workos 0.7.3 → 0.8.1

package/dist/commands/seed.js

@@ -0,0 +1,238 @@
+import { readFileSync, writeFileSync, existsSync, unlinkSync } from 'node:fs';
+import chalk from 'chalk';
+import { parse as parseYaml } from 'yaml';
+import { createWorkOSClient } from '../lib/workos-client.js';
+import { outputJson, outputSuccess, isJsonMode, exitWithError } from '../utils/output.js';
+const STATE_FILE = '.workos-seed-state.json';
+function loadState() {
+    if (!existsSync(STATE_FILE))
+        return null;
+    try {
+        return JSON.parse(readFileSync(STATE_FILE, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+function saveState(state) {
+    writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+}
+export async function runSeed(options, apiKey, baseUrl) {
+    if (options.clean) {
+        await runSeedClean(apiKey, baseUrl);
+        return;
+    }
+    if (!options.file) {
+        return exitWithError({
+            code: 'missing_args',
+            message: 'Provide a seed file: workos seed --file=workos-seed.yml',
+        });
+    }
+    if (!existsSync(options.file)) {
+        return exitWithError({
+            code: 'file_not_found',
+            message: `Seed file not found: ${options.file}. Create workos-seed.yml or run \`workos seed\` without --file for interactive mode.`,
+        });
+    }
+    const raw = readFileSync(options.file, 'utf-8');
+    let seedConfig;
+    try {
+        seedConfig = parseYaml(raw);
+    }
+    catch (error) {
+        exitWithError({
+            code: 'invalid_yaml',
+            message: `Failed to parse seed file: ${error instanceof Error ? error.message : 'Invalid YAML'}`,
+        });
+    }
+    const client = createWorkOSClient(apiKey, baseUrl);
+    const state = { permissions: [], roles: [], organizations: [], createdAt: new Date().toISOString() };
+    try {
+        // 1. Create permissions
+        if (seedConfig.permissions) {
+            for (const perm of seedConfig.permissions) {
+                try {
+                    await client.sdk.authorization.createPermission({
+                        slug: perm.slug,
+                        name: perm.name,
+                        ...(perm.description && { description: perm.description }),
+                    });
+                    state.permissions.push({ slug: perm.slug });
+                    if (!isJsonMode())
+                        console.log(chalk.green(`  Created permission: ${perm.slug}`));
+                }
+                catch (error) {
+                    if (isAlreadyExists(error)) {
+                        if (!isJsonMode())
+                            console.log(chalk.dim(`  Permission exists: ${perm.slug} (skipped)`));
+                    }
+                    else {
+                        throw error;
+                    }
+                }
+            }
+        }
+        // 2. Create roles + assign permissions
+        if (seedConfig.roles) {
+            for (const role of seedConfig.roles) {
+                try {
+                    await client.sdk.authorization.createEnvironmentRole({
+                        slug: role.slug,
+                        name: role.name,
+                        ...(role.description && { description: role.description }),
+                    });
+                    state.roles.push({ slug: role.slug });
+                    if (!isJsonMode())
+                        console.log(chalk.green(`  Created role: ${role.slug}`));
+                }
+                catch (error) {
+                    if (isAlreadyExists(error)) {
+                        if (!isJsonMode())
+                            console.log(chalk.dim(`  Role exists: ${role.slug} (skipped)`));
+                    }
+                    else {
+                        throw error;
+                    }
+                }
+                if (role.permissions?.length) {
+                    try {
+                        await client.sdk.authorization.setEnvironmentRolePermissions(role.slug, {
+                            permissions: role.permissions,
+                        });
+                        if (!isJsonMode())
+                            console.log(chalk.green(`  Set permissions on ${role.slug}: ${role.permissions.join(', ')}`));
+                    }
+                    catch {
+                        if (!isJsonMode())
+                            console.log(chalk.yellow(`  Warning: Failed to set permissions on ${role.slug}`));
+                    }
+                }
+            }
+        }
+        // 3. Create organizations
+        if (seedConfig.organizations) {
+            for (const org of seedConfig.organizations) {
+                try {
+                    const created = await client.sdk.organizations.createOrganization({
+                        name: org.name,
+                        ...(org.domains?.length && {
+                            domainData: org.domains.map((d) => ({ domain: d, state: 'verified' })),
+                        }),
+                    });
+                    state.organizations.push({ id: created.id, name: created.name });
+                    if (!isJsonMode())
+                        console.log(chalk.green(`  Created org: ${created.name} (${created.id})`));
+                }
+                catch (error) {
+                    if (isAlreadyExists(error)) {
+                        if (!isJsonMode())
+                            console.log(chalk.dim(`  Org may exist: ${org.name} (skipped)`));
+                    }
+                    else {
+                        throw error;
+                    }
