n\nimport { isNonInteractiveEnvironment } from './utils/environment.js';\nimport clack from './utils/clack.js';\n\n// Shared options for wizard commands (default and dashboard)\n/**\n * Wrap a command handler with authentication check.\n * Ensures valid auth before executing the handler.\n * Respects --skip-auth flag for CI/testing.\n */\nfunction withAuth<T>(handler: (argv: T) => Promise<void>): (argv: T) => Promise<void> {\n  return async (argv: T) => {\n    if (!(argv as { skipAuth?: boolean }).skipAuth) {\n      await ensureAuthenticated();\n    }\n    await handler(argv);\n  };\n}\n\nconst installerOptions = {\n  direct: {\n    alias: 'D',\n    default: false,\n    describe: 'Use your own Anthropic API key (bypass llm-gateway)',\n    type: 'boolean' as const,\n  },\n  debug: {\n    default: false,\n    describe: 'Enable verbose logging',\n    type: 'boolean' as const,\n  },\n  // Hidden dev/automation flags (use env vars)\n  local: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  ci: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  'skip-auth': {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  'api-key': {\n    type: 'string' as const,\n    hidden: true,\n  },\n  'client-id': {\n    type: 'string' as const,\n    hidden: true,\n  },\n  inspect: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  // User-facing flags\n  'homepage-url': {\n    describe: 'App homepage URL for WorkOS (defaults to http://localhost:{port})',\n    type: 'string' as const,\n  },\n  'redirect-uri': {\n    describe: 'Redirect URI for WorkOS callback (defaults to framework convention)',\n    type: 'string' as const,\n  },\n  'no-validate': {\n    default: false,\n    describe: 'Skip post-installation validation (includes build check)',\n    type: 'boolean' as const,\n  },\n  'install-dir': {\n    describe: 'Directory to install WorkOS AuthKit in',\n    type: 'string' as const,\n  },\n  integration: {\n    describe: 'Integration to set up',\n    choices: ['nextjs', 'react', 'tanstack-start', 'react-router', 'vanilla-js'] as const,\n    type: 'string' as const,\n  },\n  'force-install': {\n    default: false,\n    describe: 'Force install packages even if peer dependency checks fail',\n    type: 'boolean' as const,\n  },\n  dashboard: {\n    alias: 'd',\n    default: false,\n    describe: 'Run with visual dashboard mode',\n    type: 'boolean' as const,\n  },\n};\n\nyargs(hideBin(process.argv))\n  .env('WORKOS_INSTALLER')\n  .command('login', 'Authenticate with WorkOS', {}, async () => {\n    const { runLogin } = await import('./commands/login.js');\n    await runLogin();\n    process.exit(0);\n  })\n  .command('logout', 'Remove stored credentials', {}, async () => {\n    const { runLogout } = await import('./commands/logout.js');\n    await runLogout();\n  })\n  .command(\n    'install-skill',\n    'Install bundled AuthKit skills to coding agents',\n    (yargs) => {\n      return yargs\n        .option('list', {\n          alias: 'l',\n          type: 'boolean',\n          description: 'List available skills without installing',\n        })\n        .option('skill', {\n          alias: 's',\n          type: 'array',\n          string: true,\n          description: 'Install specific skill(s)',\n        })\n        .option('agent', {\n          alias: 'a',\n          type: 'array',\n          string: true,\n          description: 'Target specific agent(s): claude-code, codex, cursor, goose',\n        });\n    },\n    withAuth(async (argv) => {\n      const { runInstallSkill } = await import('./commands/install-skill.js');\n      await runInstallSkill({\n        list: argv.list as boolean | undefined,\n        skill: argv.skill as string[] | undefined,\n        agent: argv.agent as string[] | undefined,\n      });\n    }),\n  )\n  .command(\n    'install',\n    'Install WorkOS AuthKit into your project',\n    (yargs) => yargs.options(installerOptions),\n    withAuth(async (argv) => {\n      const { handleInstall } = await import('./commands/install.js');\n      await handleInstall(argv);\n    }),\n  )\n  .command(\n    'dashboard',\n    false, // hidden from help\n    (yargs) => yargs.options(installerOptions),\n    withAuth(async (argv) => {\n      const { handleInstall } = await import('./commands/install.js');\n      await handleInstall({ ...argv, dashboard: true });\n    }),\n  )\n  .command(\n    ['$0'],\n    'WorkOS AuthKit CLI',\n    (yargs) => yargs,\n    async () => {\n      // Non-TTY: show help\n      if (isNonInteractiveEnvironment()) {\n        yargs(hideBin(process.argv)).showHelp();\n        return;\n      }\n\n      // TTY: ask if user wants to run installer\n      const shouldInstall = await clack.confirm({\n        message: 'Run the AuthKit installer?',\n      });\n\n      if (clack.isCancel(shouldInstall) || !shouldInstall) {\n        process.exit(0);\n      }\n\n      // Auth check happens HERE, after user confirms\n      await ensureAuthenticated();\n\n      const { handleInstall } = await import('./commands/install.js');\n      await handleInstall({ dashboard: false } as any);\n      process.exit(0);\n    },\n  )\n  .strict()\n  .help()\n  .alias('help', 'h')\n  .version()\n  .alias('version', 'v')\n  .wrap(process.stdout.isTTY && process.stdout.columns ? process.stdout.columns : 80).argv;\n"]}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,kEAAkE;AAClE,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,wEAAwE;IACxE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;AAEnD,iFAAiF;AACjF,+BAA+B;AAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAC;IACpD,GAAG,CACD,6CAA6C,kBAAkB,2BAA2B,OAAO,CAAC,OAAO,wCAAwC,CAClJ,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,MAAM,kBAAkB,CAAC;AAErC,yCAAyC;AACzC,KAAK,UAAU,oBAAoB,CAAC,eAAyB;IAC3D,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACpE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG;IAC5B,kBAAkB,EAAE;QAClB,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,+DAA+D;QACzE,IAAI,EAAE,SAAkB;KACzB;CACO,CAAC;AAEX;;;;GAIG;AACH,SAAS,QAAQ,CAAI,OAAmC;IACtD,OAAO,KAAK,EAAE,IAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,IAAyD,CAAC;QAC5E,MAAM,oBAAoB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,CAAC,QAAQ;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACrD,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE;QACN,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,qDAAqD;QAC/D,IAAI,EAAE,SAAkB;KACzB;IACD,KAAK,EAAE;QACL,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,wBAAwB;QAClC,IAAI,EAAE,SAAkB;KACzB;IACD,GAAG,qBAAqB;IACxB,6CAA6C;IAC7C,KAAK,EAAE;QACL,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,EAAE,EAAE;QACF,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,WAAW,EAAE;QACX,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,SAAS,EAAE;QACT,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,IAAI;KACb;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,IAAI;KACb;IACD,OAAO,EAAE;QACP,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,SAAkB;QACxB,MAAM,EAAE,IAAI;KACb;IACD,oBAAoB;IACpB,cAAc,EAAE;QACd,QAAQ,EAAE,mEAAmE;QAC7E,IAAI,EAAE,QAAiB;KACxB;IACD,cAAc,EAAE;QACd,QAAQ,EAAE,qEAAqE;QAC/E,IAAI,EAAE,QAAiB;KACxB;IACD,aAAa,EAAE;QACb,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,0DAA0D;QACpE,IAAI,EAAE,SAAkB;KACzB;IACD,aAAa,EAAE;QACb,QAAQ,EAAE,wCAAwC;QAClD,IAAI,EAAE,QAAiB;KACxB;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,CAAU;QACrF,IAAI,EAAE,QAAiB;KACxB;IACD,eAAe,EAAE;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,4DAA4D;QACtE,IAAI,EAAE,SAAkB;KACzB;IACD,SAAS,EAAE;QACT,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,gCAAgC;QAC1C,IAAI,EAAE,SAAkB;KACzB;CACF,CAAC;AAEF,yCAAyC;AACzC,MAAM,eAAe,EAAE,CAAC;AAExB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,GAAG,CAAC,kBAAkB,CAAC;KACvB,OAAO,CAAC,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;IAClF,MAAM,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACzD,MAAM,QAAQ,EAAE,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;KACD,OAAO,CAAC,QAAQ,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;IACpF,MAAM,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;KACD,OAAO,CACN,eAAe,EACf,iDAAiD,EACjD,CAAC,KAAK,EAAE,EAAE;IACR,OAAO,KAAK;SACT,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,2BAA2B;KACzC,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,6DAA6D;KAC3E,CAAC,CAAC;AACP,CAAC,EACD,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACxE,MAAM,eAAe,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,IAA2B;QACtC,KAAK,EAAE,IAAI,CAAC,KAA6B;QACzC,KAAK,EAAE,IAAI,CAAC,KAA6B;KAC1C,CAAC,CAAC;AACL,CAAC,CAAC,CACH;KACA,OAAO,CACN,SAAS,EACT,0CAA0C,EAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC1C,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC,CACH;KACA,OAAO,CACN,WAAW,EACX,KAAK,EAAE,mBAAmB;AAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC1C,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC,CAAC,CACH;KACA,OAAO,CACN,CAAC,IAAI,CAAC,EACN,oBAAoB,EACpB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAC/C,KAAK,EAAE,IAAI,EAAE,EAAE;IACb,qBAAqB;IACrB,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IAED,0CAA0C;IAC1C,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;QACxC,OAAO,EAAE,4BAA4B;KACtC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+CAA+C;IAC/C,MAAM,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjD,MAAM,mBAAmB,EAAE,CAAC;IAE5B,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAS,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF;KACA,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;KAClB,OAAO,EAAE;KACT,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;KACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC","sourcesContent":["#!/usr/bin/env node\n\n// Load .env.local for local development when --local flag is used\nif (process.argv.includes('--local') || process.env.INSTALLER_DEV) {\n  const { config } = await import('dotenv');\n  // bin.ts compiles to dist/bin.js, so go up one level to find .env.local\n  config({ path: new URL('../.env.local', import.meta.url).pathname });\n}\n\nimport { satisfies } from 'semver';\nimport { red } from './utils/logging.js';\nimport { getConfig } from './lib/settings.js';\n\nimport yargs from 'yargs';\nimport { hideBin } from 'yargs/helpers';\nimport chalk from 'chalk';\nimport { ensureAuthenticated } from './lib/ensure-auth.js';\nimport { checkForUpdates } from './lib/version-check.js';\n\nconst NODE_VERSION_RANGE = getConfig().nodeVersion;\n\n// Have to run this above the other imports because they are importing clack that\n// has the problematic imports.\nif (!satisfies(process.version, NODE_VERSION_RANGE)) {\n  red(\n    `WorkOS AuthKit installer requires Node.js ${NODE_VERSION_RANGE}. You are using Node.js ${process.version}. Please upgrade your Node.js version.`,\n  );\n  process.exit(1);\n}\n\nimport { isNonInteractiveEnvironment } from './utils/environment.js';\nimport clack from './utils/clack.js';\n\n/** Apply insecure storage flag if set */\nasync function applyInsecureStorage(insecureStorage?: boolean): Promise<void> {\n  if (insecureStorage) {\n    const { setInsecureStorage } = await import('./lib/credentials.js');\n    setInsecureStorage(true);\n  }\n}\n\n/** Shared insecure-storage option for commands that access credentials */\nconst insecureStorageOption = {\n  'insecure-storage': {\n    default: false,\n    describe: 'Store credentials in plaintext file instead of system keyring',\n    type: 'boolean' as const,\n  },\n} as const;\n\n/**\n * Wrap a command handler with authentication check.\n * Ensures valid auth before executing the handler.\n * Respects --skip-auth flag for CI/testing.\n */\nfunction withAuth<T>(handler: (argv: T) => Promise<void>): (argv: T) => Promise<void> {\n  return async (argv: T) => {\n    const typedArgv = argv as { skipAuth?: boolean; insecureStorage?: boolean };\n    await applyInsecureStorage(typedArgv.insecureStorage);\n    if (!typedArgv.skipAuth) await ensureAuthenticated();\n    await handler(argv);\n  };\n}\n\nconst installerOptions = {\n  direct: {\n    alias: 'D',\n    default: false,\n    describe: 'Use your own Anthropic API key (bypass llm-gateway)',\n    type: 'boolean' as const,\n  },\n  debug: {\n    default: false,\n    describe: 'Enable verbose logging',\n    type: 'boolean' as const,\n  },\n  ...insecureStorageOption,\n  // Hidden dev/automation flags (use env vars)\n  local: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  ci: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  'skip-auth': {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  'api-key': {\n    type: 'string' as const,\n    hidden: true,\n  },\n  'client-id': {\n    type: 'string' as const,\n    hidden: true,\n  },\n  inspect: {\n    default: false,\n    type: 'boolean' as const,\n    hidden: true,\n  },\n  // User-facing flags\n  'homepage-url': {\n    describe: 'App homepage URL for WorkOS (defaults to http://localhost:{port})',\n    type: 'string' as const,\n  },\n  'redirect-uri': {\n    describe: 'Redirect URI for WorkOS callback (defaults to framework convention)',\n    type: 'string' as const,\n  },\n  'no-validate': {\n    default: false,\n    describe: 'Skip post-installation validation (includes build check)',\n    type: 'boolean' as const,\n  },\n  'install-dir': {\n    describe: 'Directory to install WorkOS AuthKit in',\n    type: 'string' as const,\n  },\n  integration: {\n    describe: 'Integration to set up',\n    choices: ['nextjs', 'react', 'tanstack-start', 'react-router', 'vanilla-js'] as const,\n    type: 'string' as const,\n  },\n  'force-install': {\n    default: false,\n    describe: 'Force install packages even if peer dependency checks fail',\n    type: 'boolean' as const,\n  },\n  dashboard: {\n    alias: 'd',\n    default: false,\n    describe: 'Run with visual dashboard mode',\n    type: 'boolean' as const,\n  },\n};\n\n// Check for updates (blocks up to 500ms)\nawait checkForUpdates();\n\nyargs(hideBin(process.argv))\n  .env('WORKOS_INSTALLER')\n  .command('login', 'Authenticate with WorkOS', insecureStorageOption, async (argv) => {\n    await applyInsecureStorage(argv.insecureStorage);\n    const { runLogin } = await import('./commands/login.js');\n    await runLogin();\n    process.exit(0);\n  })\n  .command('logout', 'Remove stored credentials', insecureStorageOption, async (argv) => {\n    await applyInsecureStorage(argv.insecureStorage);\n    const { runLogout } = await import('./commands/logout.js');\n    await runLogout();\n  })\n  .command(\n    'install-skill',\n    'Install bundled AuthKit skills to coding agents',\n    (yargs) => {\n      return yargs\n        .option('list', {\n          alias: 'l',\n          type: 'boolean',\n          description: 'List available skills without installing',\n        })\n        .option('skill', {\n          alias: 's',\n          type: 'array',\n          string: true,\n          description: 'Install specific skill(s)',\n        })\n        .option('agent', {\n          alias: 'a',\n          type: 'array',\n          string: true,\n          description: 'Target specific agent(s): claude-code, codex, cursor, goose',\n        });\n    },\n    withAuth(async (argv) => {\n      const { runInstallSkill } = await import('./commands/install-skill.js');\n      await runInstallSkill({\n        list: argv.list as boolean | undefined,\n        skill: argv.skill as string[] | undefined,\n        agent: argv.agent as string[] | undefined,\n      });\n    }),\n  )\n  .command(\n    'install',\n    'Install WorkOS AuthKit into your project',\n    (yargs) => yargs.options(installerOptions),\n    withAuth(async (argv) => {\n      const { handleInstall } = await import('./commands/install.js');\n      await handleInstall(argv);\n    }),\n  )\n  .command(\n    'dashboard',\n    false, // hidden from help\n    (yargs) => yargs.options(installerOptions),\n    withAuth(async (argv) => {\n      const { handleInstall } = await import('./commands/install.js');\n      await handleInstall({ ...argv, dashboard: true });\n    }),\n  )\n  .command(\n    ['$0'],\n    'WorkOS AuthKit CLI',\n    (yargs) => yargs.options(insecureStorageOption),\n    async (argv) => {\n      // Non-TTY: show help\n      if (isNonInteractiveEnvironment()) {\n        yargs(hideBin(process.argv)).showHelp();\n        return;\n      }\n\n      // TTY: ask if user wants to run installer\n      const shouldInstall = await clack.confirm({\n        message: 'Run the AuthKit installer?',\n      });\n\n      if (clack.isCancel(shouldInstall) || !shouldInstall) {\n        process.exit(0);\n      }\n\n      // Auth check happens HERE, after user confirms\n      await applyInsecureStorage(argv.insecureStorage);\n      await ensureAuthenticated();\n\n      const { handleInstall } = await import('./commands/install.js');\n      await handleInstall({ dashboard: false } as any);\n      process.exit(0);\n    },\n  )\n  .strict()\n  .help()\n  .alias('help', 'h')\n  .version()\n  .alias('version', 'v')\n  .wrap(process.stdout.isTTY && process.stdout.columns ? process.stdout.columns : 80).argv;\n"]}

