workos 0.8.2 → 0.10.0

package/dist/lib/agent-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-runner.js","sourceRoot":"","sources":["../../src/lib/agent-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAoB,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAuB,EAAE,OAAyB;IACxF,wCAAwC;IACxC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE;QAC9B,OAAO,EAAE,iCAAiC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;KACjE,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEtD,wEAAwE;IAExE,kCAAkC;IAClC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAE/G,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAElE,2CAA2C;IAC3C,IAAI,gBAAgB,IAAI,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC1D,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC1E,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,UAAU,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAClD,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;KACzC,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAE5G,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExE,mEAAmE;IACnE,mFAAmF;IACnF,IAAI,CAAC,mBAAmB,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE;YAC9E,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3G,8DAA8D;IAC9D,gEAAgE;IAChE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,IAAI,GAAG,YAAY,EAAE,CAAC;QAErF,gEAAgE;QAChE,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAEvG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE;YAChC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,gBAAgB,EAAE,QAAQ;YAC1B,CAAC,cAAc,CAAC,EAAE,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACnD,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,sBAAsB,CAC9C,MAAM,EACN;QACE,gBAAgB,EAAE,gBAAgB,IAAI,QAAQ;QAC9C,UAAU,EAAE,kBAAkB;KAC/B,EACD,gBAAgB,CACjB,CAAC;IAEF,2BAA2B;IAC3B,oFAAoF;IACpF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC;QACE,gBAAgB,EAAE,OAAO,CAAC,UAAU;QACpC,YAAY,EAAE,MAAM;QACpB,aAAa,EAAE,wBAAwB;KACxC,EACD,OAAO,CACR,CAAC;IAEF,MAAM,WAAW,GAA4B,OAAO,CAAC,UAAU;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACnC,iBAAiB,EAAE,2BAA2B;SAC/C,CAAC;IAEN,qFAAqF;IACrF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAChC,KAAK,EACL,iBAAiB,EACjB,OAAO,EACP;QACE,cAAc,EAAE,eAAe;QAC/B,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,cAAc;QACxC,YAAY,EAAE,oBAAoB;KACnC,EACD,OAAO,CAAC,OAAO,EACf,WAAW,CACZ,CAAC;IAEF,mEAAmE;IACnE,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,KAAK,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,sBAAsB;IACtB,IAAI,WAAW,CAAC,UAAU,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACvE,SAAS,CAAC,OAAO,CAAC,gCAAgC,EAAE;YAClD,MAAM,EAAE,qBAAqB;YAC7B,WAAW,EAAE,WAAW,CAAC,UAAU;YACnC,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACpC,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,8DAA8D;IAC9D,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAEtF,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE;YACnG,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE;YAC3C,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM;YAC1C,UAAU,EAAE,gBAAgB,CAAC,UAAU;SACxC,CAAC,CAAC;IACL,CAAC;IAED,sDAAsD;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEhE,oEAAoE;IACpE,IAAI,eAAe,GAAa,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;QACvC,eAAe,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE;YAC9D,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;YACxC,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,gBAAgB,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE;QACjF,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,EAAE;KAC5F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,MAAM,SAAS,GAAG;QAChB,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;QAChD,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,eAAe;YAChE,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,EAAE;KACP,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAEnE,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,MAAuB,EACvB,OAGC,EACD,gBAAqC;IAErC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB;QAC9D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,iBAAiB,GACrB,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,IAAI,8BAA8B,CAAC,CAAC;IACnF,CAAC;IAED,oDAAoD;IACpD,MAAM,iBAAiB,GACrB,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAEvG,OAAO,gDAAgD,MAAM,CAAC,QAAQ,CAAC,IAAI;;;;eAI9D,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,gBAAgB;gBAC/C,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,iBAAiB;;;;;;;IAOjE,iBAAiB;;;;;YAKT,SAAS;;;;;;;;;;;wBAWG,SAAS,SAAS,CAAC;AAC3C,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAuB,EAAE,OAAiB,EAAE,SAAmB;IAC7F,MAAM,KAAK,GAAa,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAC;IAEvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CACR,eAAe,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EACxC,EAAE,EACF,4GAA4G,CAC7G,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["import { SPINNER_MESSAGE, type FrameworkConfig } from './framework-config.js';\nimport { validateInstallation, quickCheckValidateAndFormat } from './validation/index.js';\nimport type { InstallerOptions } from '../utils/types.js';\nimport {\n  ensurePackageIsInstalled,\n  getOrAskForWorkOSCredentials,\n  getPackageDotJson,\n  isUsingTypeScript,\n} from '../utils/clack-utils.js';\nimport { analytics } from '../utils/analytics.js';\nimport { INSTALLER_INTERACTION_EVENT_NAME } from './constants.js';\nimport { initializeAgent, runAgent, type RetryConfig } from './agent-interface.js';\nimport { uploadEnvironmentVariablesStep } from '../steps/index.js';\nimport { autoConfigureWorkOSEnvironment } from './workos-management.js';\nimport { detectPort, getCallbackPath } from './port-detection.js';\nimport { writeEnvLocal } from './env-writer.js';\n\n/**\n * Universal agent-powered wizard runner.\n * Handles the complete flow for any framework using WorkOS MCP integration.\n *\n * @returns A detailed summary of what was done and next steps\n */\nexport async function runAgentInstaller(config: FrameworkConfig, options: InstallerOptions): Promise<string> {\n  // Emit status for UI adapters to render\n  options.emitter?.emit('status', {\n    message: `Setting up WorkOS AuthKit for ${config.metadata.name}`,\n  });\n\n  const typeScriptDetected = isUsingTypeScript(options);\n\n  // Git check is now handled by the state machine - no need to check here\n\n  // Framework detection and version\n  const packageJson = await getPackageDotJson(options);\n  await ensurePackageIsInstalled(packageJson, config.detection.packageName, config.detection.packageDisplayName);\n\n  const frameworkVersion = config.detection.getVersion(packageJson);\n\n  // Set analytics tags for framework version\n  if (frameworkVersion && config.detection.getVersionBucket) {\n    const versionBucket = config.detection.getVersionBucket(frameworkVersion);\n    analytics.setTag(`${config.metadata.integration}-version`, versionBucket);\n  }\n\n  analytics.capture(INSTALLER_INTERACTION_EVENT_NAME, {\n    action: 'started agent integration',\n    integration: config.metadata.integration,\n  });\n\n  // Get WorkOS credentials (API key optional for client-only SDKs)\n  const { apiKey, clientId } = await getOrAskForWorkOSCredentials(options, config.environment.requiresApiKey);\n\n  // Check if caller (state machine) already configured WorkOS environment\n  // If credentials were passed via options, the caller handled config+env writing\n  const callerHandledConfig = Boolean(options.apiKey || options.clientId);\n\n  // Auto-configure WorkOS environment (redirect URI, CORS, homepage)\n  // Skip if caller already handled this (prevents duplicate dashboard config output)\n  if (!callerHandledConfig && apiKey && config.environment.requiresApiKey) {\n    const port = detectPort(config.metadata.integration, options.installDir);\n    await autoConfigureWorkOSEnvironment(apiKey, config.metadata.integration, port, {\n      homepageUrl: options.homepageUrl,\n      redirectUri: options.redirectUri,\n    });\n  }\n\n  // Gather framework-specific context (e.g., Next.js router, React Native platform)\n  const frameworkContext = config.metadata.gatherContext ? await config.metadata.gatherContext(options) : {};\n\n  // Write environment variables to .env.local BEFORE agent runs\n  // Skip if caller already handled this (prevents double-writing)\n  if (!callerHandledConfig) {\n    const port = detectPort(config.metadata.integration, options.installDir);\n    const callbackPath = getCallbackPath(config.metadata.integration);\n    const redirectUri = options.redirectUri || `http://localhost:${port}${callbackPath}`;\n\n    // Next.js requires NEXT_PUBLIC_ prefix for client-side env vars\n    const redirectUriKey =\n      config.metadata.integration === 'nextjs' ? 'NEXT_PUBLIC_WORKOS_REDIRECT_URI' : 'WORKOS_REDIRECT_URI';\n\n    writeEnvLocal(options.installDir, {\n      ...(apiKey ? { WORKOS_API_KEY: apiKey } : {}),\n      WORKOS_CLIENT_ID: clientId,\n      [redirectUriKey]: redirectUri,\n    });\n  }\n\n  // Set analytics tags from framework context\n  const contextTags = config.analytics.getTags(frameworkContext);\n  Object.entries(contextTags).forEach(([key, value]) => {\n    analytics.setTag(key, value);\n  });\n\n  // Build integration prompt (credentials are already in .env.local)\n  const integrationPrompt = buildIntegrationPrompt(\n    config,\n    {\n      frameworkVersion: frameworkVersion || 'latest',\n      typescript: typeScriptDetected,\n    },\n    frameworkContext,\n  );\n\n  // Initialize and run agent\n  // Spinner is now handled by adapters listening to agent:start/agent:progress events\n  const agent = await initializeAgent(\n    {\n      workingDirectory: options.installDir,\n      workOSApiKey: apiKey,\n      workOSApiHost: 'https://api.workos.com',\n    },\n    options,\n  );\n\n  const retryConfig: RetryConfig | undefined = options.noValidate\n    ? undefined\n    : {\n        maxRetries: options.maxRetries ?? 2,\n        validateAndFormat: quickCheckValidateAndFormat,\n      };\n\n  // Run agent with retry support — agent gets correction prompts on validation failure\n  const agentResult = await runAgent(\n    agent,\n    integrationPrompt,\n    options,\n    {\n      spinnerMessage: SPINNER_MESSAGE,\n      successMessage: config.ui.successMessage,\n      errorMessage: 'Integration failed',\n    },\n    options.emitter,\n    retryConfig,\n  );\n\n  // If agent returned an error, throw so state machine can handle it\n  if (agentResult.error) {\n    await analytics.shutdown('error');\n    const message = agentResult.errorMessage || agentResult.error;\n    throw new Error(`Agent SDK error: ${message}`);\n  }\n\n  // Track retry metrics\n  if (agentResult.retryCount !== undefined && agentResult.retryCount > 0) {\n    analytics.capture(INSTALLER_INTERACTION_EVENT_NAME, {\n      action: 'agent retry summary',\n      retry_count: agentResult.retryCount,\n      max_retries: options.maxRetries ?? 2,\n      passed_after_retry: true,\n    });\n  }\n\n  // Run full validation after agent (with retries) completes\n  // Quick checks already ran inside the retry loop — skip build\n  if (!options.noValidate) {\n    options.emitter?.emit('validation:start', { framework: config.metadata.integration });\n\n    const validationResult = await validateInstallation(config.metadata.integration, options.installDir, {\n      runBuild: false,\n    });\n\n    if (validationResult.issues.length > 0) {\n      options.emitter?.emit('validation:issues', { issues: validationResult.issues });\n    }\n\n    options.emitter?.emit('validation:complete', {\n      passed: validationResult.passed,\n      issueCount: validationResult.issues.length,\n      durationMs: validationResult.durationMs,\n    });\n  }\n\n  // Build environment variables from WorkOS credentials\n  const envVars = config.environment.getEnvVars(apiKey, clientId);\n\n  // Upload environment variables to hosting providers (if configured)\n  let uploadedEnvVars: string[] = [];\n  if (config.environment.uploadToHosting) {\n    uploadedEnvVars = await uploadEnvironmentVariablesStep(envVars, {\n      integration: config.metadata.integration,\n      options,\n    });\n  }\n\n  const changes = [\n    ...config.ui.getOutroChanges(frameworkContext),\n    Object.keys(envVars).length > 0 ? `Added environment variables to .env file` : '',\n    uploadedEnvVars.length > 0 ? `Uploaded environment variables to your hosting provider` : '',\n  ].filter(Boolean);\n\n  const nextSteps = [\n    ...config.ui.getOutroNextSteps(frameworkContext),\n    uploadedEnvVars.length === 0 && config.environment.uploadToHosting\n      ? `Upload your WorkOS credentials to your hosting provider`\n      : '',\n  ].filter(Boolean);\n\n  const summary = buildCompletionSummary(config, changes, nextSteps);\n\n  await analytics.shutdown('success');\n\n  return summary;\n}\n\n/**\n * Build the integration prompt for the agent.\n * Uses skill-based approach where agent invokes framework-specific skill.\n * Note: Credentials are pre-written to .env.local, so not included in prompt.\n */\nfunction buildIntegrationPrompt(\n  config: FrameworkConfig,\n  context: {\n    frameworkVersion: string;\n    typescript: boolean;\n  },\n  frameworkContext: Record<string, any>,\n): string {\n  const additionalLines = config.prompts.getAdditionalContextLines\n    ? config.prompts.getAdditionalContextLines(frameworkContext)\n    : [];\n\n  const additionalContext =\n    additionalLines.length > 0 ? '\\n' + additionalLines.map((line) => `- ${line}`).join('\\n') : '';\n\n  const skillName = config.metadata.skillName;\n  if (!skillName) {\n    throw new Error(`Framework ${config.metadata.name} missing skillName in config`);\n  }\n\n  // Next.js uses NEXT_PUBLIC_ prefix for redirect URI\n  const redirectUriEnvVar =\n    config.metadata.integration === 'nextjs' ? 'NEXT_PUBLIC_WORKOS_REDIRECT_URI' : 'WORKOS_REDIRECT_URI';\n\n  return `You are integrating WorkOS AuthKit into this ${config.metadata.name} application.\n\n## Project Context\n\n- Framework: ${config.metadata.name} ${context.frameworkVersion}\n- TypeScript: ${context.typescript ? 'Yes' : 'No'}${additionalContext}\n\n## Environment\n\nThe following environment variables have been configured in .env.local:\n- WORKOS_API_KEY\n- WORKOS_CLIENT_ID\n- ${redirectUriEnvVar}\n- WORKOS_COOKIE_PASSWORD\n\n## Your Task\n\nUse the \\`${skillName}\\` skill to integrate WorkOS AuthKit into this application.\n\nThe skill contains step-by-step instructions including:\n1. Fetching the SDK documentation\n2. Installing the SDK\n3. Creating the callback route\n4. Setting up middleware/auth handling\n5. Adding authentication UI to the home page\n\nReport your progress using [STATUS] prefixes.\n\nBegin by invoking the ${skillName} skill.`;\n}\n\nfunction buildCompletionSummary(config: FrameworkConfig, changes: string[], nextSteps: string[]): string {\n  const lines: string[] = ['Successfully installed WorkOS AuthKit!', ''];\n\n  if (changes.length > 0) {\n    lines.push('What the agent did:');\n    for (const change of changes) lines.push(`• ${change}`);\n    lines.push('');\n  }\n\n  if (nextSteps.length > 0) {\n    lines.push('Next steps:');\n    for (const step of nextSteps) lines.push(`• ${step}`);\n    lines.push('');\n  }\n\n  lines.push(\n    `Learn more: ${config.metadata.docsUrl}`,\n    '',\n    'Note: This installer uses an LLM agent to analyze and modify your project. Please review the changes made.',\n  );\n\n  return lines.join('\\n');\n}\n"]}