+                }
+            }
+        }
+        // 4. Configure redirect URIs, CORS, homepage
+        if (seedConfig.config) {
+            await applyConfig(client, seedConfig.config);
+        }
+        saveState(state);
+        if (isJsonMode()) {
+            outputJson({ status: 'ok', message: 'Seed complete', state });
+        }
+        else {
+            console.log(chalk.green('\nSeed complete.'));
+            console.log(chalk.dim(`State saved to ${STATE_FILE}`));
+        }
+    }
+    catch (error) {
+        // Partial failure — save what was created so --clean can tear down
+        saveState(state);
+        exitWithError({
+            code: 'seed_failed',
+            message: `Seed failed: ${error instanceof Error ? error.message : 'Unknown error'}. Partial state saved to ${STATE_FILE}. Run \`workos seed --clean\` to tear down.`,
+            details: state,
+        });
+    }
+}
+async function runSeedClean(apiKey, baseUrl) {
+    const state = loadState();
+    if (!state) {
+        return exitWithError({
+            code: 'no_state',
+            message: `No seed state found (${STATE_FILE}). Nothing to clean.`,
+        });
+    }
+    const client = createWorkOSClient(apiKey, baseUrl);
+    // Delete in reverse order: orgs → roles → permissions
+    for (const org of state.organizations.reverse()) {
+        try {
+            await client.sdk.organizations.deleteOrganization(org.id);
+            if (!isJsonMode())
+                console.log(chalk.green(`  Deleted org: ${org.name} (${org.id})`));
+        }
+        catch {
+            if (!isJsonMode())
+                console.log(chalk.yellow(`  Warning: Could not delete org ${org.id}`));
+        }
+    }
+    for (const role of state.roles.reverse()) {
+        try {
+            // Env roles can't be deleted via SDK — skip silently
+            if (!isJsonMode())
+                console.log(chalk.dim(`  Env role ${role.slug}: skipped (env roles cannot be deleted)`));
+        }
+        catch {
+            // ignore
+        }
+    }
+    for (const perm of state.permissions.reverse()) {
+        try {
+            await client.sdk.authorization.deletePermission(perm.slug);
+            if (!isJsonMode())
+                console.log(chalk.green(`  Deleted permission: ${perm.slug}`));
+        }
+        catch {
+            if (!isJsonMode())
+                console.log(chalk.yellow(`  Warning: Could not delete permission ${perm.slug}`));
+        }
+    }
+    unlinkSync(STATE_FILE);
+    outputSuccess('Seed cleanup complete', { stateFile: STATE_FILE });
+}
+async function applyConfig(client, config) {
+    if (config.redirect_uris) {
+        for (const uri of config.redirect_uris) {
+            const result = await client.redirectUris.add(uri);
+            if (!isJsonMode()) {
+                console.log(result.alreadyExists
+                    ? chalk.dim(`  Redirect URI exists: ${uri}`)
+                    : chalk.green(`  Added redirect URI: ${uri}`));
+            }
+        }
+    }
+    if (config.cors_origins) {
+        for (const origin of config.cors_origins) {
+            const result = await client.corsOrigins.add(origin);
+            if (!isJsonMode()) {
+                console.log(result.alreadyExists
+                    ? chalk.dim(`  CORS origin exists: ${origin}`)
+                    : chalk.green(`  Added CORS origin: ${origin}`));
+            }
+        }
+    }
+    if (config.homepage_url) {
+        await client.homepageUrl.set(config.homepage_url);
+        if (!isJsonMode())
+            console.log(chalk.green(`  Set homepage URL: ${config.homepage_url}`));
+    }
+}
+function isAlreadyExists(error) {
+    if (!(error instanceof Error))
+        return false;
+    const msg = error.message.toLowerCase();
+    return msg.includes('already exists') || msg.includes('conflict') || msg.includes('duplicate');
+}
+//# sourceMappingURL=seed.js.map

package/dist/commands/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/commands/seed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAwB,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE1F,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAoB7C,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAgB;IACjC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAA2C,EAC3C,MAAc,EACd,OAAgB;IAEhB,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;YACnB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC;YACnB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,wBAAwB,OAAO,CAAC,IAAI,sFAAsF;SACpI,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,SAAS,CAAC,GAAG,CAAe,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE;SACjG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAc,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAEhH,IAAI,CAAC;QACH,wBAAwB;QACxB,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC;wBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;qBAC3D,CAAC,CAAC;oBACH,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC5C,IAAI,CAAC,UAAU,EAAE;wBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACpF,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC3B,IAAI,CAAC,UAAU,EAAE;4BAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC;oBAC3F,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,qBAAqB,CAAC;wBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;qBAC3D,CAAC,CAAC;oBACH,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtC,IAAI,CAAC,UAAU,EAAE;wBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC9E,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC3B,IAAI,CAAC,UAAU,EAAE;4BAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC;oBACrF,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;oBAC7B,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,EAAE;4BACtE,WAAW,EAAE,IAAI,CAAC,WAAW;yBAC9B,CAAC,CAAC;wBACH,IAAI,CAAC,UAAU,EAAE;4BACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBAClG,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,UAAU,EAAE;4BAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,2CAA2C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBACvG,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,kBAAkB,CAAC;wBAChE,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI;4BACzB,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,UAAiC,EAAE,CAAC,CAAC;yBAC9F,CAAC;qBACH,CAAC,CAAC;oBACH,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oBACjE,IAAI,CAAC,UAAU,EAAE;wBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAChG,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC3B,IAAI,CAAC,UAAU,EAAE;4BAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC;oBACtF,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,SAAS,CAAC,KAAK,CAAC,CAAC;QAEjB,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mEAAmE;QACnE,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,aAAa,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,gBAAgB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,4BAA4B,UAAU,6CAA6C;YACpK,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAAgB;IAC1D,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,aAAa,CAAC;YACnB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,wBAAwB,UAAU,sBAAsB;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnD,sDAAsD;IACtD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,qDAAqD;YACrD,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,IAAI,yCAAyC,CAAC,CAAC,CAAC;QAC9G,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,0CAA0C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED,UAAU,CAAC,UAAU,CAAC,CAAC;IACvB,aAAa,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAuB,EAAE,MAAyC;IAC3F,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,aAAa;oBAClB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,GAAG,EAAE,CAAC;oBAC5C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAChD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,aAAa;oBAClB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,MAAM,EAAE,CAAC;oBAC9C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAClD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjG,CAAC","sourcesContent":["import { readFileSync, writeFileSync, existsSync, unlinkSync } from 'node:fs';\nimport chalk from 'chalk';\nimport { parse as parseYaml } from 'yaml';\nimport type { DomainData } from '@workos-inc/node';\nimport { createWorkOSClient, type WorkOSCLIClient } from '../lib/workos-client.js';\nimport { outputJson, outputSuccess, isJsonMode, exitWithError } from '../utils/output.js';\n\nconst STATE_FILE = '.workos-seed-state.json';\n\ninterface SeedConfig {\n  organizations?: Array<{ name: string; domains?: string[] }>;\n  permissions?: Array<{ name: string; slug: string; description?: string }>;\n  roles?: Array<{ name: string; slug: string; description?: string; permissions?: string[] }>;\n  config?: {\n    redirect_uris?: string[];\n    cors_origins?: string[];\n    homepage_url?: string;\n  };\n}\n\ninterface SeedState {\n  permissions: Array<{ slug: string }>;\n  roles: Array<{ slug: string }>;\n  organizations: Array<{ id: string; name: string }>;\n  createdAt: string;\n}\n\nfunction loadState(): SeedState | null {\n  if (!existsSync(STATE_FILE)) return null;\n  try {\n    return JSON.parse(readFileSync(STATE_FILE, 'utf-8'));\n  } catch {\n    return null;\n  }\n}\n\nfunction saveState(state: SeedState): void {\n  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));\n}\n\nexport async function runSeed(\n  options: { file?: string; clean?: boolean },\n  apiKey: string,\n  baseUrl?: string,\n): Promise<void> {\n  if (options.clean) {\n    await runSeedClean(apiKey, baseUrl);\n    return;\n  }\n\n  if (!options.file) {\n    return exitWithError({\n      code: 'missing_args',\n      message: 'Provide a seed file: workos seed --file=workos-seed.yml',\n    });\n  }\n\n  if (!existsSync(options.file)) {\n    return exitWithError({\n      code: 'file_not_found',\n      message: `Seed file not found: ${options.file}. Create workos-seed.yml or run \\`workos seed\\` without --file for interactive mode.`,\n    });\n  }\n\n  const raw = readFileSync(options.file, 'utf-8');\n  let seedConfig: SeedConfig;\n  try {\n    seedConfig = parseYaml(raw) as SeedConfig;\n  } catch (error) {\n    exitWithError({\n      code: 'invalid_yaml',\n      message: `Failed to parse seed file: ${error instanceof Error ? error.message : 'Invalid YAML'}`,\n    });\n  }\n\n  const client = createWorkOSClient(apiKey, baseUrl);\n  const state: SeedState = { permissions: [], roles: [], organizations: [], createdAt: new Date().toISOString() };\n\n  try {\n    // 1. Create permissions\n    if (seedConfig.permissions) {\n      for (const perm of seedConfig.permissions) {\n        try {\n          await client.sdk.authorization.createPermission({\n            slug: perm.slug,\n            name: perm.name,\n            ...(perm.description && { description: perm.description }),\n          });\n          state.permissions.push({ slug: perm.slug });\n          if (!isJsonMode()) console.log(chalk.green(`  Created permission: ${perm.slug}`));\n        } catch (error: unknown) {\n          if (isAlreadyExists(error)) {\n            if (!isJsonMode()) console.log(chalk.dim(`  Permission exists: ${perm.slug} (skipped)`));\n          } else {\n            throw error;\n          }\n        }\n      }\n    }\n\n    // 2. Create roles + assign permissions\n    if (seedConfig.roles) {\n      for (const role of seedConfig.roles) {\n        try {\n          await client.sdk.authorization.createEnvironmentRole({\n            slug: role.slug,\n            name: role.name,\n            ...