package/dist/commands/login.js

@@ -1,7 +1,8 @@
 import open from 'opn';
 import clack from '../utils/clack.js';
-import { saveCredentials, getCredentials, getAccessToken } from '../lib/credentials.js';
+import { saveCredentials, getCredentials, getAccessToken, isTokenExpired, updateTokens } from '../lib/credentials.js';
 import { getCliAuthClientId, getAuthkitDomain } from '../lib/settings.js';
+import { refreshAccessToken } from '../lib/token-refresh-client.js';
 /**
  * Parse JWT payload
  */
@@ -45,12 +46,31 @@ export async function runLogin() {
         clack.log.error('CLI auth not configured. Set WORKOS_CLI_CLIENT_ID environment variable.');
         process.exit(1);
     }
+    // Check if already logged in with valid token
     if (getAccessToken()) {
         const creds = getCredentials();
         clack.log.info(`Already logged in as ${creds?.email ?? 'unknown'}`);
         clack.log.info('Run `workos logout` to log out');
         return;
     }
+    // Try to refresh if we have expired credentials with a refresh token
+    const existingCreds = getCredentials();
+    if (existingCreds?.refreshToken && isTokenExpired(existingCreds)) {
+        try {
+            const authkitDomain = getAuthkitDomain();
+            const result = await refreshAccessToken(authkitDomain, clientId);
+            if (result.accessToken && result.expiresAt) {
+                updateTokens(result.accessToken, result.expiresAt, result.refreshToken);
+                clack.log.info(`Already logged in as ${existingCreds.email ?? 'unknown'}`);
+                clack.log.info('(Session refreshed)');
+                clack.log.info('Run `workos logout` to log out');
+                return;
+            }
+        }
+        catch {
+            // Refresh failed, proceed with fresh login
+        }
+    }
     clack.log.step('Starting authentication...');
     const endpoints = getConnectEndpoints();
     const authResponse = await fetch(endpoints.deviceAuthorization, {