+{"version":3,"file":"agent-runner.js","sourceRoot":"","sources":["../../src/lib/agent-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAoB,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAuB,EAAE,OAAyB;IACxF,wCAAwC;IACxC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE;QAC9B,OAAO,EAAE,iCAAiC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;KACjE,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEtD,wEAAwE;IAExE,kCAAkC;IAClC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAE/G,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAElE,2CAA2C;IAC3C,IAAI,gBAAgB,IAAI,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC1D,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC1E,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,UAAU,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAClD,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;KACzC,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAE5G,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExE,mEAAmE;IACnE,mFAAmF;IACnF,IAAI,CAAC,mBAAmB,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE;YAC9E,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3G,8DAA8D;IAC9D,gEAAgE;IAChE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,IAAI,GAAG,YAAY,EAAE,CAAC;QAErF,gEAAgE;QAChE,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAEvG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE;YAChC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,gBAAgB,EAAE,QAAQ;YAC1B,CAAC,cAAc,CAAC,EAAE,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACnD,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,CACpD,MAAM,EACN;QACE,gBAAgB,EAAE,gBAAgB,IAAI,QAAQ;QAC9C,UAAU,EAAE,kBAAkB;KAC/B,EACD,gBAAgB,CACjB,CAAC;IAEF,2BAA2B;IAC3B,oFAAoF;IACpF,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC;QACE,gBAAgB,EAAE,OAAO,CAAC,UAAU;QACpC,YAAY,EAAE,MAAM;QACpB,aAAa,EAAE,wBAAwB;KACxC,EACD,OAAO,CACR,CAAC;IAEF,MAAM,WAAW,GAA4B,OAAO,CAAC,UAAU;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACnC,iBAAiB,EAAE,2BAA2B;SAC/C,CAAC;IAEN,qFAAqF;IACrF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAChC,KAAK,EACL,iBAAiB,EACjB,OAAO,EACP;QACE,cAAc,EAAE,eAAe;QAC/B,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,cAAc;QACxC,YAAY,EAAE,oBAAoB;KACnC,EACD,OAAO,CAAC,OAAO,EACf,WAAW,CACZ,CAAC;IAEF,mEAAmE;IACnE,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,KAAK,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,sBAAsB;IACtB,IAAI,WAAW,CAAC,UAAU,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACvE,SAAS,CAAC,OAAO,CAAC,gCAAgC,EAAE;YAClD,MAAM,EAAE,qBAAqB;YAC7B,WAAW,EAAE,WAAW,CAAC,UAAU;YACnC,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACpC,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,8DAA8D;IAC9D,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAEtF,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE;YACnG,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE;YAC3C,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM;YAC1C,UAAU,EAAE,gBAAgB,CAAC,UAAU;SACxC,CAAC,CAAC;IACL,CAAC;IAED,sDAAsD;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEhE,oEAAoE;IACpE,IAAI,eAAe,GAAa,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;QACvC,eAAe,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE;YAC9D,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;YACxC,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,gBAAgB,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE;QACjF,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,EAAE;KAC5F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,MAAM,SAAS,GAAG;QAChB,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;QAChD,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,eAAe;YAChE,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,EAAE;KACP,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAEnE,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAuB,EACvB,OAGC,EACD,gBAAqC;IAErC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB;QAC9D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,iBAAiB,GACrB,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,IAAI,8BAA8B,CAAC,CAAC;IACnF,CAAC;IAED,qDAAqD;IACrD,sFAAsF;IACtF,iFAAiF;IACjF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC;IAC/D,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,YAAY,CAAC,SAAS,CAAC;KACxB,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,kBAAkB;QAClB,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,qBAAqB;QACpG,wBAAwB;KACzB,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3D,OAAO,gDAAgD,MAAM,CAAC,QAAQ,CAAC,IAAI;;;;eAI9D,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,gBAAgB;gBAC/C,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,iBAAiB;;;;;EAKnE,UAAU;;EAEV,WAAW,CAAC,CAAC,CAAC,4BAA4B,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE;;EAEhE,UAAU;;;;uBAIW,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAuB,EAAE,OAAiB,EAAE,SAAmB;IAC7F,MAAM,KAAK,GAAa,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAC;IAEvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CACR,eAAe,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EACxC,EAAE,EACF,4GAA4G,CAC7G,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["import { getReference } from '@workos/skills';\nimport { SPINNER_MESSAGE, type FrameworkConfig } from './framework-config.js';\nimport { validateInstallation, quickCheckValidateAndFormat } from './validation/index.js';\nimport type { InstallerOptions } from '../utils/types.js';\nimport {\n  ensurePackageIsInstalled,\n  getOrAskForWorkOSCredentials,\n  getPackageDotJson,\n  isUsingTypeScript,\n} from '../utils/clack-utils.js';\nimport { analytics } from '../utils/analytics.js';\nimport { INSTALLER_INTERACTION_EVENT_NAME } from './constants.js';\nimport { initializeAgent, runAgent, type RetryConfig } from './agent-interface.js';\nimport { uploadEnvironmentVariablesStep } from '../steps/index.js';\nimport { autoConfigureWorkOSEnvironment } from './workos-management.js';\nimport { detectPort, getCallbackPath } from './port-detection.js';\nimport { writeEnvLocal } from './env-writer.js';\n\n/**\n * Universal agent-powered wizard runner.\n * Handles the complete flow for any framework using WorkOS MCP integration.\n *\n * @returns A detailed summary of what was done and next steps\n */\nexport async function runAgentInstaller(config: FrameworkConfig, options: InstallerOptions): Promise<string> {\n  // Emit status for UI adapters to render\n  options.emitter?.emit('status', {\n    message: `Setting up WorkOS AuthKit for ${config.metadata.name}`,\n  });\n\n  const typeScriptDetected = isUsingTypeScript(options);\n\n  // Git check is now handled by the state machine - no need to check here\n\n  // Framework detection and version\n  const packageJson = await getPackageDotJson(options);\n  await ensurePackageIsInstalled(packageJson, config.detection.packageName, config.detection.packageDisplayName);\n\n  const frameworkVersion = config.detection.getVersion(packageJson);\n\n  // Set analytics tags for framework version\n  if (frameworkVersion && config.detection.getVersionBucket) {\n    const versionBucket = config.detection.getVersionBucket(frameworkVersion);\n    analytics.setTag(`${config.metadata.integration}-version`, versionBucket);\n  }\n\n  analytics.capture(INSTALLER_INTERACTION_EVENT_NAME, {\n    action: 'started agent integration',\n    integration: config.metadata.integration,\n  });\n\n  // Get WorkOS credentials (API key optional for client-only SDKs)\n  const { apiKey, clientId } = await getOrAskForWorkOSCredentials(options, config.environment.requiresApiKey);\n\n  // Check if caller (state machine) already configured WorkOS environment\n  // If credentials were passed via options, the caller handled config+env writing\n  const callerHandledConfig = Boolean(options.apiKey || options.clientId);\n\n  // Auto-configure WorkOS environment (redirect URI, CORS, homepage)\n  // Skip if caller already handled this (prevents duplicate dashboard config output)\n  if (!callerHandledConfig && apiKey && config.environment.requiresApiKey) {\n    const port = detectPort(config.metadata.integration, options.installDir);\n    await autoConfigureWorkOSEnvironment(apiKey, config.metadata.integration, port, {\n      homepageUrl: options.homepageUrl,\n      redirectUri: options.redirectUri,\n    });\n  }\n\n  // Gather framework-specific context (e.g., Next.js router, React Native platform)\n  const frameworkContext = config.metadata.gatherContext ? await config.metadata.gatherContext(options) : {};\n\n  // Write environment variables to .env.local BEFORE agent runs\n  // Skip if caller already handled this (prevents double-writing)\n  if (!callerHandledConfig) {\n    const port = detectPort(config.metadata.integration, options.installDir);\n    const callbackPath = getCallbackPath(config.metadata.integration);\n    const redirectUri = options.redirectUri || `http://localhost:${port}${callbackPath}`;\n\n    // Next.js requires NEXT_PUBLIC_ prefix for client-side env vars\n    const redirectUriKey =\n      config.metadata.integration === 'nextjs' ? 'NEXT_PUBLIC_WORKOS_REDIRECT_URI' : 'WORKOS_REDIRECT_URI';\n\n    writeEnvLocal(options.installDir, {\n      ...(apiKey ? { WORKOS_API_KEY: apiKey } : {}),\n      WORKOS_CLIENT_ID: clientId,\n      [redirectUriKey]: redirectUri,\n    });\n  }\n\n  // Set analytics tags from framework context\n  const contextTags = config.analytics.getTags(frameworkContext);\n  Object.entries(contextTags).forEach(([key, value]) => {\n    analytics.setTag(key, value);\n  });\n\n  // Build integration prompt (credentials are already in .env.local)\n  const integrationPrompt = await buildIntegrationPrompt(\n    config,\n    {\n      frameworkVersion: frameworkVersion || 'latest',\n      typescript: typeScriptDetected,\n    },\n    frameworkContext,\n  );\n\n  // Initialize and run agent\n  // Spinner is now handled by adapters listening to agent:start/agent:progress events\n  const agent = await initializeAgent(\n    {\n      workingDirectory: options.installDir,\n      workOSApiKey: apiKey,\n      workOSApiHost: 'https://api.workos.com',\n    },\n    options,\n  );\n\n  const retryConfig: RetryConfig | undefined = options.noValidate\n    ? undefined\n    : {\n        maxRetries: options.maxRetries ?? 2,\n        validateAndFormat: quickCheckValidateAndFormat,\n      };\n\n  // Run agent with retry support — agent gets correction prompts on validation failure\n  const agentResult = await runAgent(\n    agent,\n    integrationPrompt,\n    options,\n    {\n      spinnerMessage: SPINNER_MESSAGE,\n      successMessage: config.ui.successMessage,\n      errorMessage: 'Integration failed',\n    },\n    options.emitter,\n    retryConfig,\n  );\n\n  // If agent returned an error, throw so state machine can handle it\n  if (agentResult.error) {\n    await analytics.shutdown('error');\n    const message = agentResult.errorMessage || agentResult.error;\n    throw new Error(`Agent SDK error: ${message}`);\n  }\n\n  // Track retry metrics\n  if (agentResult.retryCount !== undefined && agentResult.retryCount > 0) {\n    analytics.capture(INSTALLER_INTERACTION_EVENT_NAME, {\n      action: 'agent retry summary',\n      retry_count: agentResult.retryCount,\n      max_retries: options.maxRetries ?? 2,\n      passed_after_retry: true,\n    });\n  }\n\n  // Run full validation after agent (with retries) completes\n  // Quick checks already ran inside the retry loop — skip build\n  if (!options.noValidate) {\n    options.emitter?.emit('validation:start', { framework: config.metadata.integration });\n\n    const validationResult = await validateInstallation(config.metadata.integration, options.installDir, {\n      runBuild: false,\n    });\n\n    if (validationResult.issues.length > 0) {\n      options.emitter?.emit('validation:issues', { issues: validationResult.issues });\n    }\n\n    options.emitter?.emit('validation:complete', {\n      passed: validationResult.passed,\n      issueCount: validationResult.issues.length,\n      durationMs: validationResult.durationMs,\n    });\n  }\n\n  // Build environment variables from WorkOS credentials\n  const envVars = config.environment.getEnvVars(apiKey, clientId);\n\n  // Upload environment variables to hosting providers (if configured)\n  let uploadedEnvVars: string[] = [];\n  if (config.environment.uploadToHosting) {\n    uploadedEnvVars = await uploadEnvironmentVariablesStep(envVars, {\n      integration: config.metadata.integration,\n      options,\n    });\n  }\n\n  const changes = [\n    ...config.ui.getOutroChanges(frameworkContext),\n    Object.keys(envVars).length > 0 ? `Added environment variables to .env file` : '',\n    uploadedEnvVars.length > 0 ? `Uploaded environment variables to your hosting provider` : '',\n  ].filter(Boolean);\n\n  const nextSteps = [\n    ...config.ui.getOutroNextSteps(frameworkContext),\n    uploadedEnvVars.length === 0 && config.environment.uploadToHosting\n      ? `Upload your WorkOS credentials to your hosting provider`\n      : '',\n  ].filter(Boolean);\n\n  const summary = buildCompletionSummary(config, changes, nextSteps);\n\n  await analytics.shutdown('success');\n\n  return summary;\n}\n\n/**\n * Build the integration prompt for the agent.\n * Reads reference content from @workos/skills and injects it directly into the prompt.\n * Note: Credentials are pre-written to .env.local, so not included in prompt.\n */\nasync function buildIntegrationPrompt(\n  config: FrameworkConfig,\n  context: {\n    frameworkVersion: string;\n    typescript: boolean;\n  },\n  frameworkContext: Record<string, any>,\n): Promise<string> {\n  const additionalLines = config.prompts.getAdditionalContextLines\n    ? config.prompts.getAdditionalContextLines(frameworkContext)\n    : [];\n\n  const additionalContext =\n    additionalLines.length > 0 ? '\\n' + additionalLines.map((line) => `- ${line}`).join('\\n') : '';\n\n  const skillName = config.metadata.skillName;\n  if (!skillName) {\n    throw new Error(`Framework ${config.metadata.name} missing skillName in config`);\n  }\n\n  // Read reference content from @workos/skills package\n  // Base template has JS-centric assumptions (node_modules, lockfiles, AuthKitProvider)\n  // so only load it for JavaScript integrations; backend SDKs bypass this entirely\n  const isJavaScript = config.metadata.language === 'javascript';\n  const [baseContent, refContent] = await Promise.all([\n    isJavaScript ? getReference('workos-authkit-base') : Promise.resolve(''),\n    getReference(skillName),\n  ]);\n\n  // Build env var list dynamically based on what was actually configured\n  const envVars = [\n    ...(config.environment.requiresApiKey ? ['WORKOS_API_KEY'] : []),\n    'WORKOS_CLIENT_ID',\n    config.metadata.integration === 'nextjs' ? 'NEXT_PUBLIC_WORKOS_REDIRECT_URI' : 'WORKOS_REDIRECT_URI',\n    'WORKOS_COOKIE_PASSWORD',\n  ];\n  const envVarList = envVars.map((v) => `- ${v}`).join('\\n');\n\n  return `You are integrating WorkOS AuthKit into this ${config.metadata.name} application.\n\n## Project Context\n\n- Framework: ${config.metadata.name} ${context.frameworkVersion}\n- TypeScript: ${context.typescript ? 'Yes' : 'No'}${additionalContext}\n\n## Environment\n\nThe following environment variables have been configured in .env.local:\n${envVarList}\n\n${baseContent ? `## General Guidelines\\n\\n${baseContent}\\n\\n` : ''}## Integration Instructions\n\n${refContent}\n\nReport your progress using [STATUS] prefixes.\n\nBegin integration now.`;\n}\n\nfunction buildCompletionSummary(config: FrameworkConfig, changes: string[], nextSteps: string[]): string {\n  const lines: string[] = ['Successfully installed WorkOS AuthKit!', ''];\n\n  if (changes.length > 0) {\n    lines.push('What the agent did:');\n    for (const change of changes) lines.push(`• ${change}`);\n    lines.push('');\n  }\n\n  if (nextSteps.length > 0) {\n    lines.push('Next steps:');\n    for (const step of nextSteps) lines.push(`• ${step}`);\n    lines.push('');\n  }\n\n  lines.push(\n    `Learn more: ${config.metadata.docsUrl}`,\n    '',\n    'Note: This installer uses an LLM agent to analyze and modify your project. Please review the changes made.',\n  );\n\n  return lines.join('\\n');\n}\n"]}

package/dist/lib/credential-proxy.js

@@ -174,7 +174,7 @@ async function handleRequest(req, res, upstream, useHttps, thresholdMs) {
         res.writeHead(401, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             error: 'credentials_unavailable',
-            message: 'Not authenticated. Run `workos login` first.',
+            message: 'Not authenticated. Run `workos auth login` first.',
         }));
         return;
     }