(role.description && { description: role.description }),\n          });\n          state.roles.push({ slug: role.slug });\n          if (!isJsonMode()) console.log(chalk.green(`  Created role: ${role.slug}`));\n        } catch (error: unknown) {\n          if (isAlreadyExists(error)) {\n            if (!isJsonMode()) console.log(chalk.dim(`  Role exists: ${role.slug} (skipped)`));\n          } else {\n            throw error;\n          }\n        }\n\n        if (role.permissions?.length) {\n          try {\n            await client.sdk.authorization.setEnvironmentRolePermissions(role.slug, {\n              permissions: role.permissions,\n            });\n            if (!isJsonMode())\n              console.log(chalk.green(`  Set permissions on ${role.slug}: ${role.permissions.join(', ')}`));\n          } catch {\n            if (!isJsonMode()) console.log(chalk.yellow(`  Warning: Failed to set permissions on ${role.slug}`));\n          }\n        }\n      }\n    }\n\n    // 3. Create organizations\n    if (seedConfig.organizations) {\n      for (const org of seedConfig.organizations) {\n        try {\n          const created = await client.sdk.organizations.createOrganization({\n            name: org.name,\n            ...(org.domains?.length && {\n              domainData: org.domains.map((d) => ({ domain: d, state: 'verified' as DomainData['state'] })),\n            }),\n          });\n          state.organizations.push({ id: created.id, name: created.name });\n          if (!isJsonMode()) console.log(chalk.green(`  Created org: ${created.name} (${created.id})`));\n        } catch (error: unknown) {\n          if (isAlreadyExists(error)) {\n            if (!isJsonMode()) console.log(chalk.dim(`  Org may exist: ${org.name} (skipped)`));\n          } else {\n            throw error;\n          }\n        }\n      }\n    }\n\n    // 4. Configure redirect URIs, CORS, homepage\n    if (seedConfig.config) {\n      await applyConfig(client, seedConfig.config);\n    }\n\n    saveState(state);\n\n    if (isJsonMode()) {\n      outputJson({ status: 'ok', message: 'Seed complete', state });\n    } else {\n      console.log(chalk.green('\\nSeed complete.'));\n      console.log(chalk.dim(`State saved to ${STATE_FILE}`));\n    }\n  } catch (error) {\n    // Partial failure — save what was created so --clean can tear down\n    saveState(state);\n    exitWithError({\n      code: 'seed_failed',\n      message: `Seed failed: ${error instanceof Error ? error.message : 'Unknown error'}. Partial state saved to ${STATE_FILE}. Run \\`workos seed --clean\\` to tear down.`,\n      details: state,\n    });\n  }\n}\n\nasync function runSeedClean(apiKey: string, baseUrl?: string): Promise<void> {\n  const state = loadState();\n  if (!state) {\n    return exitWithError({\n      code: 'no_state',\n      message: `No seed state found (${STATE_FILE}). Nothing to clean.`,\n    });\n  }\n\n  const client = createWorkOSClient(apiKey, baseUrl);\n\n  // Delete in reverse order: orgs → roles → permissions\n  for (const org of state.organizations.reverse()) {\n    try {\n      await client.sdk.organizations.deleteOrganization(org.id);\n      if (!isJsonMode()) console.log(chalk.green(`  Deleted org: ${org.name} (${org.id})`));\n    } catch {\n      if (!isJsonMode()) console.log(chalk.yellow(`  Warning: Could not delete org ${org.id}`));\n    }\n  }\n\n  for (const role of state.roles.reverse()) {\n    try {\n      // Env roles can't be deleted via SDK — skip silently\n      if (!isJsonMode()) console.log(chalk.dim(`  Env role ${role.slug}: skipped (env roles cannot be deleted)`));\n    } catch {\n      // ignore\n    }\n  }\n\n  for (const perm of state.permissions.reverse()) {\n    try {\n      await client.sdk.authorization.deletePermission(perm.slug);\n      if (!isJsonMode()) console.log(chalk.green(`  Deleted permission: ${perm.slug}`));\n    } catch {\n      if (!isJsonMode()) console.log(chalk.yellow(`  Warning: Could not delete permission ${perm.slug}`));\n    }\n  }\n\n  unlinkSync(STATE_FILE);\n  outputSuccess('Seed cleanup complete', { stateFile: STATE_FILE });\n}\n\nasync function applyConfig(client: WorkOSCLIClient, config: NonNullable<SeedConfig['config']>): Promise<void> {\n  if (config.redirect_uris) {\n    for (const uri of config.redirect_uris) {\n      const result = await client.redirectUris.add(uri);\n      if (!isJsonMode()) {\n        console.log(\n          result.alreadyExists\n            ? chalk.dim(`  Redirect URI exists: ${uri}`)\n            : chalk.green(`  Added redirect URI: ${uri}`),\n        );\n      }\n    }\n  }\n\n  if (config.cors_origins) {\n    for (const origin of config.cors_origins) {\n      const result = await client.corsOrigins.add(origin);\n      if (!isJsonMode()) {\n        console.log(\n          result.alreadyExists\n            ? chalk.dim(`  CORS origin exists: ${origin}`)\n            : chalk.green(`  Added CORS origin: ${origin}`),\n        );\n      }\n    }\n  }\n\n  if (config.homepage_url) {\n    await client.homepageUrl.set(config.homepage_url);\n    if (!isJsonMode()) console.log(chalk.green(`  Set homepage URL: ${config.homepage_url}`));\n  }\n}\n\nfunction isAlreadyExists(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  const msg = error.message.toLowerCase();\n  return msg.includes('already exists') || msg.includes('conflict') || msg.includes('duplicate');\n}\n"]}