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE1E;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;AAC5B,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEnD;;GAEG;AACH,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,OAAO;QACL,mBAAmB,EAAE,GAAG,MAAM,8BAA8B;QAC5D,KAAK,EAAE,GAAG,MAAM,eAAe;KAChC,CAAC;AACJ,CAAC;AAuBD,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IAEtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QACpE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IAExC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,kEAAkE;SAC1E,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAuB,CAAC;IACrE,MAAM,cAAc,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAEzD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,eAAe,GAAG,cAAc,CAAC;IAErC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,SAAS,EAAE,QAAQ;iBACpB,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAExC,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,IAA4B,CAAC;gBAE5C,oCAAoC;gBACpC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAI,cAAc,EAAE,GAAc,IAAI,SAAS,CAAC;gBAC5D,MAAM,KAAK,GAAI,cAAc,EAAE,KAAgB,IAAI,SAAS,CAAC;gBAE7D,8EAA8E;gBAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,MAAM,SAAS,GACb,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAEzG,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEjE,eAAe,CAAC;oBACd,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,SAAS;oBACT,MAAM;oBACN,KAAK;oBACL,YAAY,EAAE,MAAM,CAAC,aAAa;iBACnC,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC3C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC;gBACrD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,YAAY,UAAU,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,IAAyB,CAAC;YAC5C,IAAI,SAAS,CAAC,KAAK,KAAK,uBAAuB;gBAAE,SAAS;YAC1D,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACpC,eAAe,IAAI,IAAI,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACtC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import open from 'opn';\nimport clack from '../utils/clack.js';\nimport { saveCredentials, getCredentials, getAccessToken } from '../lib/credentials.js';\nimport { getCliAuthClientId, getAuthkitDomain } from '../lib/settings.js';\n\n/**\n * Parse JWT payload\n */\nfunction parseJwt(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Extract expiry time from JWT token\n */\nfunction getJwtExpiry(token: string): number | null {\n  const payload = parseJwt(token);\n  if (!payload || typeof payload.exp !== 'number') return null;\n  return payload.exp * 1000;\n}\n\nconst POLL_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Get Connect OAuth endpoints from AuthKit domain\n */\nfunction getConnectEndpoints() {\n  const domain = getAuthkitDomain();\n  return {\n    deviceAuthorization: `${domain}/oauth2/device_authorization`,\n    token: `${domain}/oauth2/token`,\n  };\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete: string;\n  expires_in: number;\n  interval: number;\n}\n\ninterface ConnectTokenResponse {\n  access_token: string;\n  id_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token?: string;\n}\n\ninterface AuthErrorResponse {\n  error: string;\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nexport async function runLogin(): Promise<void> {\n  const clientId = getCliAuthClientId();\n\n  if (!clientId) {\n    clack.log.error('CLI auth not configured. Set WORKOS_CLI_CLIENT_ID environment variable.');\n    process.exit(1);\n  }\n\n  if (getAccessToken()) {\n    const creds = getCredentials();\n    clack.log.info(`Already logged in as ${creds?.email ?? 'unknown'}`);\n    clack.log.info('Run `workos logout` to log out');\n    return;\n  }\n\n  clack.log.step('Starting authentication...');\n\n  const endpoints = getConnectEndpoints();\n\n  const authResponse = await fetch(endpoints.deviceAuthorization, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({\n      client_id: clientId,\n      scope: 'openid email staging-environment:credentials:read offline_access',\n    }),\n  });\n\n  if (!authResponse.ok) {\n    clack.log.error(`Failed to start authentication: ${authResponse.status}`);\n    process.exit(1);\n  }\n\n  const deviceAuth = (await authResponse.json()) as DeviceAuthResponse;\n  const pollIntervalMs = (deviceAuth.interval || 5) * 1000;\n\n  clack.log.info(`\\nOpen this URL in your browser:\\n`);\n  console.log(`  ${deviceAuth.verification_uri}`);\n  console.log(`\\nEnter code: ${deviceAuth.user_code}\\n`);\n\n  try {\n    open(deviceAuth.verification_uri_complete);\n    clack.log.info('Browser opened automatically');\n  } catch {\n    // User can open manually\n  }\n\n  const spinner = clack.spinner();\n  spinner.start('Waiting for authentication...');\n\n  const startTime = Date.now();\n  let currentInterval = pollIntervalMs;\n\n  while (Date.now() - startTime < POLL_TIMEOUT_MS) {\n    await sleep(currentInterval);\n\n    try {\n      const tokenResponse = await fetch(endpoints.token, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n          device_code: deviceAuth.device_code,\n          client_id: clientId,\n        }),\n      });\n\n      const data = await tokenResponse.json();\n\n      if (tokenResponse.ok) {\n        const result = data as ConnectTokenResponse;\n\n        // Parse user info from id_token JWT\n        const idTokenPayload = parseJwt(result.id_token);\n        const userId = (idTokenPayload?.sub as string) || 'unknown';\n        const email = (idTokenPayload?.email as string) || undefined;\n\n        // Extract actual expiry from access token JWT, fallback to response or 15 min\n        const jwtExpiry = getJwtExpiry(result.access_token);\n        const expiresAt =\n          jwtExpiry ?? (result.expires_in ? Date.now() + result.expires_in * 1000 : Date.now() + 15 * 60 * 1000);\n\n        const expiresInSec = Math.round((expiresAt - Date.now()) / 1000);\n\n        saveCredentials({\n          accessToken: result.access_token,\n          expiresAt,\n          userId,\n          email,\n          refreshToken: result.refresh_token,\n        });\n\n        spinner.stop('Authentication successful!');\n        clack.log.success(`Logged in as ${email || userId}`);\n        clack.log.info(`Token expires in ${expiresInSec} seconds`);\n        return;\n      }\n\n      const errorData = data as AuthErrorResponse;\n      if (errorData.error === 'authorization_pending') continue;\n      if (errorData.error === 'slow_down') {\n        currentInterval += 5000;\n        continue;\n      }\n\n      spinner.stop('Authentication failed');\n      clack.log.error(`Authentication error: ${errorData.error}`);\n      process.exit(1);\n    } catch {\n      continue;\n    }\n  }\n\n  spinner.stop('Authentication timed out');\n  clack.log.error('Authentication timed out. Please try again.');\n  process.exit(1);\n}\n"]}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;AAC5B,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEnD;;GAEG;AACH,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,OAAO;QACL,mBAAmB,EAAE,GAAG,MAAM,8BAA8B;QAC5D,KAAK,EAAE,GAAG,MAAM,eAAe;KAChC,CAAC;AACJ,CAAC;AAuBD,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IAEtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8CAA8C;IAC9C,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QACpE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC;IACvC,IAAI,aAAa,EAAE,YAAY,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;gBACxE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,aAAa,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;gBAC3E,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IAExC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,kEAAkE;SAC1E,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAuB,CAAC;IACrE,MAAM,cAAc,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAEzD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,eAAe,GAAG,cAAc,CAAC;IAErC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,SAAS,EAAE,QAAQ;iBACpB,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAExC,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,IAA4B,CAAC;gBAE5C,oCAAoC;gBACpC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAI,cAAc,EAAE,GAAc,IAAI,SAAS,CAAC;gBAC5D,MAAM,KAAK,GAAI,cAAc,EAAE,KAAgB,IAAI,SAAS,CAAC;gBAE7D,8EAA8E;gBAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,MAAM,SAAS,GACb,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAEzG,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEjE,eAAe,CAAC;oBACd,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,SAAS;oBACT,MAAM;oBACN,KAAK;oBACL,YAAY,EAAE,MAAM,CAAC,aAAa;iBACnC,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC3C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC;gBACrD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,YAAY,UAAU,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,IAAyB,CAAC;YAC5C,IAAI,SAAS,CAAC,KAAK,KAAK,uBAAuB;gBAAE,SAAS;YAC1D,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACpC,eAAe,IAAI,IAAI,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACtC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import open from 'opn';\nimport clack from '../utils/clack.js';\nimport { saveCredentials, getCredentials, getAccessToken, isTokenExpired, updateTokens } from '../lib/credentials.js';\nimport { getCliAuthClientId, getAuthkitDomain } from '../lib/settings.js';\nimport { refreshAccessToken } from '../lib/token-refresh-client.js';\n\n/**\n * Parse JWT payload\n */\nfunction parseJwt(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Extract expiry time from JWT token\n */\nfunction getJwtExpiry(token: string): number | null {\n  const payload = parseJwt(token);\n  if (!payload || typeof payload.exp !== 'number') return null;\n  return payload.exp * 1000;\n}\n\nconst POLL_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Get Connect OAuth endpoints from AuthKit domain\n */\nfunction getConnectEndpoints() {\n  const domain = getAuthkitDomain();\n  return {\n    deviceAuthorization: `${domain}/oauth2/device_authorization`,\n    token: `${domain}/oauth2/token`,\n  };\n}\n\ninterface DeviceAuthResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete: string;\n  expires_in: number;\n  interval: number;\n}\n\ninterface ConnectTokenResponse {\n  access_token: string;\n  id_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token?: string;\n}\n\ninterface AuthErrorResponse {\n  error: string;\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nexport async function runLogin(): Promise<void> {\n  const clientId = getCliAuthClientId();\n\n  if (!clientId) {\n    clack.log.error('CLI auth not configured. Set WORKOS_CLI_CLIENT_ID environment variable.');\n    process.exit(1);\n  }\n\n  // Check if already logged in with valid token\n  if (getAccessToken()) {\n    const creds = getCredentials();\n    clack.log.info(`Already logged in as ${creds?.email ?? 'unknown'}`);\n    clack.log.info('Run `workos logout` to log out');\n    return;\n  }\n\n  // Try to refresh if we have expired credentials with a refresh token\n  const existingCreds = getCredentials();\n  if (existingCreds?.refreshToken && isTokenExpired(existingCreds)) {\n    try {\n      const authkitDomain = getAuthkitDomain();\n      const result = await refreshAccessToken(authkitDomain, clientId);\n      if (result.accessToken && result.expiresAt) {\n        updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n        clack.log.info(`Already logged in as ${existingCreds.email ?? 'unknown'}`);\n        clack.log.info('(Session refreshed)');\n        clack.log.info('Run `workos logout` to log out');\n        return;\n      }\n    } catch {\n      // Refresh failed, proceed with fresh login\n    }\n  }\n\n  clack.log.step('Starting authentication...');\n\n  const endpoints = getConnectEndpoints();\n\n  const authResponse = await fetch(endpoints.deviceAuthorization, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({\n      client_id: clientId,\n      scope: 'openid email staging-environment:credentials:read offline_access',\n    }),\n  });\n\n  if (!authResponse.ok) {\n    clack.log.error(`Failed to start authentication: ${authResponse.status}`);\n    process.exit(1);\n  }\n\n  const deviceAuth = (await authResponse.json()) as DeviceAuthResponse;\n  const pollIntervalMs = (deviceAuth.interval || 5) * 1000;\n\n  clack.log.info(`\\nOpen this URL in your browser:\\n`);\n  console.log(`  ${deviceAuth.verification_uri}`);\n  console.log(`\\nEnter code: ${deviceAuth.user_code}\\n`);\n\n  try {\n    open(deviceAuth.verification_uri_complete);\n    clack.log.info('Browser opened automatically');\n  } catch {\n    // User can open manually\n  }\n\n  const spinner = clack.spinner();\n  spinner.start('Waiting for authentication...');\n\n  const startTime = Date.now();\n  let currentInterval = pollIntervalMs;\n\n  while (Date.now() - startTime < POLL_TIMEOUT_MS) {\n    await sleep(currentInterval);\n\n    try {\n      const tokenResponse = await fetch(endpoints.token, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n          device_code: deviceAuth.device_code,\n          client_id: clientId,\n        }),\n      });\n\n      const data = await tokenResponse.json();\n\n      if (tokenResponse.ok) {\n        const result = data as ConnectTokenResponse;\n\n        // Parse user info from id_token JWT\n        const idTokenPayload = parseJwt(result.id_token);\n        const userId = (idTokenPayload?.sub as string) || 'unknown';\n        const email = (idTokenPayload?.email as string) || undefined;\n\n        // Extract actual expiry from access token JWT, fallback to response or 15 min\n        const jwtExpiry = getJwtExpiry(result.access_token);\n        const expiresAt =\n          jwtExpiry ?? (result.expires_in ? Date.now() + result.expires_in * 1000 : Date.now() + 15 * 60 * 1000);\n\n        const expiresInSec = Math.round((expiresAt - Date.now()) / 1000);\n\n        saveCredentials({\n          accessToken: result.access_token,\n          expiresAt,\n          userId,\n          email,\n          refreshToken: result.refresh_token,\n        });\n\n        spinner.stop('Authentication successful!');\n        clack.log.success(`Logged in as ${email || userId}`);\n        clack.log.info(`Token expires in ${expiresInSec} seconds`);\n        return;\n      }\n\n      const errorData = data as AuthErrorResponse;\n      if (errorData.error === 'authorization_pending') continue;\n      if (errorData.error === 'slow_down') {\n        currentInterval += 5000;\n        continue;\n      }\n\n      spinner.stop('Authentication failed');\n      clack.log.error(`Authentication error: ${errorData.error}`);\n      process.exit(1);\n    } catch {\n      continue;\n    }\n  }\n\n  spinner.stop('Authentication timed out');\n  clack.log.error('Authentication timed out. Please try again.');\n  process.exit(1);\n}\n"]}