package/dist/lib/credential-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-proxy.js","sourceRoot":"","sources":["../../src/lib/credential-proxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAoB,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAiC/D,sCAAsC;AACtC,IAAI,cAAc,GAAyB,IAAI,CAAC;AAChD,IAAI,aAAa,GAAyB,IAAI,CAAC;AAC/C,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAC5B,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC;;;GAGG;AACH,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,gDAAgD,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAExD,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7D,qCAAqC;QACrC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAExE,mBAAmB,GAAG,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,OAAO,CACL,yCAAyC,UAAU,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9G,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAC3C,MAAM,EAAE,iBAAiB;YACzB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;SACrC,CAAC,CAAC;QAEH,gBAAgB,EAAE,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB,EAAE,CAAC;IAEtB,QAAQ,CAAC,sCAAsC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE/D,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;QACzC,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe;QAC9C,oBAAoB,EAAE,mBAAmB;KAC1C,CAAC,CAAC;IAEH,2BAA2B;IAC3B,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,IAAI,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;QAC5F,QAAQ,CAAC,+DAA+D,CAAC,CAAC;QAC1E,gBAAgB,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAErD,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,wCAAwC;QACxC,OAAO,CAAC,0DAA0D,CAAC,CAAC;QAEpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,MAAM,cAAc,CAAC;QACrB,OAAO,cAAc,EAAE,CAAC,CAAC,2BAA2B;IACtD,CAAC;IAED,IAAI,eAAe,GAAG,WAAW,EAAE,CAAC;QAClC,0EAA0E;QAC1E,OAAO,CAAC,uCAAuC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE1G,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,iEAAiE;IACnE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA+B;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,kBAAkB,IAAI,MAAM,CAAC;IAElE,wCAAwC;IACxC,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IACxC,mBAAmB,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;oBACxD,QAAQ,EAAE,CAAC;oBACX,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,iCAAiC,GAAG,mBAAmB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,uDAAuD,WAAW,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,4BAA4B;IAC5B,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE;QACnC,MAAM,EAAE,OAAO;QACf,IAAI;QACJ,eAAe,EAAE,CAAC,CAAC,aAAa;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,sBAAsB;YACtB,aAAa,GAAG,IAAI,CAAC;YACrB,cAAc,GAAG,IAAI,CAAC;YACtB,mBAAmB,GAAG,CAAC,CAAC;YACxB,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAyB,EACzB,GAAwB,EACxB,QAAa,EACb,QAAiB,EACjB,WAAmB;IAEnB,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,6CAA6C,CAAC,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,8CAA8C;SACxD,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,qFAAqF;IACrF,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;IAC/E,MAAM,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,OAAO,GAA6B,EAAE,CAAC;IAE7C,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,YAAY;QACZ,YAAY;QACZ,oBAAoB;QACpB,qBAAqB;QACrB,IAAI;QACJ,SAAS;QACT,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IAEhC,sEAAsE;IACtE,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7D,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEhF,MAAM,cAAc,GAAwB;QAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO;QACP,OAAO,EAAE,OAAO,EAAE,mBAAmB;KACtC,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC9D,wBAAwB;QACxB,MAAM,eAAe,GAA6B,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5D,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,eAAe,CAAC,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,QAAQ,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,IAAK,GAA6B,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,sBAAsB;oBAC7B,OAAO,EAAE,sCAAsC;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,IAAK,GAA6B,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,2BAA2B;iBACrC,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,2BAA2B;aACrC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,sCAAsC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,CAAC,gDAAgD,CAAC,CAAC;YAC1D,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,4BAA4B,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Lightweight HTTP proxy that injects credentials from file into requests.\n * Includes lazy token refresh - refreshes proactively when token is expiring soon.\n */\n\nimport http from 'node:http';\nimport https from 'node:https';\nimport { URL } from 'node:url';\nimport { logInfo, logError, logWarn } from '../utils/debug.js';\nimport { getCredentials, updateTokens, type Credentials } from './credentials.js';\nimport { analytics } from '../utils/analytics.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\n\nexport interface RefreshConfig {\n  /** AuthKit domain for refresh endpoint */\n  authkitDomain: string;\n  /** OAuth client ID */\n  clientId: string;\n  /** Threshold in ms - refresh when token expires within this window (default: 60000 = 1 min) */\n  refreshThresholdMs?: number;\n  /** Callback when refresh succeeds */\n  onRefreshSuccess?: () => void;\n  /** Callback when refresh fails permanently (token expired, invalid_grant) */\n  onRefreshExpired?: () => void;\n}\n\nexport interface CredentialProxyOptions {\n  /** Upstream URL to forward requests to */\n  upstreamUrl: string;\n  /** Optional: specific port to bind (default: random) */\n  port?: number;\n  /** Optional: refresh configuration for lazy token refresh */\n  refresh?: RefreshConfig;\n}\n\nexport interface CredentialProxyHandle {\n  /** Port the proxy is listening on */\n  port: number;\n  /** Full URL for the proxy (e.g., http://localhost:54321) */\n  url: string;\n  /** Stop the proxy server */\n  stop: () => Promise<void>;\n}\n\n// Module-level state for lazy refresh\nlet refreshPromise: Promise<void> | null = null;\nlet refreshConfig: RefreshConfig | null = null;\nlet consecutiveFailures = 0;\nconst MAX_CONSECUTIVE_FAILURES = 3;\n\n/**\n * Perform token refresh, updating credentials file.\n * Returns true if refresh succeeded.\n */\nasync function doRefresh(): Promise<boolean> {\n  if (!refreshConfig) {\n    logError('[credential-proxy] No refresh config available');\n    return false;\n  }\n\n  const { authkitDomain, clientId, onRefreshSuccess, onRefreshExpired } = refreshConfig;\n  const startTime = Date.now();\n\n  logInfo('[credential-proxy] Starting token refresh...');\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_attempt',\n    trigger: 'lazy',\n  });\n\n  const result = await refreshAccessToken(authkitDomain, clientId);\n\n  if (result.success && result.accessToken && result.expiresAt) {\n    // Update credentials file atomically\n    updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n\n    consecutiveFailures = 0;\n    const durationMs = Date.now() - startTime;\n\n    logInfo(\n      `[credential-proxy] Token refreshed in ${durationMs}ms, expires: ${new Date(result.expiresAt).toISOString()}`,\n    );\n\n    analytics.capture('installer.token.refresh', {\n      action: 'refresh_success',\n      duration_ms: durationMs,\n      token_rotated: !!result.refreshToken,\n    });\n\n    onRefreshSuccess?.();\n    return true;\n  }\n\n  consecutiveFailures++;\n\n  logError(`[credential-proxy] Refresh failed: ${result.error}`);\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_failure',\n    error_type: result.errorType || 'unknown',\n    error_message: result.error || 'Unknown error',\n    consecutive_failures: consecutiveFailures,\n  });\n\n  // Handle permanent failure\n  if (result.errorType === 'invalid_grant' || consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {\n    logError('[credential-proxy] Refresh token expired or too many failures');\n    onRefreshExpired?.();\n  }\n\n  return false;\n}\n\n/**\n * Ensure we have valid credentials, refreshing if needed.\n * Uses a promise-based lock to prevent concurrent refreshes.\n *\n * @returns Credentials to use for request, or null if unavailable\n */\nasync function ensureValidCredentials(thresholdMs: number): Promise<Credentials | null> {\n  const creds = getCredentials();\n\n  if (!creds?.accessToken) {\n    return null;\n  }\n\n  // No refresh token = can't refresh, just use what we have\n  if (!creds.refreshToken || !refreshConfig) {\n    return creds;\n  }\n\n  const timeUntilExpiry = creds.expiresAt - Date.now();\n\n  if (timeUntilExpiry <= 0) {\n    // Token expired - must wait for refresh\n    logWarn('[credential-proxy] Token expired, waiting for refresh...');\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n\n    await refreshPromise;\n    return getCredentials(); // Return fresh credentials\n  }\n\n  if (timeUntilExpiry < thresholdMs) {\n    // Token expiring soon - trigger background refresh, but use current token\n    logInfo(`[credential-proxy] Token expires in ${Math.round(timeUntilExpiry / 1000)}s, triggering refresh`);\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n    // Don't await - fire and forget, use current (still valid) token\n  }\n\n  return creds;\n}\n\n/**\n * Start the credential injector proxy with optional lazy refresh.\n */\nexport async function startCredentialProxy(options: CredentialProxyOptions): Promise<CredentialProxyHandle> {\n  const upstream = new URL(options.upstreamUrl);\n  const useHttps = upstream.protocol === 'https:';\n  const thresholdMs = options.refresh?.refreshThresholdMs ?? 60_000;\n\n  // Store refresh config for lazy refresh\n  refreshConfig = options.refresh ?? null;\n  consecutiveFailures = 0;\n\n  const server = http.createServer(async (req, res) => {\n    await handleRequest(req, res, upstream, useHttps, thresholdMs);\n  });\n\n  // Find available port\n  const port = await new Promise<number>((resolve, reject) => {\n    const tryPort = options.port ?? 0; // 0 = random available port\n    let attempts = 0;\n    const maxAttempts = 10;\n\n    const tryListen = (p: number) => {\n      server.once('error', (err: NodeJS.ErrnoException) => {\n        if (err.code === 'EADDRINUSE' && attempts < maxAttempts) {\n          attempts++;\n          tryListen(0); // Try random port\n        } else {\n          reject(err);\n        }\n      });\n\n      server.listen(p, '127.0.0.1', () => {\n        const addr = server.address();\n        if (addr && typeof addr === 'object') {\n          resolve(addr.port);\n        } else {\n          reject(new Error('Failed to get server address'));\n        }\n      });\n    };\n\n    tryListen(tryPort);\n  });\n\n  const url = `http://127.0.0.1:${port}`;\n  logInfo(`[credential-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);\n  if (refreshConfig) {\n    logInfo(`[credential-proxy] Lazy refresh enabled, threshold: ${thresholdMs}ms`);\n  }\n\n  // Telemetry for proxy start\n  analytics.capture('installer.proxy', {\n    action: 'start',\n    port,\n    refresh_enabled: !!refreshConfig,\n  });\n\n  return {\n    port,\n    url,\n    stop: async () => {\n      // Clear refresh state\n      refreshConfig = null;\n      refreshPromise = null;\n      consecutiveFailures = 0;\n      await stopServer(server);\n    },\n  };\n}\n\nasync function handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  upstream: URL,\n  useHttps: boolean,\n  thresholdMs: number,\n): Promise<void> {\n  // Get valid credentials, potentially triggering refresh\n  const creds = await ensureValidCredentials(thresholdMs);\n\n  if (!creds?.accessToken) {\n    logError('[credential-proxy] No credentials available');\n    res.writeHead(401, { 'Content-Type': 'application/json' });\n    res.end(\n      JSON.stringify({\n        error: 'credentials_unavailable',\n        message: 'Not authenticated. Run `workos login` first.',\n      }),\n    );\n    return;\n  }\n\n  // Build upstream request options\n  // Concatenate paths properly - URL() would replace the base path with absolute paths\n  const requestPath = req.url || '/';\n  const basePath = upstream.pathname.replace(/\\/$/, ''); // Remove trailing slash\n  const fullPath = basePath + requestPath;\n  const upstreamUrl = new URL(fullPath, upstream.origin);\n\n  const headers: http.OutgoingHttpHeaders = {};\n\n  // Copy headers, excluding hop-by-hop headers\n  const hopByHop = new Set([\n    'connection',\n    'keep-alive',\n    'proxy-authenticate',\n    'proxy-authorization',\n    'te',\n    'trailer',\n    'transfer-encoding',\n    'upgrade',\n  ]);\n\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (!hopByHop.has(key.toLowerCase()) && value !== undefined) {\n      headers[key] = value;\n    }\n  }\n\n  // Inject credentials\n  headers['authorization'] = `Bearer ${creds.accessToken}`;\n  headers['host'] = upstream.host;\n\n  // Strip beta=true query param - WorkOS LLM gateway doesn't support it\n  const searchParams = new URLSearchParams(upstreamUrl.search);\n  searchParams.delete('beta');\n  const queryString = searchParams.toString();\n  const finalPath = upstreamUrl.pathname + (queryString ? `?${queryString}` : '');\n\n  const requestOptions: http.RequestOptions = {\n    hostname: upstream.hostname,\n    port: upstream.port || (useHttps ? 443 : 80),\n    path: finalPath,\n    method: req.method,\n    headers,\n    timeout: 120_000, // 2 minute timeout\n  };\n\n  const transport = useHttps ? https : http;\n\n  const proxyReq = transport.request(requestOptions, (proxyRes) => {\n    // Copy response headers\n    const responseHeaders: http.OutgoingHttpHeaders = {};\n    for (const [key, value] of Object.entries(proxyRes.headers)) {\n      if (!hopByHop.has(key.toLowerCase()) && value !== undefined) {\n        responseHeaders[key] = value;\n      }\n    }\n\n    res.writeHead(proxyRes.statusCode || 500, responseHeaders);\n    proxyRes.pipe(res);\n  });\n\n  proxyReq.on('error', (err) => {\n    logError('[credential-proxy] Upstream error:', err.message);\n\n    if (!res.headersSent) {\n      if ((err as NodeJS.ErrnoException).code === 'ECONNREFUSED') {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_unavailable',\n            message: 'Could not connect to upstream server',\n          }),\n        );\n      } else if ((err as NodeJS.ErrnoException).code === 'ETIMEDOUT') {\n        res.writeHead(504, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_timeout',\n            message: 'Upstream server timed out',\n          }),\n        );\n      } else {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'proxy_error',\n            message: err.message,\n          }),\n        );\n      }\n    }\n  });\n\n  proxyReq.on('timeout', () => {\n    proxyReq.destroy();\n    if (!res.headersSent) {\n      res.writeHead(504, { 'Content-Type': 'application/json' });\n      res.end(\n        JSON.stringify({\n          error: 'upstream_timeout',\n          message: 'Upstream server timed out',\n        }),\n      );\n    }\n  });\n\n  // Stream request body\n  req.pipe(proxyReq);\n}\n\nfunction stopServer(server: http.Server): Promise<void> {\n  return new Promise((resolve, reject) => {\n    // Set a timeout for graceful shutdown\n    const timeout = setTimeout(() => {\n      logInfo('[credential-proxy] Force closing after timeout');\n      server.closeAllConnections?.();\n      resolve();\n    }, 5000);\n\n    server.close((err) => {\n      clearTimeout(timeout);\n      if (err) {\n        logError('[credential-proxy] Error stopping server:', err);\n        reject(err);\n      } else {\n        logInfo('[credential-proxy] Stopped');\n        resolve();\n      }\n    });\n  });\n}\n"]}
+{"version":3,"file":"credential-proxy.js","sourceRoot":"","sources":["../../src/lib/credential-proxy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAoB,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAiC/D,sCAAsC;AACtC,IAAI,cAAc,GAAyB,IAAI,CAAC;AAChD,IAAI,aAAa,GAAyB,IAAI,CAAC;AAC/C,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAC5B,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC;;;GAGG;AACH,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,gDAAgD,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAExD,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7D,qCAAqC;QACrC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAExE,mBAAmB,GAAG,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,OAAO,CACL,yCAAyC,UAAU,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9G,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;YAC3C,MAAM,EAAE,iBAAiB;YACzB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;SACrC,CAAC,CAAC;QAEH,gBAAgB,EAAE,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB,EAAE,CAAC;IAEtB,QAAQ,CAAC,sCAAsC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE/D,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE;QAC3C,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;QACzC,aAAa,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe;QAC9C,oBAAoB,EAAE,mBAAmB;KAC1C,CAAC,CAAC;IAEH,2BAA2B;IAC3B,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,IAAI,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;QAC5F,QAAQ,CAAC,+DAA+D,CAAC,CAAC;QAC1E,gBAAgB,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAErD,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,wCAAwC;QACxC,OAAO,CAAC,0DAA0D,CAAC,CAAC;QAEpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,MAAM,cAAc,CAAC;QACrB,OAAO,cAAc,EAAE,CAAC,CAAC,2BAA2B;IACtD,CAAC;IAED,IAAI,eAAe,GAAG,WAAW,EAAE,CAAC;QAClC,0EAA0E;QAC1E,OAAO,CAAC,uCAAuC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE1G,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,SAAS,EAAE;iBACzB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACd,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,iEAAiE;IACnE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA+B;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,kBAAkB,IAAI,MAAM,CAAC;IAElE,wCAAwC;IACxC,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IACxC,mBAAmB,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;oBACxD,QAAQ,EAAE,CAAC;oBACX,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,iCAAiC,GAAG,mBAAmB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,uDAAuD,WAAW,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,4BAA4B;IAC5B,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE;QACnC,MAAM,EAAE,OAAO;QACf,IAAI;QACJ,eAAe,EAAE,CAAC,CAAC,aAAa;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,GAAG;QACH,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,sBAAsB;YACtB,aAAa,GAAG,IAAI,CAAC;YACrB,cAAc,GAAG,IAAI,CAAC;YACtB,mBAAmB,GAAG,CAAC,CAAC;YACxB,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAyB,EACzB,GAAwB,EACxB,QAAa,EACb,QAAiB,EACjB,WAAmB;IAEnB,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,6CAA6C,CAAC,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,qFAAqF;IACrF,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;IAC/E,MAAM,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,OAAO,GAA6B,EAAE,CAAC;IAE7C,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,YAAY;QACZ,YAAY;QACZ,oBAAoB;QACpB,qBAAqB;QACrB,IAAI;QACJ,SAAS;QACT,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IAEhC,sEAAsE;IACtE,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7D,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEhF,MAAM,cAAc,GAAwB;QAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO;QACP,OAAO,EAAE,OAAO,EAAE,mBAAmB;KACtC,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC9D,wBAAwB;QACxB,MAAM,eAAe,GAA6B,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5D,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,eAAe,CAAC,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,QAAQ,CAAC,oCAAoC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,IAAK,GAA6B,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,sBAAsB;oBAC7B,OAAO,EAAE,sCAAsC;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,IAAK,GAA6B,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,2BAA2B;iBACrC,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,2BAA2B;aACrC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,sCAAsC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,CAAC,gDAAgD,CAAC,CAAC;YAC1D,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,4BAA4B,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Lightweight HTTP proxy that injects credentials from file into requests.