package/dist/commands/session.d.ts

@@ -0,0 +1,8 @@
+export interface SessionListOptions {
+    limit?: number;
+    before?: string;
+    after?: string;
+    order?: string;
+}
+export declare function runSessionList(userId: string, options: SessionListOptions, apiKey: string, baseUrl?: string): Promise<void>;
+export declare function runSessionRevoke(sessionId: string, apiKey: string, baseUrl?: string): Promise<void>;

package/dist/commands/session.js

@@ -0,0 +1,63 @@
+import chalk from 'chalk';
+import { createWorkOSClient } from '../lib/workos-client.js';
+import { formatTable } from '../utils/table.js';
+import { outputSuccess, outputJson, isJsonMode } from '../utils/output.js';
+import { createApiErrorHandler } from '../lib/api-error-handler.js';
+const handleApiError = createApiErrorHandler('Session');
+export async function runSessionList(userId, options, apiKey, baseUrl) {
+    const client = createWorkOSClient(apiKey, baseUrl);
+    try {
+        const result = await client.sdk.userManagement.listSessions(userId, {
+            limit: options.limit,
+            before: options.before,
+            after: options.after,
+            order: options.order,
+        });
+        if (isJsonMode()) {
+            outputJson({ data: result.data, listMetadata: result.listMetadata });
+            return;
+        }
+        if (result.data.length === 0) {
+            console.log('No sessions found.');
+            return;
+        }
+        const rows = result.data.map((s) => [
+            s.id,
+            s.userAgent ?? chalk.dim('-'),
+            s.ipAddress ?? chalk.dim('-'),
+            s.createdAt,
+            s.expiresAt,
+        ]);
+        console.log(formatTable([
+            { header: 'ID' },
+            { header: 'User Agent' },
+            { header: 'IP Address' },
+            { header: 'Created' },
+            { header: 'Expires' },
+        ], rows));
+        const { before, after } = result.listMetadata;
+        if (before && after) {
+            console.log(chalk.dim(`Before: ${before}  After: ${after}`));
+        }
+        else if (before) {
+            console.log(chalk.dim(`Before: ${before}`));
+        }
+        else if (after) {
+            console.log(chalk.dim(`After: ${after}`));
+        }
+    }
+    catch (error) {
+        handleApiError(error);
+    }
+}
+export async function runSessionRevoke(sessionId, apiKey, baseUrl) {
+    const client = createWorkOSClient(apiKey, baseUrl);
+    try {
+        await client.sdk.userManagement.revokeSession({ sessionId });
+        outputSuccess('Revoked session', { id: sessionId });
+    }
+    catch (error) {
+        handleApiError(error);
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/commands/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;AASxD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,OAA2B,EAC3B,MAAc,EACd,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,EAAE;YAClE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAmC;SACnD,CAAC,CAAC;QAEH,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7B,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS;SACZ,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CACT,WAAW,CACT;YACE,EAAE,MAAM,EAAE,IAAI,EAAE;YAChB,EAAE,MAAM,EAAE,YAAY,EAAE;YACxB,EAAE,MAAM,EAAE,YAAY,EAAE;YACxB,EAAE,MAAM,EAAE,SAAS,EAAE;YACrB,EAAE,MAAM,EAAE,SAAS,EAAE;SACtB,EACD,IAAI,CACL,CACF,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAC9C,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,MAAM,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc,EAAE,OAAgB;IACxF,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACH,CAAC","sourcesContent":["import chalk from 'chalk';\nimport { createWorkOSClient } from '../lib/workos-client.js';\nimport { formatTable } from '../utils/table.js';\nimport { outputSuccess, outputJson, isJsonMode } from '../utils/output.js';\nimport { createApiErrorHandler } from '../lib/api-error-handler.js';\n\nconst handleApiError = createApiErrorHandler('Session');\n\nexport interface SessionListOptions {\n  limit?: number;\n  before?: string;\n  after?: string;\n  order?: string;\n}\n\nexport async function runSessionList(\n  userId: string,\n  options: SessionListOptions,\n  apiKey: string,\n  baseUrl?: string,\n): Promise<void> {\n  const client = createWorkOSClient(apiKey, baseUrl);\n\n  try {\n    const result = await client.sdk.userManagement.listSessions(userId, {\n      limit: options.limit,\n      before: options.before,\n      after: options.after,\n      order: options.order as 'asc' | 'desc' | undefined,\n    });\n\n    if (isJsonMode()) {\n      outputJson({ data: result.data, listMetadata: result.listMetadata });\n      return;\n    }\n\n    if (result.data.length === 0) {\n      console.log('No sessions found.');\n      return;\n    }\n\n    const rows = result.data.map((s) => [\n      s.id,\n      s.userAgent ?? chalk.dim('-'),\n      s.ipAddress ?? chalk.dim('-'),\n      s.createdAt,\n      s.expiresAt,\n    ]);\n\n    console.log(\n      formatTable(\n        [\n          { header: 'ID' },\n          { header: 'User Agent' },\n          { header: 'IP Address' },\n          { header: 'Created' },\n          { header: 'Expires' },\n        ],\n        rows,\n      ),\n    );\n\n    const { before, after } = result.listMetadata;\n    if (before && after) {\n      console.log(chalk.dim(`Before: ${before}  After: ${after}`));\n    } else if (before) {\n      console.log(chalk.dim(`Before: ${before}`));\n    } else if (after) {\n      console.log(chalk.dim(`After: ${after}`));\n    }\n  } catch (error) {\n    handleApiError(error);\n  }\n}\n\nexport async function runSessionRevoke(sessionId: string, apiKey: string, baseUrl?: string): Promise<void> {\n  const client = createWorkOSClient(apiKey, baseUrl);\n\n  try {\n    await client.sdk.userManagement.revokeSession({ sessionId });\n    outputSuccess('Revoked session', { id: sessionId });\n  } catch (error) {\n    handleApiError(error);\n  }\n}\n"]}