package/dist/lib/credential-store.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Credential storage abstraction with keyring support and file fallback.
+ *
+ * Storage priority:
+ * 1. If --insecure-storage: use file only
+ * 2. Try keyring, fall back to file with warning if unavailable
+ */
+export interface StagingCache {
+    clientId: string;
+    apiKey: string;
+    fetchedAt: number;
+}
+export interface Credentials {
+    accessToken: string;
+    expiresAt: number;
+    userId: string;
+    email?: string;
+    staging?: StagingCache;
+    refreshToken?: string;
+}
+export declare function setInsecureStorage(value: boolean): void;
+declare function getCredentialsPath(): string;
+export declare function hasCredentials(): boolean;
+export declare function getCredentials(): Credentials | null;
+export declare function saveCredentials(creds: Credentials): void;
+export declare function clearCredentials(): void;
+export declare function updateTokens(accessToken: string, expiresAt: number, refreshToken?: string): void;
+export { getCredentialsPath };

package/dist/lib/credential-store.js

@@ -0,0 +1,150 @@
+/**
+ * Credential storage abstraction with keyring support and file fallback.
+ *
+ * Storage priority:
+ * 1. If --insecure-storage: use file only
+ * 2. Try keyring, fall back to file with warning if unavailable
+ */
+import { Entry } from '@napi-rs/keyring';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { logWarn } from '../utils/debug.js';
+const SERVICE_NAME = 'workos-cli';
+const ACCOUNT_NAME = 'credentials';
+let fallbackWarningShown = false;
+let forceInsecureStorage = false;
+export function setInsecureStorage(value) {
+    forceInsecureStorage = value;
+}
+function getCredentialsDir() {
+    return path.join(os.homedir(), '.workos');
+}
+function getCredentialsPath() {
+    return path.join(getCredentialsDir(), 'credentials.json');
+}
+function fileExists() {
+    return fs.existsSync(getCredentialsPath());
+}
+function readFromFile() {
+    if (!fileExists())
+        return null;
+    try {
+        const content = fs.readFileSync(getCredentialsPath(), 'utf-8');
+        return JSON.parse(content);
+    }
+    catch (error) {
+        logWarn('Failed to read credentials file:', error);
+        return null;
+    }
+}
+function writeToFile(creds) {
+    const dir = getCredentialsDir();
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    fs.writeFileSync(getCredentialsPath(), JSON.stringify(creds, null, 2), {
+        mode: 0o600,
+    });
+}
+function deleteFile() {
+    if (fileExists()) {
+        fs.unlinkSync(getCredentialsPath());
+    }
+}
+function getKeyringEntry() {
+    return new Entry(SERVICE_NAME, ACCOUNT_NAME);
+}
+function readFromKeyring() {
+    try {
+        const entry = getKeyringEntry();
+        const data = entry.getPassword();
+        if (!data)
+            return null;
+        return JSON.parse(data);
+    }
+    catch (error) {
+        logWarn('Failed to read from keyring:', error);
+        return null;
+    }
+}
+function writeToKeyring(creds) {
+    try {
+        const entry = getKeyringEntry();
+        entry.setPassword(JSON.stringify(creds));
+        return true;
+    }
+    catch (error) {
+        logWarn('Failed to write to keyring:', error);
+        return false;
+    }
+}
+function deleteFromKeyring() {
+    try {
+        const entry = getKeyringEntry();
+        entry.deletePassword();
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        if (!msg.includes('not found') && !msg.includes('No such')) {
+            logWarn('Failed to delete from keyring:', error);
+        }
+    }
+}
+function showFallbackWarning() {
+    if (fallbackWarningShown || forceInsecureStorage)
+        return;
+    fallbackWarningShown = true;
+    logWarn('Unable to store credentials in system keyring. Using file storage.', 'Credentials saved to ~/.workos/credentials.json', 'Use --insecure-storage to suppress this warning.');
+}
+export function hasCredentials() {
+    if (forceInsecureStorage) {
+        return fileExists();
+    }
+    return readFromKeyring() !== null || fileExists();
+}
+export function getCredentials() {
+    if (forceInsecureStorage)
+        return readFromFile();
+    const keyringCreds = readFromKeyring();
+    if (keyringCreds)
+        return keyringCreds;
+    const fileCreds = readFromFile();
+    if (fileCreds) {
+        // Migrate file creds to keyring if possible
+        if (writeToKeyring(fileCreds))
+            deleteFile();
+        return fileCreds;
+    }
+    return null;
+}
+export function saveCredentials(creds) {
+    if (forceInsecureStorage)
+        return writeToFile(creds);
+    if (writeToKeyring(creds)) {
+        deleteFile();
+    }
+    else {
+        showFallbackWarning();
+        writeToFile(creds);
+    }
+}
+export function clearCredentials() {
+    deleteFromKeyring();
+    deleteFile();
+}
+export function updateTokens(accessToken, expiresAt, refreshToken) {
+    const creds = getCredentials();
+    if (!creds) {
+        throw new Error('No existing credentials to update');
+    }
+    const updated = {
+        ...creds,
+        accessToken,
+        expiresAt,
+        ...(refreshToken && { refreshToken }),
+    };
+    saveCredentials(updated);
+}
+export { getCredentialsPath };
+//# sourceMappingURL=credential-store.js.map