\n * Includes lazy token refresh - refreshes proactively when token is expiring soon.\n */\n\nimport http from 'node:http';\nimport https from 'node:https';\nimport { URL } from 'node:url';\nimport { logInfo, logError, logWarn } from '../utils/debug.js';\nimport { getCredentials, updateTokens, type Credentials } from './credentials.js';\nimport { analytics } from '../utils/analytics.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\n\nexport interface RefreshConfig {\n  /** AuthKit domain for refresh endpoint */\n  authkitDomain: string;\n  /** OAuth client ID */\n  clientId: string;\n  /** Threshold in ms - refresh when token expires within this window (default: 60000 = 1 min) */\n  refreshThresholdMs?: number;\n  /** Callback when refresh succeeds */\n  onRefreshSuccess?: () => void;\n  /** Callback when refresh fails permanently (token expired, invalid_grant) */\n  onRefreshExpired?: () => void;\n}\n\nexport interface CredentialProxyOptions {\n  /** Upstream URL to forward requests to */\n  upstreamUrl: string;\n  /** Optional: specific port to bind (default: random) */\n  port?: number;\n  /** Optional: refresh configuration for lazy token refresh */\n  refresh?: RefreshConfig;\n}\n\nexport interface CredentialProxyHandle {\n  /** Port the proxy is listening on */\n  port: number;\n  /** Full URL for the proxy (e.g., http://localhost:54321) */\n  url: string;\n  /** Stop the proxy server */\n  stop: () => Promise<void>;\n}\n\n// Module-level state for lazy refresh\nlet refreshPromise: Promise<void> | null = null;\nlet refreshConfig: RefreshConfig | null = null;\nlet consecutiveFailures = 0;\nconst MAX_CONSECUTIVE_FAILURES = 3;\n\n/**\n * Perform token refresh, updating credentials file.\n * Returns true if refresh succeeded.\n */\nasync function doRefresh(): Promise<boolean> {\n  if (!refreshConfig) {\n    logError('[credential-proxy] No refresh config available');\n    return false;\n  }\n\n  const { authkitDomain, clientId, onRefreshSuccess, onRefreshExpired } = refreshConfig;\n  const startTime = Date.now();\n\n  logInfo('[credential-proxy] Starting token refresh...');\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_attempt',\n    trigger: 'lazy',\n  });\n\n  const result = await refreshAccessToken(authkitDomain, clientId);\n\n  if (result.success && result.accessToken && result.expiresAt) {\n    // Update credentials file atomically\n    updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n\n    consecutiveFailures = 0;\n    const durationMs = Date.now() - startTime;\n\n    logInfo(\n      `[credential-proxy] Token refreshed in ${durationMs}ms, expires: ${new Date(result.expiresAt).toISOString()}`,\n    );\n\n    analytics.capture('installer.token.refresh', {\n      action: 'refresh_success',\n      duration_ms: durationMs,\n      token_rotated: !!result.refreshToken,\n    });\n\n    onRefreshSuccess?.();\n    return true;\n  }\n\n  consecutiveFailures++;\n\n  logError(`[credential-proxy] Refresh failed: ${result.error}`);\n\n  analytics.capture('installer.token.refresh', {\n    action: 'refresh_failure',\n    error_type: result.errorType || 'unknown',\n    error_message: result.error || 'Unknown error',\n    consecutive_failures: consecutiveFailures,\n  });\n\n  // Handle permanent failure\n  if (result.errorType === 'invalid_grant' || consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {\n    logError('[credential-proxy] Refresh token expired or too many failures');\n    onRefreshExpired?.();\n  }\n\n  return false;\n}\n\n/**\n * Ensure we have valid credentials, refreshing if needed.\n * Uses a promise-based lock to prevent concurrent refreshes.\n *\n * @returns Credentials to use for request, or null if unavailable\n */\nasync function ensureValidCredentials(thresholdMs: number): Promise<Credentials | null> {\n  const creds = getCredentials();\n\n  if (!creds?.accessToken) {\n    return null;\n  }\n\n  // No refresh token = can't refresh, just use what we have\n  if (!creds.refreshToken || !refreshConfig) {\n    return creds;\n  }\n\n  const timeUntilExpiry = creds.expiresAt - Date.now();\n\n  if (timeUntilExpiry <= 0) {\n    // Token expired - must wait for refresh\n    logWarn('[credential-proxy] Token expired, waiting for refresh...');\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n\n    await refreshPromise;\n    return getCredentials(); // Return fresh credentials\n  }\n\n  if (timeUntilExpiry < thresholdMs) {\n    // Token expiring soon - trigger background refresh, but use current token\n    logInfo(`[credential-proxy] Token expires in ${Math.round(timeUntilExpiry / 1000)}s, triggering refresh`);\n\n    if (!refreshPromise) {\n      refreshPromise = doRefresh()\n        .then(() => {})\n        .finally(() => {\n          refreshPromise = null;\n        });\n    }\n    // Don't await - fire and forget, use current (still valid) token\n  }\n\n  return creds;\n}\n\n/**\n * Start the credential injector proxy with optional lazy refresh.\n */\nexport async function startCredentialProxy(options: CredentialProxyOptions): Promise<CredentialProxyHandle> {\n  const upstream = new URL(options.upstreamUrl);\n  const useHttps = upstream.protocol === 'https:';\n  const thresholdMs = options.refresh?.refreshThresholdMs ?? 60_000;\n\n  // Store refresh config for lazy refresh\n  refreshConfig = options.refresh ?? null;\n  consecutiveFailures = 0;\n\n  const server = http.createServer(async (req, res) => {\n    await handleRequest(req, res, upstream, useHttps, thresholdMs);\n  });\n\n  // Find available port\n  const port = await new Promise<number>((resolve, reject) => {\n    const tryPort = options.port ?? 0; // 0 = random available port\n    let attempts = 0;\n    const maxAttempts = 10;\n\n    const tryListen = (p: number) => {\n      server.once('error', (err: NodeJS.ErrnoException) => {\n        if (err.code === 'EADDRINUSE' && attempts < maxAttempts) {\n          attempts++;\n          tryListen(0); // Try random port\n        } else {\n          reject(err);\n        }\n      });\n\n      server.listen(p, '127.0.0.1', () => {\n        const addr = server.address();\n        if (addr && typeof addr === 'object') {\n          resolve(addr.port);\n        } else {\n          reject(new Error('Failed to get server address'));\n        }\n      });\n    };\n\n    tryListen(tryPort);\n  });\n\n  const url = `http://127.0.0.1:${port}`;\n  logInfo(`[credential-proxy] Started on ${url}, forwarding to ${options.upstreamUrl}`);\n  if (refreshConfig) {\n    logInfo(`[credential-proxy] Lazy refresh enabled, threshold: ${thresholdMs}ms`);\n  }\n\n  // Telemetry for proxy start\n  analytics.capture('installer.proxy', {\n    action: 'start',\n    port,\n    refresh_enabled: !!refreshConfig,\n  });\n\n  return {\n    port,\n    url,\n    stop: async () => {\n      // Clear refresh state\n      refreshConfig = null;\n      refreshPromise = null;\n      consecutiveFailures = 0;\n      await stopServer(server);\n    },\n  };\n}\n\nasync function handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  upstream: URL,\n  useHttps: boolean,\n  thresholdMs: number,\n): Promise<void> {\n  // Get valid credentials, potentially triggering refresh\n  const creds = await ensureValidCredentials(thresholdMs);\n\n  if (!creds?.accessToken) {\n    logError('[credential-proxy] No credentials available');\n    res.writeHead(401, { 'Content-Type': 'application/json' });\n    res.end(\n      JSON.stringify({\n        error: 'credentials_unavailable',\n        message: 'Not authenticated. Run `workos auth login` first.',\n      }),\n    );\n    return;\n  }\n\n  // Build upstream request options\n  // Concatenate paths properly - URL() would replace the base path with absolute paths\n  const requestPath = req.url || '/';\n  const basePath = upstream.pathname.replace(/\\/$/, ''); // Remove trailing slash\n  const fullPath = basePath + requestPath;\n  const upstreamUrl = new URL(fullPath, upstream.origin);\n\n  const headers: http.OutgoingHttpHeaders = {};\n\n  // Copy headers, excluding hop-by-hop headers\n  const hopByHop = new Set([\n    'connection',\n    'keep-alive',\n    'proxy-authenticate',\n    'proxy-authorization',\n    'te',\n    'trailer',\n    'transfer-encoding',\n    'upgrade',\n  ]);\n\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (!hopByHop.has(key.toLowerCase()) && value !== undefined) {\n      headers[key] = value;\n    }\n  }\n\n  // Inject credentials\n  headers['authorization'] = `Bearer ${creds.accessToken}`;\n  headers['host'] = upstream.host;\n\n  // Strip beta=true query param - WorkOS LLM gateway doesn't support it\n  const searchParams = new URLSearchParams(upstreamUrl.search);\n  searchParams.delete('beta');\n  const queryString = searchParams.toString();\n  const finalPath = upstreamUrl.pathname + (queryString ? `?${queryString}` : '');\n\n  const requestOptions: http.RequestOptions = {\n    hostname: upstream.hostname,\n    port: upstream.port || (useHttps ? 443 : 80),\n    path: finalPath,\n    method: req.method,\n    headers,\n    timeout: 120_000, // 2 minute timeout\n  };\n\n  const transport = useHttps ? https : http;\n\n  const proxyReq = transport.request(requestOptions, (proxyRes) => {\n    // Copy response headers\n    const responseHeaders: http.OutgoingHttpHeaders = {};\n    for (const [key, value] of Object.entries(proxyRes.headers)) {\n      if (!hopByHop.has(key.toLowerCase()) && value !== undefined) {\n        responseHeaders[key] = value;\n      }\n    }\n\n    res.writeHead(proxyRes.statusCode || 500, responseHeaders);\n    proxyRes.pipe(res);\n  });\n\n  proxyReq.on('error', (err) => {\n    logError('[credential-proxy] Upstream error:', err.message);\n\n    if (!res.headersSent) {\n      if ((err as NodeJS.ErrnoException).code === 'ECONNREFUSED') {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_unavailable',\n            message: 'Could not connect to upstream server',\n          }),\n        );\n      } else if ((err as NodeJS.ErrnoException).code === 'ETIMEDOUT') {\n        res.writeHead(504, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'upstream_timeout',\n            message: 'Upstream server timed out',\n          }),\n        );\n      } else {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({\n            error: 'proxy_error',\n            message: err.message,\n          }),\n        );\n      }\n    }\n  });\n\n  proxyReq.on('timeout', () => {\n    proxyReq.destroy();\n    if (!res.headersSent) {\n      res.writeHead(504, { 'Content-Type': 'application/json' });\n      res.end(\n        JSON.stringify({\n          error: 'upstream_timeout',\n          message: 'Upstream server timed out',\n        }),\n      );\n    }\n  });\n\n  // Stream request body\n  req.pipe(proxyReq);\n}\n\nfunction stopServer(server: http.Server): Promise<void> {\n  return new Promise((resolve, reject) => {\n    // Set a timeout for graceful shutdown\n    const timeout = setTimeout(() => {\n      logInfo('[credential-proxy] Force closing after timeout');\n      server.closeAllConnections?.();\n      resolve();\n    }, 5000);\n\n    server.close((err) => {\n      clearTimeout(timeout);\n      if (err) {\n        logError('[credential-proxy] Error stopping server:', err);\n        reject(err);\n      } else {\n        logInfo('[credential-proxy] Stopped');\n        resolve();\n      }\n    });\n  });\n}\n"]}

package/dist/lib/ensure-auth.js

@@ -59,7 +59,7 @@ export async function ensureAuthenticated() {
             if (refreshResult.errorType === 'invalid_grant') {
                 clearCredentials();
                 if (isNonInteractiveEnvironment()) {
-                    exitWithAuthRequired('Session expired. Run `workos login` in an interactive terminal to re-authenticate.');
+                    exitWithAuthRequired('Session expired. Run `workos auth login` in an interactive terminal to re-authenticate.');
                 }
                 logInfo('[ensure-auth] Refresh token expired, triggering login');
                 await runLogin();
@@ -69,7 +69,7 @@ export async function ensureAuthenticated() {
             }
             // Network or server error - keep credentials intact for retry
             if (isNonInteractiveEnvironment()) {
-                exitWithAuthRequired(`Authentication refresh failed (${refreshResult.errorType}). Run \`workos login\` in an interactive terminal.`);
+                exitWithAuthRequired(`Authentication refresh failed (${refreshResult.errorType}). Run \`workos auth login\` in an interactive terminal.`);
             }
             logInfo(`[ensure-auth] Refresh failed (${refreshResult.errorType}), triggering login`);
             await runLogin();
@@ -81,7 +81,7 @@ export async function ensureAuthenticated() {
     // Case 4: No refresh token available — clear stale creds, must login
     clearCredentials();
     if (isNonInteractiveEnvironment()) {
-        exitWithAuthRequired('Session expired. Run `workos login` in an interactive terminal to re-authenticate.');
+        exitWithAuthRequired('Session expired. Run `workos auth login` in an interactive terminal to re-authenticate.');
     }
     logInfo('[ensure-auth] No refresh token, triggering login');
     await runLogin();

package/dist/lib/ensure-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-auth.js","sourceRoot":"","sources":["../../src/lib/ensure-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAW9D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,MAAM,GAAqB;QAC/B,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,KAAK;KACtB,CAAC;IAEF,gDAAgD;IAChD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,gBAAgB,EAAE,CAAC,CAAC,mCAAmC;QACvD,IAAI,2BAA2B,EAAE,EAAE,CAAC;YAClC,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,4DAA4D,CAAC,CAAC;QACtE,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,wDAAwD,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QAEzC,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAExE,IAAI,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,WAAW,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;gBAClF,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC7F,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,6CAA6C;YAC7C,IAAI,aAAa,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;gBAChD,gBAAgB,EAAE,CAAC;gBACnB,IAAI,2BAA2B,EAAE,EAAE,CAAC;oBAClC,oBAAoB,CAAC,oFAAoF,CAAC,CAAC;gBAC7G,CAAC;gBACD,OAAO,CAAC,uDAAuD,CAAC,CAAC;gBACjE,MAAM,QAAQ,EAAE,CAAC;gBACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,8DAA8D;YAC9D,IAAI,2BAA2B,EAAE,EAAE,CAAC;gBAClC,oBAAoB,CAClB,kCAAkC,aAAa,CAAC,SAAS,qDAAqD,CAC/G,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iCAAiC,aAAa,CAAC,SAAS,qBAAqB,CAAC,CAAC;YACvF,MAAM,QAAQ,EAAE,CAAC;YACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;YACjD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,gBAAgB,EAAE,CAAC;IACnB,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,oBAAoB,CAAC,oFAAoF,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAC5D,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Startup auth guard - ensures valid authentication before command execution.\n */\n\nimport { getCredentials, updateTokens, isTokenExpired, clearCredentials } from './credentials.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\nimport { getCliAuthClientId, getAuthkitDomain } from './settings.js';\nimport { runLogin } from '../commands/login.js';\nimport { logInfo } from '../utils/debug.js';\nimport { isNonInteractiveEnvironment } from '../utils/environment.js';\nimport { exitWithAuthRequired } from '../utils/exit-codes.js';\n\nexport interface EnsureAuthResult {\n  /** Whether auth is now valid */\n  authenticated: boolean;\n  /** Whether login flow was triggered */\n  loginTriggered: boolean;\n  /** Whether token was refreshed */\n  tokenRefreshed: boolean;\n}\n\n/**\n * Ensure valid authentication before command execution.\n *\n * - No credentials: triggers login flow\n * - Expired access token (valid refresh): silently refreshes\n * - Expired refresh token: triggers login flow\n *\n * @returns Result indicating what actions were taken\n * @throws Error if login fails or refresh fails unexpectedly\n */\nexport async function ensureAuthenticated(): Promise<EnsureAuthResult> {\n  const result: EnsureAuthResult = {\n    authenticated: false,\n    loginTriggered: false,\n    tokenRefreshed: false,\n  };\n\n  // Case 1: No credentials or invalid credentials\n  const creds = getCredentials();\n  if (!creds) {\n    clearCredentials(); // Clean up any corrupt/empty files\n    if (isNonInteractiveEnvironment()) {\n      exitWithAuthRequired();\n    }\n    logInfo('[ensure-auth] No valid credentials found, triggering login');\n    await runLogin();\n    result.loginTriggered = true;\n    result.authenticated = getCredentials() !== null;\n    return result;\n  }\n\n  // Case 2: Access token still valid\n  if (!isTokenExpired(creds)) {\n    result.authenticated = true;\n    return result;\n  }\n\n  // Case 3: Access token expired, try refresh\n  if (creds.refreshToken) {\n    logInfo('[ensure-auth] Access token expired, attempting refresh');\n\n    const clientId = getCliAuthClientId();\n    const authkitDomain = getAuthkitDomain();\n\n    if (clientId && authkitDomain) {\n      const refreshResult = await refreshAccessToken(authkitDomain, clientId);\n\n      if (refreshResult.success && refreshResult.accessToken && refreshResult.expiresAt) {\n        updateTokens(refreshResult.accessToken, refreshResult.expiresAt, refreshResult.refreshToken);\n        result.tokenRefreshed = true;\n        result.authenticated = true;\n        return result;\n      }\n\n      // Refresh failed - check if it's recoverable\n      if (refreshResult.errorType === 'invalid_grant') {\n        clearCredentials();\n        if (isNonInteractiveEnvironment()) {\n          exitWithAuthRequired('Session expired. Run `workos login` in an interactive terminal to re-authenticate.');\n        }\n        logInfo('[ensure-auth] Refresh token expired, triggering login');\n        await runLogin();\n        result.loginTriggered = true;\n        result.authenticated = getCredentials() !== null;\n        return result;\n      }\n\n      // Network or server error - keep credentials intact for retry\n      if (isNonInteractiveEnvironment()) {\n        exitWithAuthRequired(\n          `Authentication refresh failed (${refreshResult.errorType}). Run \\`workos login\\` in an interactive terminal.`,\n        );\n      }\n      logInfo(`[ensure-auth] Refresh failed (${refreshResult.errorType}), triggering login`);\n      await runLogin();\n      result.loginTriggered = true;\n      result.authenticated = getCredentials() !== null;\n      return result;\n    }\n  }\n\n  // Case 4: No refresh token available — clear stale creds, must login\n  clearCredentials();\n  if (isNonInteractiveEnvironment()) {\n    exitWithAuthRequired('Session expired. Run `workos login` in an interactive terminal to re-authenticate.');\n  }\n  logInfo('[ensure-auth] No refresh token, triggering login');\n  await runLogin();\n  result.loginTriggered = true;\n  result.authenticated = getCredentials() !== null;\n  return result;\n}\n"]}