package/dist/commands/setup-org.d.ts

@@ -0,0 +1,6 @@
+export interface SetupOrgOptions {
+    name: string;
+    domain?: string;
+    roles?: string[];
+}
+export declare function runSetupOrg(options: SetupOrgOptions, apiKey: string, baseUrl?: string): Promise<void>;

package/dist/commands/setup-org.js

@@ -0,0 +1,99 @@
+import chalk from 'chalk';
+import { createWorkOSClient } from '../lib/workos-client.js';
+import { outputJson, isJsonMode } from '../utils/output.js';
+import { createApiErrorHandler } from '../lib/api-error-handler.js';
+const handleApiError = createApiErrorHandler('SetupOrg');
+export async function runSetupOrg(options, apiKey, baseUrl) {
+    const client = createWorkOSClient(apiKey, baseUrl);
+    const summary = {};
+    try {
+        // 1. Create organization
+        if (!isJsonMode())
+            console.log(chalk.bold(`Setting up organization: ${options.name}`));
+        const org = await client.sdk.organizations.createOrganization({
+            name: options.name,
+        });
+        summary.organizationId = org.id;
+        if (!isJsonMode())
+            console.log(chalk.green(`  Created org: ${org.name} (${org.id})`));
+        // 2. Add domain
+        if (options.domain) {
+            const domainResult = await client.sdk.organizationDomains.create({
+                domain: options.domain,
+                organizationId: org.id,
+            });
+            summary.domainId = domainResult.id;
+            if (!isJsonMode())
+                console.log(chalk.green(`  Added domain: ${options.domain}`));
+            // 3. Verify domain
+            try {
+                await client.sdk.organizationDomains.verify(domainResult.id);
+                summary.domainVerified = true;
+                if (!isJsonMode())
+                    console.log(chalk.green(`  Verified domain: ${options.domain}`));
+            }
+            catch {
+                summary.domainVerified = false;
+                if (!isJsonMode())
+                    console.log(chalk.yellow(`  Domain verification pending: ${options.domain}`));
+            }
+        }
+        // 4. Create org-scoped roles (copy from env role names)
+        if (options.roles?.length) {
+            summary.roles = [];
+            for (const roleSlug of options.roles) {
+                try {
+                    const role = await client.sdk.authorization.createOrganizationRole(org.id, {
+                        slug: roleSlug,
+                        name: roleSlug,
+                    });
+                    summary.roles.push(role.slug);
+                    if (!isJsonMode())
+                        console.log(chalk.green(`  Created org role: ${roleSlug}`));
+                }
+                catch (error) {
+                    if (error instanceof Error && error.message.toLowerCase().includes('already exists')) {
+                        if (!isJsonMode())
+                            console.log(chalk.dim(`  Role exists: ${roleSlug} (skipped)`));
+                    }
+                    else {
+                        if (!isJsonMode())
+                            console.log(chalk.yellow(`  Warning: Could not create role ${roleSlug}`));
+                    }
+                }
+            }
+        }
+        // 5. Generate Admin Portal link
+        try {
+            const portal = await client.sdk.portal.generateLink({
+                intent: 'sso',
+                organization: org.id,
+            });
+            summary.portalLink = portal.link;
+            if (!isJsonMode()) {
+                console.log(chalk.green(`  Portal link: ${portal.link}`));
+                console.log(chalk.dim('  Note: Portal links expire after 5 minutes.'));
+            }
+        }
+        catch {
+            if (!isJsonMode())
+                console.log(chalk.dim('  Portal link: skipped (may require plan upgrade)'));
+        }
+        // 6. Print summary
+        if (isJsonMode()) {
+            outputJson({ status: 'ok', ...summary });
+        }
+        else {
+            console.log(chalk.bold('\nSetup complete:'));
+            console.log(`  Organization: ${org.id}`);
+            if (options.domain)
+                console.log(`  Domain: ${options.domain} (${summary.domainVerified ? 'verified' : 'pending'})`);
+            if (summary.portalLink)
+                console.log(`  Portal: ${summary.portalLink}`);
+        }
+    }
+    catch (error) {
+        handleApiError(error);
+    }
+}
+//# sourceMappingURL=setup-org.js.map