package/dist/lib/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/lib/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAiB5C,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,oBAAoB,GAAG,KAAK,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACrE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAkB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,oBAAoB,IAAI,oBAAoB;QAAE,OAAO;IACzD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,CACL,oEAAoE,EACpE,iDAAiD,EACjD,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,eAAe,EAAE,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,oBAAoB;QAAE,OAAO,YAAY,EAAE,CAAC;IAEhD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,4CAA4C;QAC5C,IAAI,cAAc,CAAC,SAAS,CAAC;YAAE,UAAU,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,oBAAoB;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,EAAE,CAAC;IACf,CAAC;SAAM,CAAC;QACN,mBAAmB,EAAE,CAAC;QACtB,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,SAAiB,EAAE,YAAqB;IACxF,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,GAAG,KAAK;QACR,WAAW;QACX,SAAS;QACT,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;KACtC,CAAC;IAEF,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/**\n * Credential storage abstraction with keyring support and file fallback.\n *\n * Storage priority:\n * 1. If --insecure-storage: use file only\n * 2. Try keyring, fall back to file with warning if unavailable\n */\n\nimport { Entry } from '@napi-rs/keyring';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { logWarn } from '../utils/debug.js';\n\nexport interface StagingCache {\n  clientId: string;\n  apiKey: string;\n  fetchedAt: number;\n}\n\nexport interface Credentials {\n  accessToken: string;\n  expiresAt: number;\n  userId: string;\n  email?: string;\n  staging?: StagingCache;\n  refreshToken?: string;\n}\n\nconst SERVICE_NAME = 'workos-cli';\nconst ACCOUNT_NAME = 'credentials';\n\nlet fallbackWarningShown = false;\nlet forceInsecureStorage = false;\n\nexport function setInsecureStorage(value: boolean): void {\n  forceInsecureStorage = value;\n}\n\nfunction getCredentialsDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nfunction getCredentialsPath(): string {\n  return path.join(getCredentialsDir(), 'credentials.json');\n}\n\nfunction fileExists(): boolean {\n  return fs.existsSync(getCredentialsPath());\n}\n\nfunction readFromFile(): Credentials | null {\n  if (!fileExists()) return null;\n  try {\n    const content = fs.readFileSync(getCredentialsPath(), 'utf-8');\n    return JSON.parse(content);\n  } catch (error) {\n    logWarn('Failed to read credentials file:', error);\n    return null;\n  }\n}\n\nfunction writeToFile(creds: Credentials): void {\n  const dir = getCredentialsDir();\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n  fs.writeFileSync(getCredentialsPath(), JSON.stringify(creds, null, 2), {\n    mode: 0o600,\n  });\n}\n\nfunction deleteFile(): void {\n  if (fileExists()) {\n    fs.unlinkSync(getCredentialsPath());\n  }\n}\n\nfunction getKeyringEntry(): Entry {\n  return new Entry(SERVICE_NAME, ACCOUNT_NAME);\n}\n\nfunction readFromKeyring(): Credentials | null {\n  try {\n    const entry = getKeyringEntry();\n    const data = entry.getPassword();\n    if (!data) return null;\n    return JSON.parse(data);\n  } catch (error) {\n    logWarn('Failed to read from keyring:', error);\n    return null;\n  }\n}\n\nfunction writeToKeyring(creds: Credentials): boolean {\n  try {\n    const entry = getKeyringEntry();\n    entry.setPassword(JSON.stringify(creds));\n    return true;\n  } catch (error) {\n    logWarn('Failed to write to keyring:', error);\n    return false;\n  }\n}\n\nfunction deleteFromKeyring(): void {\n  try {\n    const entry = getKeyringEntry();\n    entry.deletePassword();\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    if (!msg.includes('not found') && !msg.includes('No such')) {\n      logWarn('Failed to delete from keyring:', error);\n    }\n  }\n}\n\nfunction showFallbackWarning(): void {\n  if (fallbackWarningShown || forceInsecureStorage) return;\n  fallbackWarningShown = true;\n  logWarn(\n    'Unable to store credentials in system keyring. Using file storage.',\n    'Credentials saved to ~/.workos/credentials.json',\n    'Use --insecure-storage to suppress this warning.',\n  );\n}\n\nexport function hasCredentials(): boolean {\n  if (forceInsecureStorage) {\n    return fileExists();\n  }\n  return readFromKeyring() !== null || fileExists();\n}\n\nexport function getCredentials(): Credentials | null {\n  if (forceInsecureStorage) return readFromFile();\n\n  const keyringCreds = readFromKeyring();\n  if (keyringCreds) return keyringCreds;\n\n  const fileCreds = readFromFile();\n  if (fileCreds) {\n    // Migrate file creds to keyring if possible\n    if (writeToKeyring(fileCreds)) deleteFile();\n    return fileCreds;\n  }\n\n  return null;\n}\n\nexport function saveCredentials(creds: Credentials): void {\n  if (forceInsecureStorage) return writeToFile(creds);\n\n  if (writeToKeyring(creds)) {\n    deleteFile();\n  } else {\n    showFallbackWarning();\n    writeToFile(creds);\n  }\n}\n\nexport function clearCredentials(): void {\n  deleteFromKeyring();\n  deleteFile();\n}\n\nexport function updateTokens(accessToken: string, expiresAt: number, refreshToken?: string): void {\n  const creds = getCredentials();\n  if (!creds) {\n    throw new Error('No existing credentials to update');\n  }\n\n  const updated: Credentials = {\n    ...creds,\n    accessToken,\n    expiresAt,\n    ...(refreshToken && { refreshToken }),\n  };\n\n  saveCredentials(updated);\n}\n\nexport { getCredentialsPath };\n"]}

package/dist/lib/credentials.d.ts

@@ -1,47 +1,13 @@
-export interface StagingCache {
-    clientId: string;
-    apiKey: string;
-    fetchedAt: number;
-}
-export interface Credentials {
-    accessToken: string;
-    expiresAt: number;
-    userId: string;
-    email?: string;
-    staging?: StagingCache;
-    refreshToken?: string;
-}
-export declare function getCredentialsPath(): string;
-export declare function hasCredentials(): boolean;
-export declare function getCredentials(): Credentials | null;
-export declare function saveCredentials(creds: Credentials): void;
-export declare function clearCredentials(): void;
-/**
- * Check if token is actually expired (hard expiry check).
- */
+export type { StagingCache, Credentials } from './credential-store.js';
+export { hasCredentials, getCredentials, saveCredentials, clearCredentials, updateTokens, getCredentialsPath, setInsecureStorage, } from './credential-store.js';
+import type { Credentials } from './credential-store.js';
 export declare function isTokenExpired(creds: Credentials): boolean;
-/**
- * Get access token if available and not expired.
- */
 export declare function getAccessToken(): string | null;
-/**
- * Save staging credentials to the credential cache.
- * Staging credentials are tied to the access token lifecycle.
- */
 export declare function saveStagingCredentials(staging: {
     clientId: string;
     apiKey: string;
 }): void;
-/**
- * Get cached staging credentials if available and access token is still valid.
- * Returns null if no cached credentials or if access token has expired.
- */
 export declare function getStagingCredentials(): {
     clientId: string;
     apiKey: string;
 } | null;
-/**
- * Atomically update tokens in credentials file.
- * Uses write-to-temp + rename pattern for atomic updates.
- */
-export declare function updateTokens(accessToken: string, expiresAt: number, refreshToken?: string): void;

package/dist/lib/credentials.js

@@ -1,49 +1,8 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-function getCredentialsDir() {
-    return path.join(os.homedir(), '.workos');
-}
-export function getCredentialsPath() {
-    return path.join(getCredentialsDir(), 'credentials.json');
-}
-export function hasCredentials() {
-    return fs.existsSync(getCredentialsPath());
-}
-export function getCredentials() {
-    if (!hasCredentials())
-        return null;
-    try {
-        const content = fs.readFileSync(getCredentialsPath(), 'utf-8');
-        return JSON.parse(content);
-    }
-    catch {
-        return null;
-    }
-}
-export function saveCredentials(creds) {
-    const dir = getCredentialsDir();
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    fs.writeFileSync(getCredentialsPath(), JSON.stringify(creds, null, 2), {
-        mode: 0o600,
-    });
-}
-export function clearCredentials() {
-    if (hasCredentials()) {
-        fs.unlinkSync(getCredentialsPath());
-    }
-}
-/**
- * Check if token is actually expired (hard expiry check).
- */
+export { hasCredentials, getCredentials, saveCredentials, clearCredentials, updateTokens, getCredentialsPath, setInsecureStorage, } from './credential-store.js';
+import { getCredentials, saveCredentials } from './credential-store.js';
 export function isTokenExpired(creds) {
     return Date.now() >= creds.expiresAt;
 }
-/**
- * Get access token if available and not expired.
- */
 export function getAccessToken() {
     const creds = getCredentials();
     if (!creds)
@@ -52,10 +11,6 @@ export function getAccessToken() {
         return null;
     return creds.accessToken;
 }
-/**
- * Save staging credentials to the credential cache.
- * Staging credentials are tied to the access token lifecycle.
- */
 export function saveStagingCredentials(staging) {
     const creds = getCredentials();
     if (!creds)
@@ -68,50 +23,12 @@ export function saveStagingCredentials(staging) {
         },
     });
 }
-/**
- * Get cached staging credentials if available and access token is still valid.
- * Returns null if no cached credentials or if access token has expired.
- */
 export function getStagingCredentials() {
     const creds = getCredentials();
     if (!creds?.staging)
         return null;
-    // Invalidate staging credentials when access token expires
     if (isTokenExpired(creds))
         return null;
     return { clientId: creds.staging.clientId, apiKey: creds.staging.apiKey };
 }
-/**
- * Atomically update tokens in credentials file.
- * Uses write-to-temp + rename pattern for atomic updates.
- */
-export function updateTokens(accessToken, expiresAt, refreshToken) {
-    const creds = getCredentials();
-    if (!creds) {
-        throw new Error('No existing credentials to update');
-    }
-    const updated = {
-        ...creds,
-        accessToken,
-        expiresAt,
-        ...(refreshToken && { refreshToken }),
-    };
-    // Atomic write: temp file + rename
-    const credPath = getCredentialsPath();
-    const tempPath = `${credPath}.${crypto.randomUUID()}.tmp`;
-    try {
-        fs.writeFileSync(tempPath, JSON.stringify(updated, null, 2), { mode: 0o600 });
-        fs.renameSync(tempPath, credPath);
-    }
-    catch (error) {
-        // Clean up temp file if rename failed
-        try {
-            fs.unlinkSync(tempPath);
-        }
-        catch {
-            // Ignore cleanup errors
-        }
-        throw error;
-    }
-}
 //# sourceMappingURL=credentials.js.map