+{"version":3,"file":"ensure-auth.js","sourceRoot":"","sources":["../../src/lib/ensure-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAW9D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,MAAM,GAAqB;QAC/B,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,KAAK;KACtB,CAAC;IAEF,gDAAgD;IAChD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,gBAAgB,EAAE,CAAC,CAAC,mCAAmC;QACvD,IAAI,2BAA2B,EAAE,EAAE,CAAC;YAClC,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,4DAA4D,CAAC,CAAC;QACtE,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,wDAAwD,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QAEzC,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAExE,IAAI,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,WAAW,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;gBAClF,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC7F,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,6CAA6C;YAC7C,IAAI,aAAa,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;gBAChD,gBAAgB,EAAE,CAAC;gBACnB,IAAI,2BAA2B,EAAE,EAAE,CAAC;oBAClC,oBAAoB,CAClB,yFAAyF,CAC1F,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,uDAAuD,CAAC,CAAC;gBACjE,MAAM,QAAQ,EAAE,CAAC;gBACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,8DAA8D;YAC9D,IAAI,2BAA2B,EAAE,EAAE,CAAC;gBAClC,oBAAoB,CAClB,kCAAkC,aAAa,CAAC,SAAS,0DAA0D,CACpH,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iCAAiC,aAAa,CAAC,SAAS,qBAAqB,CAAC,CAAC;YACvF,MAAM,QAAQ,EAAE,CAAC;YACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;YACjD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,gBAAgB,EAAE,CAAC;IACnB,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,oBAAoB,CAAC,yFAAyF,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAC5D,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,aAAa,GAAG,cAAc,EAAE,KAAK,IAAI,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Startup auth guard - ensures valid authentication before command execution.\n */\n\nimport { getCredentials, updateTokens, isTokenExpired, clearCredentials } from './credentials.js';\nimport { refreshAccessToken } from './token-refresh-client.js';\nimport { getCliAuthClientId, getAuthkitDomain } from './settings.js';\nimport { runLogin } from '../commands/login.js';\nimport { logInfo } from '../utils/debug.js';\nimport { isNonInteractiveEnvironment } from '../utils/environment.js';\nimport { exitWithAuthRequired } from '../utils/exit-codes.js';\n\nexport interface EnsureAuthResult {\n  /** Whether auth is now valid */\n  authenticated: boolean;\n  /** Whether login flow was triggered */\n  loginTriggered: boolean;\n  /** Whether token was refreshed */\n  tokenRefreshed: boolean;\n}\n\n/**\n * Ensure valid authentication before command execution.\n *\n * - No credentials: triggers login flow\n * - Expired access token (valid refresh): silently refreshes\n * - Expired refresh token: triggers login flow\n *\n * @returns Result indicating what actions were taken\n * @throws Error if login fails or refresh fails unexpectedly\n */\nexport async function ensureAuthenticated(): Promise<EnsureAuthResult> {\n  const result: EnsureAuthResult = {\n    authenticated: false,\n    loginTriggered: false,\n    tokenRefreshed: false,\n  };\n\n  // Case 1: No credentials or invalid credentials\n  const creds = getCredentials();\n  if (!creds) {\n    clearCredentials(); // Clean up any corrupt/empty files\n    if (isNonInteractiveEnvironment()) {\n      exitWithAuthRequired();\n    }\n    logInfo('[ensure-auth] No valid credentials found, triggering login');\n    await runLogin();\n    result.loginTriggered = true;\n    result.authenticated = getCredentials() !== null;\n    return result;\n  }\n\n  // Case 2: Access token still valid\n  if (!isTokenExpired(creds)) {\n    result.authenticated = true;\n    return result;\n  }\n\n  // Case 3: Access token expired, try refresh\n  if (creds.refreshToken) {\n    logInfo('[ensure-auth] Access token expired, attempting refresh');\n\n    const clientId = getCliAuthClientId();\n    const authkitDomain = getAuthkitDomain();\n\n    if (clientId && authkitDomain) {\n      const refreshResult = await refreshAccessToken(authkitDomain, clientId);\n\n      if (refreshResult.success && refreshResult.accessToken && refreshResult.expiresAt) {\n        updateTokens(refreshResult.accessToken, refreshResult.expiresAt, refreshResult.refreshToken);\n        result.tokenRefreshed = true;\n        result.authenticated = true;\n        return result;\n      }\n\n      // Refresh failed - check if it's recoverable\n      if (refreshResult.errorType === 'invalid_grant') {\n        clearCredentials();\n        if (isNonInteractiveEnvironment()) {\n          exitWithAuthRequired(\n            'Session expired. Run `workos auth login` in an interactive terminal to re-authenticate.',\n          );\n        }\n        logInfo('[ensure-auth] Refresh token expired, triggering login');\n        await runLogin();\n        result.loginTriggered = true;\n        result.authenticated = getCredentials() !== null;\n        return result;\n      }\n\n      // Network or server error - keep credentials intact for retry\n      if (isNonInteractiveEnvironment()) {\n        exitWithAuthRequired(\n          `Authentication refresh failed (${refreshResult.errorType}). Run \\`workos auth login\\` in an interactive terminal.`,\n        );\n      }\n      logInfo(`[ensure-auth] Refresh failed (${refreshResult.errorType}), triggering login`);\n      await runLogin();\n      result.loginTriggered = true;\n      result.authenticated = getCredentials() !== null;\n      return result;\n    }\n  }\n\n  // Case 4: No refresh token available — clear stale creds, must login\n  clearCredentials();\n  if (isNonInteractiveEnvironment()) {\n    exitWithAuthRequired('Session expired. Run `workos auth login` in an interactive terminal to re-authenticate.');\n  }\n  logInfo('[ensure-auth] No refresh token, triggering login');\n  await runLogin();\n  result.loginTriggered = true;\n  result.authenticated = getCredentials() !== null;\n  return result;\n}\n"]}

package/dist/lib/run-with-core.js

@@ -179,7 +179,7 @@ export async function runWithCore(options) {
                 if (!token) {
                     // This should rarely happen since bin.ts handles auth first
                     // But keep as safety net for programmatic usage
-                    throw new Error('Not authenticated. Run `workos login` first.');
+                    throw new Error('Not authenticated. Run `workos auth login` first.');
                 }
                 // Set telemetry from existing credentials
                 const creds = getCredentials();

package/dist/lib/run-with-core.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-with-core.js","sourceRoot":"","sources":["../../src/lib/run-with-core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAStE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,uBAAuB,IAAI,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,IAAI,eAAe,EAC/B,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,IAAI,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClH,OAAO,EACL,qBAAqB,IAAI,uBAAuB,EAChD,qBAAqB,IAAI,uBAAuB,GACjD,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,KAAK,UAAU,yBAAyB,CAAC,WAAwB,EAAE,OAAyB;IAC1F,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,SAAS;YAC3C,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,SAAS;SAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAA6C;IAC9E,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;IAE1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,oFAAoF;QACpF,iEAAiE;QACjE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,WAAmB,EACnB,OAA6C;IAE7C,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACtE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACzE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,0CAA0C;IAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAErD,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACX,OAAO,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAClD,KAAK,gBAAgB;gBACnB,OAAO,mBAAmB,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;YACnE,KAAK,cAAc;gBACjB,OAAO,mBAAmB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC1D,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC3D,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBACzD,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBACxE,MAAM,WAAW,GAAG,mBAAmB,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;gBAC9E,MAAM,YAAY,GAAG,mBAAmB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;gBACvE,OAAO,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC;YAClF,CAAC;YACD,KAAK,WAAW;gBACd,OAAO,mBAAmB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC/D,MAAM,WAAW,GACf,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;oBACxC,mBAAmB,CAAC,eAAe,EAAE,WAAW,CAAC;oBACjD,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC;oBACzC,mBAAmB,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;gBAC5D,OAAO,UAAU,IAAI,CAAC,WAAW,CAAC;YACpC,CAAC;YACD,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,CAAC,WAAW;YAC1B;gBACE,sDAAsD;gBACtD,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAyB;IACzD,4DAA4D;IAC5D,WAAW,EAAE,CAAC;IACd,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,eAAe,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,+BAA+B,EAAE;QACvC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,yDAAyD;IACzD,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;IAC9C,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAEpC,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAqB;QACzC,GAAG,OAAO;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM;QAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ;KACrD,CAAC;IAEF,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;IAC9C,IAAI,KAAK,GAAmE,IAAI,CAAC;IAEjF,MAAM,SAAS,GAAG,CAAC,KAA+C,EAAE,EAAE;QACpE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,KAAyC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,OAAyB,CAAC;IAC9B,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC3E,OAAO,GAAG,IAAI,eAAe,CAAC;YAC5B,OAAO;YACP,SAAS;YACT,KAAK,EAAE,gBAAgB,CAAC,KAAK;YAC7B,OAAO,EAAE;gBACP,MAAM,EAAE,gBAAgB,CAAC,MAAM;gBAC/B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,UAAU,EAAE,gBAAgB,CAAC,UAAU;aACxC;SACF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC;QACjD,MAAM,EAAE;YACN,mBAAmB,EAAE,WAAW,CAAC,KAAK,IAAI,EAAE;gBAC1C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,4DAA4D;oBAC5D,gDAAgD;oBAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBAED,0CAA0C;gBAC1C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;oBAC5C,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC;YAEF,iBAAiB,EAAE,WAAW,CAAiD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACjG,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;gBACxF,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,CAAC,CAAC;YAEF,cAAc,EAAE,WAAW,CAAyC,KAAK,IAAI,EAAE;gBAC7E,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBACtC,CAAC;gBACD,MAAM,KAAK,GAAG,8BAA8B,EAAE,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YAChD,CAAC,CAAC;YAEF,oBAAoB,EAAE,WAAW,CAA6C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChG,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC1B,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAExE,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACxD,CAAC;gBAED,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAClE,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBAClD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,IAAI,oBAAoB,IAAI,GAAG,YAAY,EAAE,CAAC;gBAE9F,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC1F,IAAI,WAAW,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;oBACzC,MAAM,8BAA8B,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;wBAC1E,WAAW,EAAE,gBAAgB,CAAC,WAAW;wBACzC,WAAW,EAAE,gBAAgB,CAAC,WAAW;qBAC1C,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,cAAc,GAAG,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBAE5G,aAAa,CAAC,gBAAgB,CAAC,UAAU,EAAE;oBACzC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,gBAAgB,EAAE,WAAW,CAAC,QAAQ;oBACtC,CAAC,cAAc,CAAC,EAAE,WAAW;iBAC9B,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,QAAQ,EAAE,WAAW,CAAoD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3F,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC1B,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAExE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC;gBAC1E,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAqB;wBACrC,GAAG,gBAAgB;wBACnB,MAAM,EAAE,WAAW,EAAE,MAAM;wBAC3B,QAAQ,EAAE,WAAW,EAAE,QAAQ;wBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;qBACzB,CAAC;oBACF,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;oBAC3E,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,OAAO,IAAI,6CAA6C,WAAW,GAAG;qBAChF,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;qBACjE,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;YAEF,8BAA8B;YAC9B,cAAc,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9C,OAAO,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,YAAY,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC5C,OAAO,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/C,CAAC,CAAC;YAEF,eAAe,EAAE,WAAW,CAAC,KAAK,IAAI,EAAE;gBACtC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC/B,OAAO,KAAK,KAAK,IAAI,CAAC;YACxB,CAAC,CAAC;YAEF,aAAa,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC7C,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;gBAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;gBAC7F,CAAC;gBAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;oBACzC,QAAQ;oBACR,aAAa;iBACd,CAAC,CAAC;gBAEH,mDAAmD;gBACnD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE;oBACnC,eAAe,EAAE,UAAU,CAAC,gBAAgB;oBAC5C,uBAAuB,EAAE,UAAU,CAAC,yBAAyB;oBAC7D,QAAQ,EAAE,UAAU,CAAC,SAAS;iBAC/B,CAAC,CAAC;gBAEH,eAAe;gBACf,IAAI,CAAC;oBACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;oBAChD,MAAM,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;oBACxD,QAAQ;oBACR,aAAa;oBACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;iBACvD,CAAC,CAAC;gBAEH,sBAAsB;gBACtB,eAAe,CAAC;oBACd,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAChC,CAAC,CAAC;YAEF,uBAAuB,EAAE,WAAW,CAAC,KAAK,IAAI,EAAE;gBAC9C,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;gBACzC,IAAI,SAAS,EAAE,QAAQ,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;oBAC7C,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;gBACpE,CAAC;gBAED,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBACvC,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;gBAE1B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAEzD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBACxD,sBAAsB,CAAC,OAAO,CAAC,CAAC;gBAEhC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;oBACnD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;wBACpC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG;4BAC/B,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;4BACtE,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;yBAC3B,CAAC;wBACF,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