package/dist/commands/setup-org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-org.js","sourceRoot":"","sources":["../../src/commands/setup-org.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,MAAM,cAAc,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;AAQzD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB,EAAE,MAAc,EAAE,OAAgB;IAC1F,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,IAAI,CAAC;QACH,yBAAyB;QACzB,IAAI,CAAC,UAAU,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAEvF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,kBAAkB,CAAC;YAC5D,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAEtF,gBAAgB;QAChB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAC/D,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,GAAG,CAAC,EAAE;aACvB,CAAC,CAAC;YACH,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAEjF,mBAAmB;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBAC7D,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC9B,IAAI,CAAC,UAAU,EAAE;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACtF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC/B,IAAI,CAAC,UAAU,EAAE;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,EAAE;wBACzE,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,QAAQ;qBACf,CAAC,CAAC;oBACF,OAAO,CAAC,KAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC5C,IAAI,CAAC,UAAU,EAAE;wBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACjF,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBACrF,IAAI,CAAC,UAAU,EAAE;4BAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,QAAQ,YAAY,CAAC,CAAC,CAAC;oBACpF,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,UAAU,EAAE;4BAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC,CAAC;oBAC/F,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;gBAClD,MAAM,EAAE,KAAuE;gBAC/E,YAAY,EAAE,GAAG,CAAC,EAAE;aACrB,CAAC,CAAC;YACH,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;YACjC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QACjG,CAAC;QAED,mBAAmB;QACnB,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM;gBAChB,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YAClG,IAAI,OAAO,CAAC,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACH,CAAC","sourcesContent":["import chalk from 'chalk';\nimport { createWorkOSClient } from '../lib/workos-client.js';\nimport { outputJson, isJsonMode } from '../utils/output.js';\nimport { createApiErrorHandler } from '../lib/api-error-handler.js';\n\nconst handleApiError = createApiErrorHandler('SetupOrg');\n\nexport interface SetupOrgOptions {\n  name: string;\n  domain?: string;\n  roles?: string[];\n}\n\nexport async function runSetupOrg(options: SetupOrgOptions, apiKey: string, baseUrl?: string): Promise<void> {\n  const client = createWorkOSClient(apiKey, baseUrl);\n  const summary: Record<string, unknown> = {};\n\n  try {\n    // 1. Create organization\n    if (!isJsonMode()) console.log(chalk.bold(`Setting up organization: ${options.name}`));\n\n    const org = await client.sdk.organizations.createOrganization({\n      name: options.name,\n    });\n    summary.organizationId = org.id;\n    if (!isJsonMode()) console.log(chalk.green(`  Created org: ${org.name} (${org.id})`));\n\n    // 2. Add domain\n    if (options.domain) {\n      const domainResult = await client.sdk.organizationDomains.create({\n        domain: options.domain,\n        organizationId: org.id,\n      });\n      summary.domainId = domainResult.id;\n      if (!isJsonMode()) console.log(chalk.green(`  Added domain: ${options.domain}`));\n\n      // 3. Verify domain\n      try {\n        await client.sdk.organizationDomains.verify(domainResult.id);\n        summary.domainVerified = true;\n        if (!isJsonMode()) console.log(chalk.green(`  Verified domain: ${options.domain}`));\n      } catch {\n        summary.domainVerified = false;\n        if (!isJsonMode()) console.log(chalk.yellow(`  Domain verification pending: ${options.domain}`));\n      }\n    }\n\n    // 4. Create org-scoped roles (copy from env role names)\n    if (options.roles?.length) {\n      summary.roles = [];\n      for (const roleSlug of options.roles) {\n        try {\n          const role = await client.sdk.authorization.createOrganizationRole(org.id, {\n            slug: roleSlug,\n            name: roleSlug,\n          });\n          (summary.roles as string[]).push(role.slug);\n          if (!isJsonMode()) console.log(chalk.green(`  Created org role: ${roleSlug}`));\n        } catch (error: unknown) {\n          if (error instanceof Error && error.message.toLowerCase().includes('already exists')) {\n            if (!isJsonMode()) console.log(chalk.dim(`  Role exists: ${roleSlug} (skipped)`));\n          } else {\n            if (!isJsonMode()) console.log(chalk.yellow(`  Warning: Could not create role ${roleSlug}`));\n          }\n        }\n      }\n    }\n\n    // 5. Generate Admin Portal link\n    try {\n      const portal = await client.sdk.portal.generateLink({\n        intent: 'sso' as Parameters<typeof client.sdk.portal.generateLink>[0]['intent'],\n        organization: org.id,\n      });\n      summary.portalLink = portal.link;\n      if (!isJsonMode()) {\n        console.log(chalk.green(`  Portal link: ${portal.link}`));\n        console.log(chalk.dim('  Note: Portal links expire after 5 minutes.'));\n      }\n    } catch {\n      if (!isJsonMode()) console.log(chalk.dim('  Portal link: skipped (may require plan upgrade)'));\n    }\n\n    // 6. Print summary\n    if (isJsonMode()) {\n      outputJson({ status: 'ok', ...summary });\n    } else {\n      console.log(chalk.bold('\\nSetup complete:'));\n      console.log(`  Organization: ${org.id}`);\n      if (options.domain)\n        console.log(`  Domain: ${options.domain} (${summary.domainVerified ? 'verified' : 'pending'})`);\n      if (summary.portalLink) console.log(`  Portal: ${summary.portalLink}`);\n    }\n  } catch (error) {\n    handleApiError(error);\n  }\n}\n"]}

package/dist/commands/user.js

@@ -1,56 +1,34 @@
 import chalk from 'chalk';
-import { workosRequest, WorkOSApiError } from '../lib/workos-api.js';
+import { createWorkOSClient } from '../lib/workos-client.js';
 import { formatTable } from '../utils/table.js';
-function handleApiError(error) {
-    if (error instanceof WorkOSApiError) {
-        if (error.statusCode === 401) {