package/dist/lib/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/lib/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAiBzB,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACrE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA6C;IAClF,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,eAAe,CAAC;QACd,GAAG,KAAK;QACR,OAAO,EAAE;YACP,GAAG,OAAO;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,2DAA2D;IAC3D,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,SAAiB,EAAE,YAAqB;IACxF,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,GAAG,KAAK;QACR,WAAW;QACX,SAAS;QACT,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;KACtC,CAAC;IAEF,mCAAmC;IACnC,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;IAE1D,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC;QACtC,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\n\nexport interface StagingCache {\n  clientId: string;\n  apiKey: string;\n  fetchedAt: number;\n}\n\nexport interface Credentials {\n  accessToken: string;\n  expiresAt: number;\n  userId: string;\n  email?: string;\n  staging?: StagingCache;\n  refreshToken?: string;\n}\n\nfunction getCredentialsDir(): string {\n  return path.join(os.homedir(), '.workos');\n}\n\nexport function getCredentialsPath(): string {\n  return path.join(getCredentialsDir(), 'credentials.json');\n}\n\nexport function hasCredentials(): boolean {\n  return fs.existsSync(getCredentialsPath());\n}\n\nexport function getCredentials(): Credentials | null {\n  if (!hasCredentials()) return null;\n  try {\n    const content = fs.readFileSync(getCredentialsPath(), 'utf-8');\n    return JSON.parse(content);\n  } catch {\n    return null;\n  }\n}\n\nexport function saveCredentials(creds: Credentials): void {\n  const dir = getCredentialsDir();\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n  fs.writeFileSync(getCredentialsPath(), JSON.stringify(creds, null, 2), {\n    mode: 0o600,\n  });\n}\n\nexport function clearCredentials(): void {\n  if (hasCredentials()) {\n    fs.unlinkSync(getCredentialsPath());\n  }\n}\n\n/**\n * Check if token is actually expired (hard expiry check).\n */\nexport function isTokenExpired(creds: Credentials): boolean {\n  return Date.now() >= creds.expiresAt;\n}\n\n/**\n * Get access token if available and not expired.\n */\nexport function getAccessToken(): string | null {\n  const creds = getCredentials();\n  if (!creds) return null;\n  if (isTokenExpired(creds)) return null;\n  return creds.accessToken;\n}\n\n/**\n * Save staging credentials to the credential cache.\n * Staging credentials are tied to the access token lifecycle.\n */\nexport function saveStagingCredentials(staging: { clientId: string; apiKey: string }): void {\n  const creds = getCredentials();\n  if (!creds) return;\n\n  saveCredentials({\n    ...creds,\n    staging: {\n      ...staging,\n      fetchedAt: Date.now(),\n    },\n  });\n}\n\n/**\n * Get cached staging credentials if available and access token is still valid.\n * Returns null if no cached credentials or if access token has expired.\n */\nexport function getStagingCredentials(): { clientId: string; apiKey: string } | null {\n  const creds = getCredentials();\n  if (!creds?.staging) return null;\n  // Invalidate staging credentials when access token expires\n  if (isTokenExpired(creds)) return null;\n  return { clientId: creds.staging.clientId, apiKey: creds.staging.apiKey };\n}\n\n/**\n * Atomically update tokens in credentials file.\n * Uses write-to-temp + rename pattern for atomic updates.\n */\nexport function updateTokens(accessToken: string, expiresAt: number, refreshToken?: string): void {\n  const creds = getCredentials();\n  if (!creds) {\n    throw new Error('No existing credentials to update');\n  }\n\n  const updated: Credentials = {\n    ...creds,\n    accessToken,\n    expiresAt,\n    ...(refreshToken && { refreshToken }),\n  };\n\n  // Atomic write: temp file + rename\n  const credPath = getCredentialsPath();\n  const tempPath = `${credPath}.${crypto.randomUUID()}.tmp`;\n\n  try {\n    fs.writeFileSync(tempPath, JSON.stringify(updated, null, 2), { mode: 0o600 });\n    fs.renameSync(tempPath, credPath);\n  } catch (error) {\n    // Clean up temp file if rename failed\n    try {\n      fs.unlinkSync(tempPath);\n    } catch {\n      // Ignore cleanup errors\n    }\n    throw error;\n  }\n}\n"]}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/lib/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExE,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA6C;IAClF,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,eAAe,CAAC;QACd,GAAG,KAAK;QACR,OAAO,EAAE;YACP,GAAG,OAAO;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["export type { StagingCache, Credentials } from './credential-store.js';\n\nexport {\n  hasCredentials,\n  getCredentials,\n  saveCredentials,\n  clearCredentials,\n  updateTokens,\n  getCredentialsPath,\n  setInsecureStorage,\n} from './credential-store.js';\n\nimport type { Credentials } from './credential-store.js';\nimport { getCredentials, saveCredentials } from './credential-store.js';\n\nexport function isTokenExpired(creds: Credentials): boolean {\n  return Date.now() >= creds.expiresAt;\n}\n\nexport function getAccessToken(): string | null {\n  const creds = getCredentials();\n  if (!creds) return null;\n  if (isTokenExpired(creds)) return null;\n  return creds.accessToken;\n}\n\nexport function saveStagingCredentials(staging: { clientId: string; apiKey: string }): void {\n  const creds = getCredentials();\n  if (!creds) return;\n\n  saveCredentials({\n    ...creds,\n    staging: {\n      ...staging,\n      fetchedAt: Date.now(),\n    },\n  });\n}\n\nexport function getStagingCredentials(): { clientId: string; apiKey: string } | null {\n  const creds = getCredentials();\n  if (!creds?.staging) return null;\n  if (isTokenExpired(creds)) return null;\n  return { clientId: creds.staging.clientId, apiKey: creds.staging.apiKey };\n}\n"]}

package/dist/lib/version-check.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Check npm registry for latest version and warn if outdated.
+ * Runs asynchronously, fails silently on any error.
+ * Safe to call without awaiting (fire-and-forget).
+ */
+export declare function checkForUpdates(): Promise<void>;

package/dist/lib/version-check.js

@@ -0,0 +1,45 @@
+import { lt, valid } from 'semver';
+import { yellow, dim } from '../utils/logging.js';
+import { getVersion } from './settings.js';
+const NPM_REGISTRY_URL = 'https://registry.npmjs.org/workos/latest';
+const TIMEOUT_MS = 500;
+let hasWarned = false;
+/**
+ * Check npm registry for latest version and warn if outdated.
+ * Runs asynchronously, fails silently on any error.
+ * Safe to call without awaiting (fire-and-forget).
+ */
+export async function checkForUpdates() {
+    if (hasWarned)
+        return;
+    try {
+        const response = await fetch(NPM_REGISTRY_URL, {
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return;
+        const data = (await response.json());
+        const latestVersion = data.version;
+        const currentVersion = getVersion();
+        // Validate both versions are valid semver
+        if (!valid(latestVersion) || !valid(currentVersion))
+            return;
+        // Only warn if current < latest
+        if (lt(currentVersion, latestVersion)) {
+            hasWarned = true;
+            yellow(`Update available: ${currentVersion} → ${latestVersion}`);
+            dim(`Run: npx workos@latest`);
+        }
+    }
+    catch {
+        // Silently ignore all errors (timeout, network, parse, etc.)
+    }
+}
+/**
+ * Reset warning state (for testing).
+ * @internal
+ */
+export function _resetWarningState() {
+    hasWarned = false;
+}
+//# sourceMappingURL=version-check.js.map

package/dist/lib/version-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../../src/lib/version-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AACpE,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,IAAI,SAAS,GAAG,KAAK,CAAC;AAMtB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,SAAS;QAAE,OAAO;IAEtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO;QAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;QACnC,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;QAEpC,0CAA0C;QAC1C,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO;QAE5D,gCAAgC;QAChC,IAAI,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;YACtC,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,qBAAqB,cAAc,MAAM,aAAa,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC","sourcesContent":["import { lt, valid } from 'semver';\nimport { yellow, dim } from '../utils/logging.js';\nimport { getVersion } from './settings.js';\n\nconst NPM_REGISTRY_URL = 'https://registry.npmjs.org/workos/latest';\nconst TIMEOUT_MS = 500;\n\nlet hasWarned = false;\n\ninterface NpmPackageInfo {\n  version: string;\n}\n\n/**\n * Check npm registry for latest version and warn if outdated.\n * Runs asynchronously, fails silently on any error.\n * Safe to call without awaiting (fire-and-forget).\n */\nexport async function checkForUpdates(): Promise<void> {\n  if (hasWarned) return;\n\n  try {\n    const response = await fetch(NPM_REGISTRY_URL, {\n      signal: AbortSignal.timeout(TIMEOUT_MS),\n    });\n\n    if (!response.ok) return;\n\n    const data = (await response.json()) as NpmPackageInfo;\n    const latestVersion = data.version;\n    const currentVersion = getVersion();\n\n    // Validate both versions are valid semver\n    if (!valid(latestVersion) || !valid(currentVersion)) return;\n\n    // Only warn if current < latest\n    if (lt(currentVersion, latestVersion)) {\n      hasWarned = true;\n      yellow(`Update available: ${currentVersion} → ${latestVersion}`);\n      dim(`Run: npx workos@latest`);\n    }\n  } catch {\n    // Silently ignore all errors (timeout, network, parse, etc.)\n  }\n}\n\n/**\n * Reset warning state (for testing).\n * @internal\n */\nexport function _resetWarningState(): void {\n  hasWarned = false;\n}\n"]}