;4BAC9B,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC;wBACvC,CAAC;wBACD,UAAU,CAAC,MAAM,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,kDAAkD;gBACpD,CAAC;gBAED,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;YAEF,sBAAsB;YACtB,WAAW,EAAE,WAAW,CAA0B,KAAK,IAAI,EAAE;gBAC3D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;gBAC9C,CAAC;gBACD,OAAO;oBACL,MAAM;oBACN,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;iBACvC,CAAC;YACJ,CAAC,CAAC;YAEF,YAAY,EAAE,WAAW,CAA6D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACxG,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;gBACrC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9D,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAClC,CAAC,CAAC;YAEF,sBAAsB;YACtB,aAAa,EAAE,WAAW,CAAiD,KAAK,IAAI,EAAE;gBACpF,OAAO,aAAa,EAAE,CAAC;YACzB,CAAC,CAAC;YAEF,qBAAqB,EAAE,WAAW,CAChC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAClB,OAAO,uBAAuB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3F,CAAC,CACF;YAED,aAAa,EAAE,WAAW,CAAyC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACrF,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC,CAAC;YAEF,qBAAqB,EAAE,WAAW,CAGhC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpB,OAAO,uBAAuB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAChH,CAAC,CAAC;YAEF,UAAU,EAAE,WAAW,CAAwB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACjE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC,CAAC;YAEF,QAAQ,EAAE,WAAW,CAAuD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9F,OAAO,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC,CAAC;SACH;KACF,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,SAAuC,CAAC;IAC5C,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;QAChC,IAAI,UAA8B,CAAC;QAEnC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBAC7E,UAAU,GAAG,GAAG,CAAC;gBACjB,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;gBACvD,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;QAEF,yDAAyD;QACzD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAClE,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACjC,UAAU,CAAC,GAAG,EAAE;YACd,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;QAC5B,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,GAAG,WAAW,CAAC,iBAAiB,EAAE;QACrC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;QAC7C,OAAO,EAAE,SAAS,EAAE,OAAO;KAC5B,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IAEtB,0BAA0B;IAC1B,MAAM,IAAI,GAAG,2BAA2B,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACrG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3C,IAAI,eAAe,GAAsC,SAAS,CAAC;IAEnE,yEAAyE;IACzE,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,eAAe,GAAG,WAAW,CAAC;QAC9B,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,KAAM,CAAC,SAAS,CAAC;gBACf,QAAQ,EAAE,GAAG,EAAE;oBACb,MAAM,QAAQ,GAAG,KAAM,CAAC,WAAW,EAAE,CAAC;oBACtC,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;wBACnC,eAAe,GAAG,OAAO,CAAC;wBAC1B,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;oBAC5C,CAAC;yBAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;wBAC1C,eAAe,GAAG,WAAW,CAAC;wBAC9B,OAAO,EAAE,CAAC;oBACZ,CAAC;yBAAM,CAAC;wBACN,OAAO,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;oBACb,eAAe,GAAG,OAAO,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;aACF,CAAC,CAAC;YAEH,KAAM,CAAC,KAAK,EAAE,CAAC;YACf,KAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,GAAG,OAAO,CAAC;QAC1B,QAAQ,CAAC,2BAA2B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7G,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACpC,MAAM,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { createActor, fromPromise } from 'xstate';\nimport open from 'opn';\nimport { existsSync, readFileSync } from 'fs';\nimport { join } from 'path';\nimport { installerMachine } from './installer-core.js';\nimport { createInstallerEventEmitter } from './events.js';\nimport { CLIAdapter } from './adapters/cli-adapter.js';\nimport { DashboardAdapter } from './adapters/dashboard-adapter.js';\nimport type { InstallerAdapter } from './adapters/types.js';\nimport type { InstallerOptions } from '../utils/types.js';\nimport { isNonInteractiveEnvironment } from '../utils/environment.js';\nimport type {\n  InstallerMachineContext,\n  DetectionOutput,\n  GitCheckOutput,\n  AgentOutput,\n  BranchCheckOutput,\n} from './installer-core.types.js';\nimport type { Integration } from './constants.js';\nimport { parseEnvFile } from '../utils/env-parser.js';\nimport { enableDebugLogs, initLogFile, logInfo, logError } from '../utils/debug.js';\n\nimport {\n  getAccessToken,\n  getCredentials,\n  saveCredentials,\n  getStagingCredentials,\n  saveStagingCredentials,\n} from './credentials.js';\nimport { getConfig, saveConfig, getActiveEnvironment } from './config-store.js';\nimport { checkForEnvFiles, discoverCredentials } from './credential-discovery.js';\nimport { requestDeviceCode, pollForToken } from './device-auth.js';\nimport { fetchStagingCredentials as fetchStagingCredentialsApi } from './staging-api.js';\nimport { getCliAuthClientId, getAuthkitDomain } from './settings.js';\nimport { analytics } from '../utils/analytics.js';\nimport { getVersion } from './settings.js';\nimport { getLlmGatewayUrlFromHost } from '../utils/urls.js';\nimport { isInGitRepo, getUncommittedOrUntrackedFiles } from '../utils/clack-utils.js';\nimport {\n  getCurrentBranch,\n  isProtectedBranch,\n  createBranch as createGitBranch,\n  branchExists,\n} from '../utils/git-utils.js';\nimport { detectChanges, stageAndCommit, pushBranch as pushGitBranch, createPullRequest } from './post-install.js';\nimport {\n  generateCommitMessage as generateCommitMessageAi,\n  generatePrDescription as generatePrDescriptionAi,\n} from './ai-content.js';\nimport { autoConfigureWorkOSEnvironment } from './workos-management.js';\nimport { detectPort, getCallbackPath } from './port-detection.js';\nimport { writeEnvLocal } from './env-writer.js';\nimport { getRegistry } from './registry.js';\n\nasync function runIntegrationInstallerFn(integration: Integration, options: InstallerOptions): Promise<string> {\n  const registry = await getRegistry();\n  const mod = registry.get(integration);\n  if (!mod) {\n    throw new Error(`Unknown integration: ${integration}`);\n  }\n  return mod.run(options);\n}\n\nfunction readExistingCredentials(installDir: string): { apiKey?: string; clientId?: string } {\n  const envPath = join(installDir, '.env.local');\n  if (!existsSync(envPath)) {\n    return {};\n  }\n\n  try {\n    const content = readFileSync(envPath, 'utf-8');\n    const envVars = parseEnvFile(content);\n    return {\n      apiKey: envVars.WORKOS_API_KEY || undefined,\n      clientId: envVars.WORKOS_CLIENT_ID || undefined,\n    };\n  } catch {\n    return {};\n  }\n}\n\nasync function detectIntegrationFn(options: Pick<InstallerOptions, 'installDir'>): Promise<Integration | undefined> {\n  const registry = await getRegistry();\n  const configs = registry.detectionOrder();\n\n  for (const config of configs) {\n    // Use the detect function from INTEGRATION_CONFIG in config.ts for JS integrations,\n    // or fall back to checking if the framework package is installed\n    const detected = await detectSingleIntegration(config.metadata.integration, options);\n    if (detected) {\n      return config.metadata.integration;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Detect if a single integration matches the project.\n * Uses package.json detection for JS integrations, manifest files for others.\n */\nasync function detectSingleIntegration(\n  integration: string,\n  options: Pick<InstallerOptions, 'installDir'>,\n): Promise<boolean> {\n  const { getPackageDotJson } = await import('../utils/clack-utils.js');\n  const { hasPackageInstalled } = await import('../utils/package-json.js');\n  const { existsSync } = await import('node:fs');\n  const { join } = await import('node:path');\n\n  const registry = await getRegistry();\n  const mod = registry.get(integration);\n  if (!mod) return false;\n\n  const config = mod.config;\n\n  // For JS integrations, check package.json\n  if (config.metadata.language === 'javascript') {\n    const packageJson = await getPackageDotJson(options);\n\n    switch (integration) {\n      case 'nextjs':\n        return hasPackageInstalled('next', packageJson);\n      case 'tanstack-start':\n        return hasPackageInstalled('@tanstack/react-start', packageJson);\n      case 'react-router':\n        return hasPackageInstalled('react-router', packageJson);\n      case 'react': {\n        const hasReact = hasPackageInstalled('react', packageJson);\n        const hasNext = hasPackageInstalled('next', packageJson);\n        const hasReactRouter = hasPackageInstalled('react-router', packageJson);\n        const hasTanstack = hasPackageInstalled('@tanstack/react-start', packageJson);\n        const hasSvelteKit = hasPackageInstalled('@sveltejs/kit', packageJson);\n        return hasReact && !hasNext && !hasReactRouter && !hasTanstack && !hasSvelteKit;\n      }\n      case 'sveltekit':\n        return hasPackageInstalled('@sveltejs/kit', packageJson);\n      case 'node': {\n        const hasExpress = hasPackageInstalled('express', packageJson);\n        const hasFrontend =\n          hasPackageInstalled('next', packageJson) ||\n          hasPackageInstalled('@sveltejs/kit', packageJson) ||\n          hasPackageInstalled('react', packageJson) ||\n          hasPackageInstalled('@tanstack/react-start', packageJson);\n        return hasExpress && !hasFrontend;\n      }\n      case 'vanilla-js':\n        return true; // Fallback\n      default:\n        // Unknown JS integration — try package name detection\n        return hasPackageInstalled(config.detection.packageName, packageJson);\n    }\n  }\n\n  // For non-JS integrations, check manifest files\n  if (config.metadata.manifestFile) {\n    return existsSync(join(options.installDir, config.metadata.manifestFile));\n  }\n\n  return false;\n}\n\nexport async function runWithCore(options: InstallerOptions): Promise<void> {\n  // Initialize debug/logging early so we capture all failures\n  initLogFile();\n  if (options.debug) {\n    enableDebugLogs();\n  }\n  logInfo('Wizard starting with options:', {\n    debug: options.debug,\n    dashboard: options.dashboard,\n    local: options.local,\n    ci: options.ci,\n    skipAuth: options.skipAuth,\n    installDir: options.installDir,\n  });\n\n  // Configure telemetry endpoint (same URL as LLM gateway)\n  const gatewayUrl = getLlmGatewayUrlFromHost();\n  analytics.setGatewayUrl(gatewayUrl);\n\n  const existingCreds = readExistingCredentials(options.installDir);\n  const augmentedOptions: InstallerOptions = {\n    ...options,\n    apiKey: options.apiKey || existingCreds.apiKey,\n    clientId: options.clientId || existingCreds.clientId,\n  };\n\n  const emitter = createInstallerEventEmitter();\n  let actor: ReturnType<typeof createActor<typeof installerMachine>> | null = null;\n\n  const sendEvent = (event: { type: string; [key: string]: unknown }) => {\n    if (actor) {\n      actor.send(event as Parameters<typeof actor.send>[0]);\n    }\n  };\n\n  let adapter: InstallerAdapter;\n  if (isNonInteractiveEnvironment()) {\n    const { HeadlessAdapter } = await import('./adapters/headless-adapter.js');\n    adapter = new HeadlessAdapter({\n      emitter,\n      sendEvent,\n      debug: augmentedOptions.debug,\n      options: {\n        apiKey: augmentedOptions.apiKey,\n        clientId: augmentedOptions.clientId,\n        noBranch: augmentedOptions.noBranch,\n        noCommit: augmentedOptions.noCommit,\n        createPr: augmentedOptions.createPr,\n        noGitCheck: augmentedOptions.noGitCheck,\n      },\n    });\n  } else if (options.dashboard) {\n    adapter = new DashboardAdapter({ emitter, sendEvent, debug: augmentedOptions.debug });\n  } else {\n    adapter = new CLIAdapter({ emitter, sendEvent, debug: augmentedOptions.debug });\n  }\n\n  const machineWithActors = installerMachine.provide({\n    actors: {\n      checkAuthentication: fromPromise(async () => {\n        const token = getAccessToken();\n        if (!token) {\n          // This should rarely happen since bin.ts handles auth first\n          // But keep as safety net for programmatic usage\n          throw new Error('Not authenticated. Run `workos login` first.');\n        }\n\n        // Set telemetry from existing credentials\n        const creds = getCredentials();\n        if (creds) {\n          analytics.setAccessToken(creds.accessToken);\n          analytics.setDistinctId(creds.userId);\n        }\n        return true;\n      }),\n\n      detectIntegration: fromPromise<DetectionOutput, { options: InstallerOptions }>(async ({ input }) => {\n        const integration = await detectIntegrationFn({ installDir: input.options.installDir });\n        return { integration };\n      }),\n\n      checkGitStatus: fromPromise<GitCheckOutput, { installDir: string }>(async () => {\n        if (!isInGitRepo()) {\n          return { isClean: true, files: [] };\n        }\n        const files = getUncommittedOrUntrackedFiles();\n        return { isClean: files.length === 0, files };\n      }),\n\n      configureEnvironment: fromPromise<void, { context: InstallerMachineContext }>(async ({ input }) => {\n        const { context } = input;\n        const { options: installerOptions, integration, credentials } = context;\n\n        if (!integration || !credentials) {\n          throw new Error('Missing integration or credentials');\n        }\n\n        const port = detectPort(integration, installerOptions.installDir);\n        const callbackPath = getCallbackPath(integration);\n        const redirectUri = installerOptions.redirectUri || `http://localhost:${port}${callbackPath}`;\n\n        const requiresApiKey = ['nextjs', 'tanstack-start', 'react-router'].includes(integration);\n        if (credentials.apiKey && requiresApiKey) {\n          await autoConfigureWorkOSEnvironment(credentials.apiKey, integration, port, {\n            homepageUrl: installerOptions.homepageUrl,\n            redirectUri: installerOptions.redirectUri,\n          });\n        }\n\n        const redirectUriKey = integration === 'nextjs' ? 'NEXT_PUBLIC_WORKOS_REDIRECT_URI' : 'WORKOS_REDIRECT_URI';\n\n        writeEnvLocal(installerOptions.installDir, {\n          ...(credentials.apiKey ? { WORKOS_API_KEY: credentials.apiKey } : {}),\n          WORKOS_CLIENT_ID: credentials.clientId,\n          [redirectUriKey]: redirectUri,\n        });\n      }),\n\n      runAgent: fromPromise<AgentOutput, { context: InstallerMachineContext }>(async ({ input }) => {\n        const { context } = input;\n        const { options: installerOptions, integration, credentials } = context;\n\n        if (!integration) {\n          return { success: false, error: new Error('No integration specified') };\n        }\n\n        try {\n          const agentOptions: InstallerOptions = {\n            ...installerOptions,\n            apiKey: credentials?.apiKey,\n            clientId: credentials?.clientId,\n            emitter: context.emitter,\n          };\n          const summary = await runIntegrationInstallerFn(integration, agentOptions);\n          return {\n            success: true,\n            summary: summary || `Successfully installed WorkOS AuthKit for ${integration}!`,\n          };\n        } catch (error) {\n          return {\n            success: false,\n            error: error instanceof Error ? error : new Error(String(error)),\n          };\n        }\n      }),\n\n      // Credential discovery actors\n      detectEnvFiles: fromPromise(async ({ input }) => {\n        return checkForEnvFiles(input.installDir);\n      }),\n\n      scanEnvFiles: fromPromise(async ({ input }) => {\n        return discoverCredentials(input.installDir);\n      }),\n\n      checkStoredAuth: fromPromise(async () => {\n        const token = getAccessToken();\n        return token !== null;\n      }),\n\n      runDeviceAuth: fromPromise(async ({ input }) => {\n        const clientId = getCliAuthClientId();\n        const authkitDomain = getAuthkitDomain();\n\n        if (!clientId) {\n          throw new Error('CLI auth not configured. Set WORKOS_CLI_CLIENT_ID environment variable.');\n        }\n\n        const deviceAuth = await requestDeviceCode({\n          clientId,\n          authkitDomain,\n        });\n\n        // Emit device started event with verification info\n        input.emitter.emit('device:started', {\n          verificationUri: deviceAuth.verification_uri,\n          verificationUriComplete: deviceAuth.verification_uri_complete,\n          userCode: deviceAuth.user_code,\n        });\n\n        // Open browser\n        try {\n          const { default: openFn } = await import('opn');\n          await openFn(deviceAuth.verification_uri_complete);\n        } catch {\n          // User can open manually\n        }\n\n        const result = await pollForToken(deviceAuth.device_code, {\n          clientId,\n          authkitDomain,\n          interval: deviceAuth.interval,\n          onPoll: () => input.emitter.emit('device:polling', {}),\n        });\n\n        // Save the auth token\n        saveCredentials({\n          accessToken: result.accessToken,\n          expiresAt: result.expiresAt,\n          userId: result.userId,\n          email: result.email,\n        });\n\n        return { result, deviceAuth };\n      }),\n\n      fetchStagingCredentials: fromPromise(async () => {\n        const activeEnv = getActiveEnvironment();\n        if (activeEnv?.clientId && activeEnv?.apiKey) {\n          return { clientId: activeEnv.clientId, apiKey: activeEnv.apiKey };\n        }\n\n        const cached = getStagingCredentials();\n        if (cached) return cached;\n\n        const token = getAccessToken();\n        if (!token) throw new Error('No access token available');\n\n        const staging = await fetchStagingCredentialsApi(token);\n        saveStagingCredentials(staging);\n\n        try {\n          const config = getConfig() ?? { environments: {} };\n          if (!config.environments['default']) {\n            config.environments['default'] = {\n              name: 'default',\n              type: staging.apiKey.startsWith('sk_test_') ? 