-            console.error(chalk.red('Invalid API key. Check your environment configuration.'));
-        }
-        else if (error.statusCode === 404) {
-            console.error(chalk.red('User not found.'));
-        }
-        else if (error.statusCode === 422 && error.errors?.length) {
-            console.error(chalk.red(error.errors.map((e) => e.message).join(', ')));
-        }
-        else {
-            console.error(chalk.red(error.message));
-        }
-    }
-    else {
-        console.error(chalk.red(error instanceof Error ? error.message : 'Unknown error'));
-    }
-    process.exit(1);
-}
+import { outputSuccess, outputJson, isJsonMode } from '../utils/output.js';
+import { createApiErrorHandler } from '../lib/api-error-handler.js';
+const handleApiError = createApiErrorHandler('User');
 export async function runUserGet(userId, apiKey, baseUrl) {
+    const client = createWorkOSClient(apiKey, baseUrl);
     try {
-        const user = await workosRequest({
-            method: 'GET',
-            path: `/user_management/users/${userId}`,
-            apiKey,
-            baseUrl,
-        });
-        console.log(JSON.stringify(user, null, 2));
+        const user = await client.sdk.userManagement.getUser(userId);
+        outputJson(user);
     }
     catch (error) {
         handleApiError(error);
     }
 }
 export async function runUserList(options, apiKey, baseUrl) {
+    const client = createWorkOSClient(apiKey, baseUrl);
     try {
-        const result = await workosRequest({
-            method: 'GET',
-            path: '/user_management/users',
-            apiKey,
-            baseUrl,
-            params: {
-                email: options.email,
-                organization_id: options.organization,
-                limit: options.limit,
-                before: options.before,
-                after: options.after,
-                order: options.order,
-            },
+        const result = await client.sdk.userManagement.listUsers({
+            email: options.email,
+            organizationId: options.organization,
+            limit: options.limit,
+            before: options.before,
+            after: options.after,
+            order: options.order,
         });
+        if (isJsonMode()) {
+            outputJson({ data: result.data, listMetadata: result.listMetadata });
+            return;
+        }
         if (result.data.length === 0) {
             console.log('No users found.');
             return;
@@ -58,9 +36,9 @@ export async function runUserList(options, apiKey, baseUrl) {
         const rows = result.data.map((user) => [
             user.id,
             user.email,
-            user.first_name || chalk.dim('-'),
-            user.last_name || chalk.dim('-'),
-            user.email_verified ? 'Yes' : 'No',
+            user.firstName || chalk.dim('-'),
+            user.lastName || chalk.dim('-'),
+            user.emailVerified ? 'Yes' : 'No',
         ]);
         console.log(formatTable([
             { header: 'ID' },
@@ -69,7 +47,7 @@ export async function runUserList(options, apiKey, baseUrl) {
             { header: 'Last Name' },
             { header: 'Verified' },
         ], rows));
-        const { before, after } = result.list_metadata;
+        const { before, after } = result.listMetadata;
         if (before && after) {
             console.log(chalk.dim(`Before: ${before}  After: ${after}`));
         }
@@ -85,41 +63,27 @@ export async function runUserList(options, apiKey, baseUrl) {
     }
 }
 export async function runUserUpdate(userId, apiKey, options, baseUrl) {
-    const body = {};
-    if (options.firstName !== undefined)
-        body.first_name = options.firstName;
-    if (options.lastName !== undefined)
-        body.last_name = options.lastName;
-    if (options.emailVerified !== undefined)
-        body.email_verified = options.emailVerified;
-    if (options.password !== undefined)
-        body.password = options.password;
-    if (options.externalId !== undefined)
-        body.external_id = options.externalId;
+    const client = createWorkOSClient(apiKey, baseUrl);
     try {
-        const user = await workosRequest({
-            method: 'PUT',
-            path: `/user_management/users/${userId}`,
-            apiKey,
-            baseUrl,
-            body,
+        const user = await client.sdk.userManagement.updateUser({
+            userId,
+            ...(options.firstName !== undefined && { firstName: options.firstName }),
+            ...(options.lastName !== undefined && { lastName: options.lastName }),
+            ...(options.emailVerified !== undefined && { emailVerified: options.emailVerified }),
+            ...(options.password !== undefined && { password: options.password }),
+            ...(options.externalId !== undefined && { externalId: options.externalId }),
         });
-        console.log(chalk.green('Updated user'));
-        console.log(JSON.stringify(user, null, 2));
+        outputSuccess('Updated user', user);
     }
     catch (error) {
         handleApiError(error);
     }
 }
 export async function runUserDelete(userId, apiKey, baseUrl) {
+    const client = createWorkOSClient(apiKey, baseUrl);
     try {
-        await workosRequest({
-            method: 'DELETE',
-            path: `/user_management/users/${userId}`,
-            apiKey,
-            baseUrl,
-        });
-        console.log(chalk.green(`Deleted user ${userId}`));
+        await client.sdk.userManagement.deleteUser(userId);
+        outputSuccess('Deleted user', { id: userId });
     }
     catch (error) {
         handleApiError(error);