package/dist/utils/exec-file.d.ts

@@ -0,0 +1,15 @@
+export interface ExecResult {
+    status: number;
+    stdout: string;
+    stderr: string;
+}
+export interface ExecOptions {
+    cwd?: string;
+    timeout?: number;
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Execute a command without throwing on non-zero exit codes.
+ * Returns { status, stdout, stderr } for all outcomes.
+ */
+export declare function execFileNoThrow(command: string, args: string[], options?: ExecOptions): Promise<ExecResult>;

package/dist/utils/exec-file.js

@@ -0,0 +1,38 @@
+import { spawn } from 'node:child_process';
+/**
+ * Execute a command without throwing on non-zero exit codes.
+ * Returns { status, stdout, stderr } for all outcomes.
+ */
+export function execFileNoThrow(command, args, options = {}) {
+    return new Promise((resolve) => {
+        const child = spawn(command, args, {
+            cwd: options.cwd,
+            env: options.env ?? process.env,
+            timeout: options.timeout,
+            shell: false,
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (data) => {
+            stdout += data.toString();
+        });
+        child.stderr?.on('data', (data) => {
+            stderr += data.toString();
+        });
+        child.on('close', (code) => {
+            resolve({
+                status: code ?? 1,
+                stdout,
+                stderr,
+            });
+        });
+        child.on('error', (err) => {
+            resolve({
+                status: 1,
+                stdout,
+                stderr: err.message,
+            });
+        });
+    });
+}
+//# sourceMappingURL=exec-file.js.map

package/dist/utils/exec-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-file.js","sourceRoot":"","sources":["../../src/utils/exec-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAc3C;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAc,EAAE,UAAuB,EAAE;IACxF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC;gBACN,MAAM,EAAE,IAAI,IAAI,CAAC;gBACjB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC;gBACN,MAAM,EAAE,CAAC;gBACT,MAAM;gBACN,MAAM,EAAE,GAAG,CAAC,OAAO;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\n\nexport interface ExecResult {\n  status: number;\n  stdout: string;\n  stderr: string;\n}\n\nexport interface ExecOptions {\n  cwd?: string;\n  timeout?: number;\n  env?: NodeJS.ProcessEnv;\n}\n\n/**\n * Execute a command without throwing on non-zero exit codes.\n * Returns { status, stdout, stderr } for all outcomes.\n */\nexport function execFileNoThrow(command: string, args: string[], options: ExecOptions = {}): Promise<ExecResult> {\n  return new Promise((resolve) => {\n    const child = spawn(command, args, {\n      cwd: options.cwd,\n      env: options.env ?? process.env,\n      timeout: options.timeout,\n      shell: false,\n    });\n\n    let stdout = '';\n    let stderr = '';\n\n    child.stdout?.on('data', (data) => {\n      stdout += data.toString();\n    });\n\n    child.stderr?.on('data', (data) => {\n      stderr += data.toString();\n    });\n\n    child.on('close', (code) => {\n      resolve({\n        status: code ?? 1,\n        stdout,\n        stderr,\n      });\n    });\n\n    child.on('error', (err) => {\n      resolve({\n        status: 1,\n        stdout,\n        stderr: err.message,\n      });\n    });\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workos",
-  "version": "0.3.2",
+  "version": "0.4.5",
   "type": "module",
   "description": "The Official Workos CLI",
   "repository": {
@@ -41,6 +41,7 @@
     "@anthropic-ai/sdk": "^0.71.2",
     "@clack/core": "^0.5.0",
     "@clack/prompts": "0.11.0",
+    "@napi-rs/keyring": "^1.2.0",
     "chalk": "^5.6.2",
     "diff": "^8.0.3",
     "fast-glob": "^3.3.3",
@@ -63,6 +64,7 @@
     "@vitest/coverage-v8": "^4.0.18",
     "@vitest/ui": "^4.0.18",
     "dotenv": "^17.2.3",
+    "p-limit": "^7.2.0",
     "prettier": "^3.8.0",
     "tsx": "^4.20.3",
     "typescript": "^5.9.3",
@@ -86,6 +88,12 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "eval": "tsx tests/evals/index.ts",
+    "eval:history": "tsx tests/evals/index.ts history",
+    "eval:diff": "tsx tests/evals/index.ts diff",
+    "eval:prune": "tsx tests/evals/index.ts prune",
+    "eval:logs": "tsx tests/evals/index.ts logs",
+    "eval:show": "tsx tests/evals/index.ts show"
   }
 }

package/skills/workos-authkit-nextjs/SKILL.md

@@ -55,6 +55,46 @@ Next.js version?
 
 Middleware/proxy code: See README for `authkitMiddleware()` export pattern.
 
+### Existing Middleware (IMPORTANT)
+
+If `middleware.ts` already exists with custom logic (rate limiting, logging, headers, etc.), use the **`authkit()` composable function** instead of `authkitMiddleware`.
+
+**Pattern for composing with existing middleware:**
+
+```typescript
+import { NextRequest, NextResponse } from 'next/server';
+import { authkit, handleAuthkitHeaders } from '@workos-inc/authkit-nextjs';
+
+export default async function middleware(request: NextRequest) {
+  // 1. Get auth session and headers from AuthKit
+  const { session, headers, authorizationUrl } = await authkit(request);
+  const { pathname } = request.nextUrl;
+
+  // 2. === YOUR EXISTING MIDDLEWARE LOGIC ===
+  // Rate limiting, logging, custom headers, etc.
+  const rateLimitResult = checkRateLimit(request);
+  if (!rateLimitResult.allowed) {
+    return new NextResponse('Too Many Requests', { status: 429 });
+  }
+
+  // 3. Protect routes - redirect to auth if needed
+  if (pathname.startsWith('/dashboard') && !session.user && authorizationUrl) {
+    return handleAuthkitHeaders(request, headers, { redirect: authorizationUrl });
+  }
+
+  // 4. Continue with AuthKit headers properly handled
+  return handleAuthkitHeaders(request, headers);
+}
+```
+
+**Key functions:**
+
+- `authkit(request)` - Returns `{ session, headers, authorizationUrl }` for composition
+- `handleAuthkitHeaders(request, headers, options?)` - Ensures AuthKit headers pass through correctly
+- For rewrites, use `partitionAuthkitHeaders()` and `applyResponseHeaders()` (see README)
+
+**Critical:** Always return via `handleAuthkitHeaders()` to ensure `withAuth()` works in pages.
+
 ## Step 5: Create Callback Route
 
 Parse `NEXT_PUBLIC_WORKOS_REDIRECT_URI` to determine route path:
@@ -78,33 +118,58 @@ export const GET = handleAuth();
 
 Check README for exact usage. If build fails with "cookies outside request scope", the handler is likely missing async/await.
 
-## Step 6: Provider Setup
+## Step 6: Provider Setup (REQUIRED)
+
+**CRITICAL:** You MUST wrap the app in `AuthKitProvider` in `app/layout.tsx`.
+
+This is required for:
+
+- Client-side auth state via `useAuth()` hook
+- Consistent auth UX across client/server boundaries
+- Proper migration from Auth0 (which uses client-side auth)
+
+```tsx
+// app/layout.tsx
+import { AuthKitProvider } from '@workos-inc/authkit-nextjs';
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en">
+      <body>
+        <AuthKitProvider>{children}</AuthKitProvider>
+      </body>
+    </html>
+  );
+}
+```
+
+Check README for exact import path - it may be a subpath export like `@workos-inc/authkit-nextjs/components`.
 
-Wrap app in `AuthKitProvider` in `app/layout.tsx`. See README for import path.
+**Do NOT skip this step** even if using server-side auth patterns elsewhere.
 
 ## Step 7: UI Integration
 
 Add auth UI to `app/page.tsx` using SDK functions. See README for `getUser`, `getSignInUrl`, `signOut` usage.
 
-## Verification Checklist
+## Verification Checklist (ALL MUST PASS)
 
-Run these commands to confirm integration:
+Run these commands to confirm integration. **Do not mark complete until all pass:**
 
 ```bash
-# Check middleware/proxy exists (one should match)
+# 1. Check middleware/proxy exists (one should match)
 ls proxy.ts middleware.ts src/proxy.ts src/middleware.ts 2>/dev/null
 
-# Check provider is wrapped
-grep -l "AuthKitProvider" app/layout.tsx
+# 2. CRITICAL: Check AuthKitProvider is in layout (REQUIRED)
+grep "AuthKitProvider" app/layout.tsx || echo "FAIL: AuthKitProvider missing from layout"
 
-# Check callback route exists
+# 3. Check callback route exists
 find app -name "route.ts" -path "*/callback/*"
 
-# Build succeeds
+# 4. Build succeeds
 npm run build
 ```
 
-All checks must pass before marking complete.
+**If check #2 fails:** Go back to Step 6 and add AuthKitProvider. This is not optional.
 
 ## Error Recovery
 

package/skills/workos-authkit-tanstack-start/SKILL.md

@@ -12,9 +12,9 @@ description: Integrate WorkOS AuthKit with TanStack Start applications. Full-sta
    ├── Extract package name from install command
    └── README is source of truth for ALL code patterns
 
-2. Verify TanStack Start project
-   ├── @tanstack/start or @tanstack/react-start in package.json
-   └── app.config.ts exists (vinxi)
+2. Detect directory structure
+   ├── src/ (TanStack Start v1.132+, default)
+   └── app/ (legacy vinxi-based projects)
 
 3. Follow README install/setup exactly
    └── Do not invent commands or patterns
@@ -28,7 +28,7 @@ WebFetch: `https://github.com/workos/authkit-tanstack-start/blob/main/README.md`
 
 From README, extract:
 
-1. Package name from install command (e.g., `pnpm add @workos/...`)
+1. Package name: `@workos/authkit-tanstack-react-start`
 2. Use that exact name for all imports
 
 **README overrides this skill if conflict.**
@@ -37,9 +37,38 @@ From README, extract:
 
 - [ ] README fetched and package name extracted
 - [ ] `@tanstack/start` or `@tanstack/react-start` in package.json
-- [ ] `app.config.ts` exists
+- [ ] Identify directory structure: `src/` (modern) or `app/` (legacy)
 - [ ] Environment variables set (see below)
 
+## Directory Structure Detection
+
+**Modern TanStack Start (v1.132+)** uses `src/`:
+
+```
+src/
+├── start.ts              # Middleware config (CRITICAL)
+├── router.tsx            # Router setup
+├── routes/
+│   ├── __root.tsx        # Root layout
+│   ├── api.auth.callback.tsx  # OAuth callback (flat route)
+│   └── ...
+```
+
+**Legacy (vinxi-based)** uses `app/`:
+
+```
+app/
+├── start.ts or router.tsx
+├── routes/
+│   └── api/auth/callback.tsx  # OAuth callback (nested route)
+```
+
+**Detection:**
+
+```bash
+ls src/routes 2>/dev/null && echo "Modern (src/)" || echo "Legacy (app/)"
+```
+
 ## Environment Variables
 
 | Variable                 | Format       | Required |
@@ -51,56 +80,184 @@ From README, extract:
 
 Generate password if missing: `openssl rand -base64 32`
 
+Default redirect URI: `http://localhost:3000/api/auth/callback`
+
 ## Middleware Configuration (CRITICAL)
 
-**authkitMiddleware MUST be configured or auth will fail.**
+**authkitMiddleware MUST be configured or auth will fail silently.**
 
-Find file with `createRouter` (typically `app/router.tsx` or `app.tsx`).
+Create or update `src/start.ts` (or `app/start.ts` for legacy):
+
+```typescript
+import { authkitMiddleware } from '@workos/authkit-tanstack-react-start';
+
+export default {
+  requestMiddleware: [authkitMiddleware()],
+};
+```
+
+Alternative pattern with createStart:
+
+```typescript
+import { createStart } from '@tanstack/react-start';
+import { authkitMiddleware } from '@workos/authkit-tanstack-react-start';
+
+export default createStart({
+  requestMiddleware: [authkitMiddleware()],
+});
+```
 
 ### Verification Checklist
 
-- [ ] `authkitMiddleware` imported from SDK package
-- [ ] `middleware: [authkitMiddleware()]` in createRouter config
-- [ ] Array syntax used: `[authkitMiddleware()]` not `authkitMiddleware()`
+- [ ] `authkitMiddleware` imported from `@workos/authkit-tanstack-react-start`
+- [ ] Middleware in `requestMiddleware` array
+- [ ] File exports the config (default export or named `startInstance`)
 
-Verify: `grep "authkitMiddleware" app/router.tsx app.tsx src/router.tsx`
+Verify: `grep -r "authkitMiddleware" src/ app/ 2>/dev/null`
+
+## Callback Route (CRITICAL)
+
+Path must match `WORKOS_REDIRECT_URI`. For `/api/auth/callback`:
+
+**Modern (flat routes):** `src/routes/api.auth.callback.tsx`
+**Legacy (nested routes):** `app/routes/api/auth/callback.tsx`
+
+```typescript
+import { createFileRoute } from '@tanstack/react-router';
+import { handleCallbackRoute } from '@workos/authkit-tanstack-react-start';
+
+export const Route = createFileRoute('/api/auth/callback')({
+  server: {
+    handlers: {
+      GET: handleCallbackRoute(),
+    },
+  },
+});
+```
 
-## Logout Route Pattern
+**Key points:**
 
-Logout requires `signOut()` followed by redirect in a route loader. See README for exact implementation.
+- Use `handleCallbackRoute()` - do not write custom OAuth logic
+- Route path string must match the URI path exactly
+- This is a server-only route (no component needed)
 
-## Callback Route
+## Protected Routes
 
-Path must match `WORKOS_REDIRECT_URI`. If URI is `/api/auth/callback`:
+Use `getAuth()` in route loaders to check authentication:
 
-- File: `app/routes/api/auth/callback.tsx`
-- Use `handleAuth()` from SDK - do not write custom OAuth logic
+```typescript
+import { createFileRoute, redirect } from '@tanstack/react-router';
+import { getAuth, getSignInUrl } from '@workos/authkit-tanstack-react-start';
+
+export const Route = createFileRoute('/dashboard')({
+  loader: async () => {
+    const { user } = await getAuth();
+    if (!user) {
+      const signInUrl = await getSignInUrl();
+      throw redirect({ href: signInUrl });
+    }
+    return { user };
+  },
+  component: Dashboard,
+});
+```
+
+## Sign Out Route
+
+```typescript
+import { createFileRoute, redirect } from '@tanstack/react-router';
+import { signOut } from '@workos/authkit-tanstack-react-start';
+
+export const Route = createFileRoute('/signout')({
+  loader: async () => {
+    await signOut();
+    throw redirect({ href: '/' });
+  },
+});
+```
+
+## Client-Side Hooks (Optional)
+
+Only needed if you want reactive auth state in components.
+
+**1. Add AuthKitProvider to root:**
+
+```typescript
+// src/routes/__root.tsx
+import { AuthKitProvider } from '@workos/authkit-tanstack-react-start/client';
+
+function RootComponent() {
+  return (
+    <AuthKitProvider>
+      <Outlet />
+    </AuthKitProvider>
+  );
+}
+```
+
+**2. Use hooks in components:**
+
+```typescript
+import { useAuth } from '@workos/authkit-tanstack-react-start/client';
+
+function Profile() {
+  const { user, isLoading } = useAuth();
+  // ...
+}
+```
+
+**Note:** Server-side `getAuth()` is preferred for most use cases.
 
 ## Error Recovery
 
 ### "AuthKit middleware is not configured"
 
-**Cause:** `authkitMiddleware()` not added to router
-**Fix:** Add `middleware: [authkitMiddleware()]` to createRouter config
-**Verify:** `grep "authkitMiddleware" app/router.tsx app.tsx`
+**Cause:** `authkitMiddleware()` not in start.ts
+**Fix:** Create/update `src/start.ts` with middleware config
+**Verify:** `grep -r "authkitMiddleware" src/`
 
 ### "Module not found" for SDK
 
 **Cause:** Wrong package name or not installed
-**Fix:** Re-read README, extract correct package name, reinstall
-**Verify:** `ls node_modules/` + package name from README
+**Fix:** `pnpm add @workos/authkit-tanstack-react-start`
+**Verify:** `ls node_modules/@workos/authkit-tanstack-react-start`
 
 ### Callback 404
 
-**Cause:** Route path doesn't match WORKOS_REDIRECT_URI
-**Fix:** File path must mirror URI path under `app/routes/`
+**Cause:** Route file path doesn't match WORKOS_REDIRECT_URI
+**Fix:**
+
+- URI `/api/auth/callback` → file `src/routes/api.auth.callback.tsx` (flat) or `app/routes/api/auth/callback.tsx` (nested)
+- Route path string in `createFileRoute()` must match exactly
 
-### getAuth returns undefined
+### getAuth returns undefined user
 
-**Cause:** Middleware not configured
-**Fix:** Same as "AuthKit middleware not configured" above
+**Cause:** Middleware not configured or not running
+**Fix:** Ensure `authkitMiddleware()` is in start.ts requestMiddleware array
 
 ### "Cookie password too short"
 
 **Cause:** WORKOS_COOKIE_PASSWORD < 32 chars
 **Fix:** `openssl rand -base64 32`, update .env
+
+### Build fails with route type errors
+
+**Cause:** Route tree not regenerated after adding routes
+**Fix:** `pnpm dev` to regenerate `routeTree.gen.ts`
+
+## SDK Exports Reference
+
+**Server (main export):**
+
+- `authkitMiddleware()` - Request middleware
+- `handleCallbackRoute()` - OAuth callback handler
+- `getAuth()` - Get current session
+- `signOut()` - Sign out user
+- `getSignInUrl()` / `getSignUpUrl()` - Auth URLs
+- `switchToOrganization()` - Change org context
+
+**Client (`/client` subpath):**
+
+- `AuthKitProvider` - Context provider
+- `useAuth()` - Auth state hook
+- `useAccessToken()` - Token management