'sandbox' : 'production',\n              apiKey: staging.apiKey,\n              clientId: staging.clientId,\n            };\n            if (!config.activeEnvironment) {\n              config.activeEnvironment = 'default';\n            }\n            saveConfig(config);\n          }\n        } catch {\n          // Don't block install if config-store write fails\n        }\n\n        return staging;\n      }),\n\n      // Branch check actors\n      checkBranch: fromPromise<BranchCheckOutput, void>(async () => {\n        const branch = getCurrentBranch();\n        if (!branch) {\n          return { branch: null, isProtected: false };\n        }\n        return {\n          branch,\n          isProtected: isProtectedBranch(branch),\n        };\n      }),\n\n      createBranch: fromPromise<{ branch: string }, { name: string; fallbackName: string }>(async ({ input }) => {\n        const { name, fallbackName } = input;\n        const targetBranch = branchExists(name) ? fallbackName : name;\n        createGitBranch(targetBranch);\n        return { branch: targetBranch };\n      }),\n\n      // Post-install actors\n      detectChanges: fromPromise<{ hasChanges: boolean; files: string[] }, void>(async () => {\n        return detectChanges();\n      }),\n\n      generateCommitMessage: fromPromise<string, { integration: string; files: string[]; direct?: boolean }>(\n        async ({ input }) => {\n          return generateCommitMessageAi(input.integration, input.files, { direct: input.direct });\n        },\n      ),\n\n      commitChanges: fromPromise<void, { message: string; cwd: string }>(async ({ input }) => {\n        stageAndCommit(input.message, input.cwd);\n      }),\n\n      generatePrDescription: fromPromise<\n        string,\n        { integration: string; files: string[]; commitMessage: string; direct?: boolean }\n      >(async ({ input }) => {\n        return generatePrDescriptionAi(input.integration, input.files, input.commitMessage, { direct: input.direct });\n      }),\n\n      pushBranch: fromPromise<void, { cwd: string }>(async ({ input }) => {\n        pushGitBranch(input.cwd);\n      }),\n\n      createPr: fromPromise<string, { title: string; body: string; cwd: string }>(async ({ input }) => {\n        return createPullRequest(input.title, input.body, input.cwd);\n      }),\n    },\n  });\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let inspector: { inspect: any } | undefined;\n  if (augmentedOptions.inspect) {\n    const originalLog = console.log;\n    let inspectUrl: string | undefined;\n\n    console.log = (...args: unknown[]) => {\n      const msg = args.join(' ');\n      if (typeof msg === 'string' && msg.startsWith('https://stately.ai/inspect/')) {\n        inspectUrl = msg;\n        console.log = originalLog;\n        console.log(`Opening XState inspector: ${inspectUrl}`);\n        void open(inspectUrl);\n      } else {\n        originalLog.apply(console, args);\n      }\n    };\n\n    // Dynamic import - @statelyai/inspect is a devDependency\n    const { createSkyInspector } = await import('@statelyai/inspect');\n    inspector = createSkyInspector();\n    setTimeout(() => {\n      console.log = originalLog;\n    }, 5000).unref();\n  }\n\n  actor = createActor(machineWithActors, {\n    input: { emitter, options: augmentedOptions },\n    inspect: inspector?.inspect,\n  });\n\n  await adapter.start();\n\n  // Start telemetry session\n  const mode = isNonInteractiveEnvironment() ? 'headless' : augmentedOptions.dashboard ? 'tui' : 'cli';\n  analytics.sessionStart(mode, getVersion());\n\n  let installerStatus: 'success' | 'error' | 'cancelled' = 'success';\n\n  // Handle ctrl+c by sending CANCEL to state machine for graceful shutdown\n  const handleSigint = () => {\n    installerStatus = 'cancelled';\n    actor?.send({ type: 'CANCEL' });\n  };\n  process.on('SIGINT', handleSigint);\n\n  try {\n    await new Promise<void>((resolve, reject) => {\n      actor!.subscribe({\n        complete: () => {\n          const snapshot = actor!.getSnapshot();\n          if (snapshot.value === 'error') {\n            const err = snapshot.context.error;\n            installerStatus = 'error';\n            reject(err ?? new Error('Wizard failed'));\n          } else if (snapshot.value === 'cancelled') {\n            installerStatus = 'cancelled';\n            resolve();\n          } else {\n            resolve();\n          }\n        },\n        error: (err) => {\n          installerStatus = 'error';\n          reject(err);\n        },\n      });\n\n      actor!.start();\n      actor!.send({ type: 'START' });\n    });\n  } catch (error) {\n    installerStatus = 'error';\n    logError('Wizard failed with error:', error instanceof Error ? error.stack || error.message : String(error));\n    throw error;\n  } finally {\n    process.off('SIGINT', handleSigint);\n    await analytics.shutdown(installerStatus);\n    await adapter.stop();\n  }\n}\n"]}
+{"version":3,"file":"run-with-core.js","sourceRoot":"","sources":["../../src/lib/run-with-core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAStE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,uBAAuB,IAAI,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,IAAI,eAAe,EAC/B,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,IAAI,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClH,OAAO,EACL,qBAAqB,IAAI,uBAAuB,EAChD,qBAAqB,IAAI,uBAAuB,GACjD,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,KAAK,UAAU,yBAAyB,CAAC,WAAwB,EAAE,OAAyB;IAC1F,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,SAAS;YAC3C,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,SAAS;SAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAA6C;IAC9E,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;IAE1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,oFAAoF;QACpF,iEAAiE;QACjE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,WAAmB,EACnB,OAA6C;IAE7C,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACtE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACzE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,0CAA0C;IAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAErD,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACX,OAAO,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAClD,KAAK,gBAAgB;gBACnB,OAAO,mBAAmB,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;YACnE,KAAK,cAAc;gBACjB,OAAO,mBAAmB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC1D,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC3D,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBACzD,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBACxE,MAAM,WAAW,GAAG,mBAAmB,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;gBAC9E,MAAM,YAAY,GAAG,mBAAmB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;gBACvE,OAAO,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC;YAClF,CAAC;YACD,KAAK,WAAW;gBACd,OAAO,mBAAmB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC/D,MAAM,WAAW,GACf,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC;oBACxC,mBAAmB,CAAC,eAAe,EAAE,WAAW,CAAC;oBACjD,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC;oBACzC,mBAAmB,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;gBAC5D,OAAO,UAAU,IAAI,CAAC,WAAW,CAAC;YACpC,CAAC;YACD,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,CAAC,WAAW;YAC1B;gBACE,sDAAsD;gBACtD,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAyB;IACzD,4DAA4D;IAC5D,WAAW,EAAE,CAAC;IACd,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,eAAe,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,+BAA+B,EAAE;QACvC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,yDAAyD;IACzD,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;IAC9C,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAEpC,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAqB;QACzC,GAAG,OAAO;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM;QAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ;KACrD,CAAC;IAEF,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;IAC9C,IAAI,KAAK,GAAmE,IAAI,CAAC;IAEjF,MAAM,SAAS,GAAG,CAAC,KAA+C,EAAE,EAAE;QACpE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,KAAyC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,OAAyB,CAAC;IAC9B,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC3E,OAAO,GAAG,IAAI,eAAe,CAAC;YAC5B,OAAO;YACP,SAAS;YACT,KAAK,EAAE,gBAAgB,CAAC,KAAK;YAC7B,OAAO,EAAE;gBACP,MAAM,EAAE,gBAAgB,CAAC,MAAM;gBAC/B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,UAAU,EAAE,gBAAgB,CAAC,UAAU;aACxC;SACF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC;QACjD,MAAM,EAAE;YACN,mBAAmB,EAAE,WAAW,CAAC,KAAK,IAAI,EAAE;gBAC1C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,4DAA4D;oBAC5D,gDAAgD;oBAChD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;gBAED,0CAA0C;gBAC1C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;oBAC5C,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC;YAEF,iBAAiB,EAAE,WAAW,CAAiD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACjG,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;gBACxF,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,CAAC,CAAC;YAEF,cAAc,EAAE,WAAW,CAAyC,KAAK,IAAI,EAAE;gBAC7E,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBACtC,CAAC;gBACD,MAAM,KAAK,GAAG,8BAA8B,EAAE,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YAChD,CAAC,CAAC;YAEF,oBAAoB,EAAE,WAAW,CAA6C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChG,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC1B,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAExE,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACxD,CAAC;gBAED,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAClE,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBAClD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,IAAI,oBAAoB,IAAI,GAAG,YAAY,EAAE,CAAC;gBAE9F,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC1F,IAAI,WAAW,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;oBACzC,MAAM,8BAA8B,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;wBAC1E,WAAW,EAAE,gBAAgB,CAAC,WAAW;wBACzC,WAAW,EAAE,gBAAgB,CAAC,WAAW;qBAC1C,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,cAAc,GAAG,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBAE5G,aAAa,CAAC,gBAAgB,CAAC,UAAU,EAAE;oBACzC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,gBAAgB,EAAE,WAAW,CAAC,QAAQ;oBACtC,CAAC,cAAc,CAAC,EAAE,WAAW;iBAC9B,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,QAAQ,EAAE,WAAW,CAAoD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3F,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC1B,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAExE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC;gBAC1E,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAqB;wBACrC,GAAG,gBAAgB;wBACnB,MAAM,EAAE,WAAW,EAAE,MAAM;wBAC3B,QAAQ,EAAE,WAAW,EAAE,QAAQ;wBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;qBACzB,CAAC;oBACF,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;oBAC3E,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,OAAO,IAAI,6CAA6C,WAAW,GAAG;qBAChF,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;qBACjE,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;YAEF,8BAA8B;YAC9B,cAAc,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9C,OAAO,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5C,CAAC,CAAC;YAEF,YAAY,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC5C,OAAO,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/C,CAAC,CAAC;YAEF,eAAe,EAAE,WAAW,CAAC,KAAK,IAAI,EAAE;gBACtC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC/B,OAAO,KAAK,KAAK,IAAI,CAAC;YACxB,CAAC,CAAC;YAEF,aAAa,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC7C,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;gBAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;gBAC7F,CAAC;gBAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;oBACzC,QAAQ;oBACR,aAAa;iBACd,CAAC,CAAC;gBAEH,mDAAmD;gBACnD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE;oBACnC,eAAe,EAAE,UAAU,CAAC,gBAAgB;oBAC5C,uBAAuB,EAAE,UAAU,CAAC,yBAAyB;oBAC7D,QAAQ,EAAE,UAAU,CAAC,SAAS;iBAC/B,CAAC,CAAC;gBAEH,eAAe;gBACf,IAAI,CAAC;oBACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;oBAChD,MAAM,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;oBACxD,QAAQ;oBACR,aAAa;oBACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;iBACvD,CAAC,CAAC;gBAEH,sBAAsB;gBACtB,eAAe,CAAC;oBACd,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAChC,CAAC,CAAC;YAEF,uBAAuB,EAAE,WAAW,CAAC,KAAK,IAAI,EAAE;gBAC9C,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;gBACzC,IAAI,SAAS,EAAE,QAAQ,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;oBAC7C,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;gBACpE,CAAC;gBAED,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBACvC,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;gBAE1B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAEzD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBACxD,sBAAsB,CAAC,OAAO,CAAC,CAAC;gBAEhC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;oBACnD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;wBACpC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG;4BAC/B,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;4BACtE,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;yBAC3B,CAAC;wBACF,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;4BAC9B,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC;wBACvC,CAAC;wBACD,UAAU,CAAC,MAAM,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,kDAAkD;gBACpD,CAAC;gBAED,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;YAEF,sBAAsB;YACtB,WAAW,EAAE,WAAW,CAA0B,KAAK,IAAI,EAAE;gBAC3D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;gBAC9C,CAAC;gBACD,OAAO;oBACL,MAAM;oBACN,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;iBACvC,CAAC;YACJ,CAAC,CAAC;YAEF,YAAY,EAAE,WAAW,CAA6D,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACxG,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;gBACrC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9D,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAClC,CAAC,CAAC;YAEF,sBAAsB;YACtB,aAAa,EAAE,WAAW,CAAiD,KAAK,IAAI,EAAE;gBACpF,OAAO,aAAa,EAAE,CAAC;YACzB,CAAC,CAAC;YAEF,qBAAqB,EAAE,WAAW,CAChC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAClB,OAAO,uBAAuB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3F,CAAC,CACF;YAED,aAAa,EAAE,WAAW,CAAyC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACrF,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC,CAAC;YAEF,qBAAqB,EAAE,WAAW,CAGhC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpB,OAAO,uBAAuB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAChH,CAAC,CAAC;YAEF,UAAU,EAAE,WAAW,CAAwB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACjE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC,CAAC;YAEF,QAAQ,EAAE,WAAW,CAAuD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9F,OAAO,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC,CAAC;SACH;KACF,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,SAAuC,CAAC;IAC5C,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;QAChC,IAAI,UAA8B,CAAC;QAEnC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBAC7E,UAAU,GAAG,GAAG,CAAC;gBACjB,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;gBACvD,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;QAEF,yDAAyD;QACzD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAClE,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACjC,UAAU,CAAC,GAAG,EAAE;YACd,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;QAC5B,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,GAAG,WAAW,CAAC,iBAAiB,EAAE;QACrC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;QAC7C,OAAO,EAAE,SAAS,EAAE,OAAO;KAC5B,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IAEtB,0BAA0B;IAC1B,MAAM,IAAI,GAAG,2BAA2B,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACrG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3C,IAAI,eAAe,GAAsC,SAAS,CAAC;IAEnE,yEAAyE;IACzE,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,eAAe,GAAG,WAAW,CAAC;QAC9B,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,KAAM,CAAC,SAAS,CAAC;gBACf,QAAQ,EAAE,GAAG,EAAE;oBACb,MAAM,QAAQ,GAAG,KAAM,CAAC,WAAW,EAAE,CAAC;oBACtC,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;wBACnC,eAAe,GAAG,OAAO,CAAC;wBAC1B,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;oBAC5C,CAAC;yBAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;wBAC1C,eAAe,GAAG,WAAW,CAAC;wBAC9B,OAAO,EAAE,CAAC;oBACZ,CAAC;yBAAM,CAAC;wBACN,OAAO,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;oBACb,eAAe,GAAG,OAAO,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;aACF,CAAC,CAAC;YAEH,KAAM,CAAC,KAAK,EAAE,CAAC;YACf,KAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,GAAG,OAAO,CAAC;QAC1B,QAAQ,CAAC,2BAA2B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7G,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACpC,MAAM,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { createActor, fromPromise } from 'xstate';\nimport open from 'opn';\nimport { existsSync, readFileSync } from 'fs';\nimport { join } from 'path';\nimport { installerMachine } from './installer-core.js';\nimport { createInstallerEventEmitter } from './events.js';\nimport { CLIAdapter } from './adapters/cli-adapter.js';\nimport { DashboardAdapter } from './adapters/dashboard-adapter.js';\nimport type { InstallerAdapter } from './adapters/types.js';\nimport type { InstallerOptions } from '../utils/types.js';\nimport { isNonInteractiveEnvironment } from '../utils/environment.js';\nimport type {\n  InstallerMachineContext,\n  DetectionOutput,\n  GitCheckOutput,\n  AgentOutput,\n  BranchCheckOutput,\n} from './installer-core.types.js';\nimport type { Integration } from './constants.js';\nimport { parseEnvFile } from '../utils/env-parser.js';\nimport { enableDebugLogs, initLogFile, logInfo, logError } from '../utils/debug.js';\n\nimport {\n  getAccessToken,\n  getCredentials,\n  saveCredentials,\n  getStagingCredentials,\n  saveStagingCredentials,\n} from './credentials.js';\nimport { getConfig, saveConfig, getActiveEnvironment } from './config-store.js';\nimport { checkForEnvFiles, discoverCredentials } from './credential-discovery.js';\nimport { requestDeviceCode, pollForToken } from './device-auth.js';\nimport { fetchStagingCredentials as fetchStagingCredentialsApi } from './staging-api.js';\nimport { getCliAuthClientId, getAuthkitDomain } from './settings.js';\nimport { analytics } from '../utils/analytics.js';\nimport { getVersion } from './settings.js';\nimport { getLlmGatewayUrlFromHost } from '../utils/urls.js';\nimport { isInGitRepo, getUncommittedOrUntrackedFiles } from '../utils/clack-utils.js';\nimport {\n  getCurrentBranch,\n  isProtectedBranch,\n  createBranch as createGitBranch,\n  branchExists,\n} from '../utils/git-utils.js';\nimport { detectChanges, stageAndCommit, pushBranch as pushGitBranch, createPullRequest } from './post-install.js';\nimport {\n  generateCommitMessage as generateCommitMessageAi,\n  generatePrDescription as generatePrDescriptionAi,\n} from './ai-content.js';\nimport { autoConfigureWorkOSEnvironment } from './workos-management.js';\nimport { detectPort, getCallbackPath } from './port-detection.js';\nimport { writeEnvLocal } from './env-writer.js';\nimport { getRegistry } from './registry.js';\n\nasync function runIntegrationInstallerFn(integration: Integration, options: InstallerOptions): Promise<string> {\n  const registry = await getRegistry();\n  const mod = registry.get(integration);\n  if (!mod) {\n    throw new Error(`Unknown integration: ${integration}`);\n  }\n  return mod.run(options);\n}\n\nfunction readExistingCredentials(installDir: string): { apiKey?: string; clientId?: string } {\n  const envPath = join(installDir, '.env.local');\n  if (!existsSync(envPath)) {\n    return {};\n  }\n\n  try {\n    const content = readFileSync(envPath, 'utf-8');\n    const envVars = parseEnvFile(content);\n    return {\n      apiKey: envVars.WORKOS_API_KEY || undefined,\n      clientId: envVars.WORKOS_CLIENT_ID || undefined,\n    };\n  } catch {\n    return {};\n  }\n}\n\nasync function detectIntegrationFn(options: Pick<InstallerOptions, 'installDir'>): Promise<Integration | undefined> {\n  const registry = await getRegistry();\n  const configs = registry.detectionOrder();\n\n  for (const config of configs) {\n    // Use the detect function from INTEGRATION_CONFIG in config.ts for JS integrations,\n    // or fall back to checking if the framework package is installed\n    const detected = await detectSingleIntegration(config.metadata.integration, options);\n    if (detected) {\n      return config.metadata.integration;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Detect if a single integration matches the project.\n * Uses package.json detection for JS integrations, manifest files for others.\n */\nasync function detectSingleIntegration(\n  integration: string,\n  options: Pick<InstallerOptions, 'installDir'>,\n): Promise<boolean> {\n  const { getPackageDotJson } = await import('../utils/clack-utils.js');\n  const { hasPackageInstalled } = await import('../utils/package-json.js');\n  const { existsSync } = await import('node:fs');\n  const { join } = await import('node:path');\n\n  const registry = await getRegistry();\n  const mod = registry.get(integration);\n  if (!mod) return false;\n\n  const config = mod.config;\n\n  // For JS integrations, check package.json\n  if (config.metadata.language === 'javascript') {\n    const packageJson = await getPackageDotJson(options);\n\n    switch (integration) {\n      case 'nextjs':\n        return hasPackageInstalled('next', packageJson);\n      case 'tanstack-start':\n        return hasPackageInstalled('@tanstack/react-start', packageJson);\n      case 'react-router':\n        return hasPackageInstalled('react-router', packageJson);\n      case 'react': {\n        const hasReact = hasPackageInstalled('react', packageJson);\n        const hasNext = hasPackageInstalled('next', packageJson);\n        const hasReactRouter = hasPackageInstalled('react-router', packageJson);\n        const hasTanstack = hasPackageInstalled('@tanstack/react-start', packageJson);\n        const hasSvelteKit = hasPackageInstalled('@sveltejs/kit', packageJson);\n        return hasReact && !hasNext && !hasReactRouter && !hasTanstack && !hasSvelteKit;\n      }\n      case 'sveltekit':\n        return hasPackageInstalled('@sveltejs/kit', packageJson);\n      case 'node': {\n        const hasExpress = hasPackageInstalled('express', packageJson);\n        const hasFrontend =\n          hasPackageInstalled('next', packageJson) ||\n          hasPackageInstalled('@sveltejs/kit', packageJson) ||\n          hasPackageInstalled('react', packageJson) ||\n          hasPackageInstalled('@tanstack/react-start', packageJson);\n        return hasExpress && !hasFrontend;\n      }\n      case 'vanilla-js':\n        return true; // Fallback\n      default:\n        // Unknown JS integration — try package name detection\n        return hasPackageInstalled(config.detection.packageName, packageJson);\n    }\n  }\n\n  // For non-JS integrations, check manifest files\n  if (config.metadata.manifestFile) {\n    return existsSync(join(options.installDir, config.metadata.manifestFile));\n  }\n\n  return false;\n}\n\nexport async function runWithCore(options: InstallerOptions): Promise<void> {\n  // Initialize debug/logging early so we capture all failures\n  initLogFile();\n  if (options.debug) {\n    enableDebugLogs();\n  }\n  logInfo('Wizard starting with options:', {\n    debug: options.debug,\n    dashboard: options.dashboard,\n    local: options.local,\n    ci: options.ci,\n    skipAuth: options.skipAuth,\n    installDir: options.installDir,\n  });\n\n  // Configure telemetry endpoint (same URL as LLM gateway)\n  const gatewayUrl = getLlmGatewayUrlFromHost();\n  analytics.setGatewayUrl(gatewayUrl);\n\n  const existingCreds = readExistingCredentials(options.installDir);\n  const augmentedOptions: InstallerOptions = {\n    ...options,\n    apiKey: options.apiKey || existingCreds.apiKey,\n    clientId: options.clientId || existingCreds.clientId,\n  };\n\n  const emitter = createInstallerEventEmitter();\n  let actor: ReturnType<typeof createActor<typeof installerMachine>> | null = null;\n\n  const sendEvent = (event: { type: string; [key: string]: unknown }) => {\n    if (actor) {\n      actor.send(event as Parameters<typeof actor.send>[0]);\n    }\n  };\n\n  let adapter: InstallerAdapter;\n  if (isNonInteractiveEnvironment()) {\n    const { HeadlessAdapter } = await import('./adapters/headless-adapter.js');\n    adapter = new HeadlessAdapter({\n      emitter,\n      sendEvent,\n      debug: augmentedOptions.debug,\n      options: {\n        apiKey: augmentedOptions.apiKey,\n        clientId: augmentedOptions.clientId,\n        noBranch: augmentedOptions.noBranch,\n        noCommit: augmentedOptions.noCommit,\n        createPr: augmentedOptions.createPr,\n        noGitCheck: augmentedOptions.noGitCheck,\n      },\n    });\n  } else if (options.dashboard) {\n    adapter = new DashboardAdapter({ emitter, sendEvent, debug: augmentedOptions.debug });\n  } else {\n    adapter = new CLIAdapter({ emitter, sendEvent, debug: augmentedOptions.debug });\n  }\n\n  const machineWithActors = installerMachine.provide({\n    actors: {\n      checkAuthentication: fromPromise(async () => {\n        const token = getAccessToken();\n        if (!token) {\n          // This should rarely happen since bin.ts handles auth first\n          // But keep as safety net for programmatic usage\n          throw new Error('Not authenticated. Run `workos auth login` first.');\n        }\n\n        // Set telemetry from existing credentials\n        const creds = getCredentials();\n        if (creds) {\n          analytics.setAccessToken(creds.accessToken);\n          analytics.setDistinctId(creds.userId);\n        }\n        return true;\n      }),\n\n      detectIntegration: fromPromise<DetectionOutput, { options: InstallerOptions }>(async ({ input }) => {\n        const integration = await detectIntegrationFn({ installDir: input.options.installDir });\n        return { integration };\n      }),\n\n      checkGitStatus: fromPromise<GitCheckOutput, { installDir: string }>(async () => {\n        if (!isInGitRepo()) {\n          return { isClean: true, files: [] };\n        }\n        const files = getUncommittedOrUntrackedFiles();\n        return { isClean: files.length === 0, files };\n      }),\n\n      configureEnvironment: fromPromise<void, { context: InstallerMachineContext }>(async ({ input }) => {\n        const { context } = input;\n        const { options: installerOptions, integration, credentials } = context;\n\n        if (!integration || !credentials) {\n          throw new Error('Missing integration or credentials');\n        }\n\n        const port = detectPort(integration, installerOptions.installDir);\n        const callbackPath = getCallbackPath(integration);\n        const redirectUri = installerOptions.redirectUri || `http://localhost:${port}${callbackPath}`;\n\n        const requiresApiKey = ['nextjs', 'tanstack-start', 'react-router'].includes(integration);\n        if (credentials.apiKey && requiresApiKey) {\n          await autoConfigureWorkOSEnvironment(credentials.apiKey, integration, port, {\n            homepageUrl: installerOptions.homepageUrl,\n            redirectUri: installerOptions.redirectUri,\n          });\n        }\n\n        const redirectUriKey = integration === 'nextjs' ? 'NEXT_PUBLIC_WORKOS_REDIRECT_URI' : 'WORKOS_REDIRECT_URI';\n\n        writeEnvLocal(installerOptions.installDir, {\n          ...(credentials.apiKey ? { WORKOS_API_KEY: credentials.apiKey } : {}),\n          WORKOS_CLIENT_ID: credentials.clientId,\n          [redirectUriKey]: redirectUri,\n        });\n      }),\n\n      runAgent: fromPromise<AgentOutput, { context: InstallerMachineContext }>(async ({ input }) => {\n        const { context } = input;\n        const { options: installerOptions, integration, credentials } = context;\n\n        if (!integration) {\n          return { success: false, error: new Error('No integration specified') };\n        }\n\n        try {\n          const agentOptions: InstallerOptions = {\n            ...installerOptions,\n            apiKey: credentials?.apiKey,\n            clientId: credentials?.clientId,\n            emitter: context.emitter,\n          };\n          const summary = await runIntegrationInstallerFn(integration, agentOptions);\n          return {\n            success: true,\n            summary: summary || `Successfully installed WorkOS AuthKit for ${integration}!`,\n          };\n        } catch (error) {\n          return {\n            success: false,\n            error: error instanceof Error ? error : new Error(String(error)),\n          };\n        }\n      }),\n\n      // Credential discovery actors\n      detectEnvFiles: fromPromise(async ({ input }) => {\n        return checkForEnvFiles(input.installDir);\n      }),\n\n      scanEnvFiles: fromPromise(async ({ input }) => {\n        return discoverCredentials(input.installDir);\n      }),\n\n      checkStoredAuth: fromPromise(async () => {\n        const token = getAccessToken();\n        return token !== null;\n      }),\n\n      runDeviceAuth: fromPromise(async ({ input }) => {\n        const clientId = getCliAuthClientId();\n        const authkitDomain = getAuthkitDomain();\n\n        if (!clientId) {\n          throw new Error('CLI auth not configured. Set WORKOS_CLI_CLIENT_ID environment variable.');\n        }\n\n        const deviceAuth = await requestDeviceCode({\n          clientId,\n          authkitDomain,\n        });\n\n        // Emit device started event with verification info\n        input.emitter.emit('device:started', {\n          verificationUri: deviceAuth.verification_uri,\n          verificationUriComplete: deviceAuth.verification_uri_complete,\n          userCode: deviceAuth.user_code,\n        });\n\n        // Open browser\n        try {\n          const { default: openFn } = await import('opn');\n          await openFn(deviceAuth.verification_uri_complete);\n        } catch {\n          // User can open manually\n        }\n\n        const result = await pollForToken(deviceAuth.device_code, {\n          clientId,\n          authkitDomain,\n          interval: deviceAuth.interval,\n          onPoll: () => input.emitter.emit('device:polling', {}),\n        });\n\n        // Save the auth token\n        saveCredentials({\n          accessToken: result.accessToken,\n          expiresAt: result.expiresAt,\n          userId: result.userId,\n          email: result.email,\n        });\n\n        return { result, deviceAuth };\n      }),\n\n      fetchStagingCredentials: fromPromise(async () => {\n        const activeEnv = getActiveEnvironment();\n        if (activeEnv?.clientId && activeEnv?.apiKey) {\n          return { clientId: activeEnv.clientId, apiKey: activeEnv.apiKey };\n        }\n\n        const cached = getStagingCredentials();\n        if (cached) return cached;\n\n        const token = getAccessToken();\n        if (!token) throw new Error('No access token available');\n\n        const staging = await fetchStagingCredentialsApi(token);\n        saveStagingCredentials(staging);\n\n        try {\n          const config = getConfig() ?? { environments: {} };\n          if (!config.environments['default']) {\n            config.environments['default'] = {\n              name: 'default',\n              type: staging.apiKey.startsWith('sk_test_') ? 'sandbox' : 'production',\n              apiKey: staging.apiKey,\n              clientId: staging.clientId,\n            };\n            if (!config.activeEnvironment) {\n              config.activeEnvironment = 'default';\n            }\n            saveConfig(config);\n          }\n        } catch {\n          // Don't block install if config-store write fails\n        }\n\n        return staging;\n      }),\n\n      // Branch check actors\n      checkBranch: fromPromise<BranchCheckOutput, void>(async () => {\n        const branch = getCurrentBranch();\n        if (!branch) {\n          return { branch: null, isProtected: false };\n        }\n        return {\n          branch,\n          isProtected: isProtectedBranch(branch),\n        };\n      }),\n\n      createBranch: fromPromise<{ branch: string }, { name: string; fallbackName: string }>(async ({ input }) => {\n        const { name, fallbackName } = input;\n        const targetBranch = branchExists(name) ? fallbackName : name;\n        createGitBranch(targetBranch);\n        return { branch: targetBranch };\n      }),\n\n      // Post-install actors\n      detectChanges: fromPromise<{ hasChanges: boolean; files: string[] }, void>(async () => {\n        return detectChanges();\n      }),\n\n      generateCommitMessage: fromPromise<string, { integration: string; files: string[]; direct?: boolean }>(\n        async ({ input }) => {\n          return generateCommitMessageAi(input.integration, input.files, { direct: input.direct });\n        },\n      ),\n\n      commitChanges: fromPromise<void, { message: string; cwd: string }>(async ({ input }) => {\n        stageAndCommit(input.message, input.cwd);\n      }),\n\n      generatePrDescription: fromPromise<\n        string,\n        { integration: string; files: string[]; commitMessage: string; direct?: boolean }\n      >(async ({ input }) => {\n        return generatePrDescriptionAi(input.integration, input.files, input.commitMessage, { direct: input.direct });\n      }),\n\n      pushBranch: fromPromise<void, { cwd: string }>(async ({ input }) => {\n        pushGitBranch(input.cwd);\n      }),\n\n      createPr: fromPromise<string, { title: string; body: string; cwd: string }>(async ({ input }) => {\n        return createPullRequest(input.title, input.body, input.cwd);\n      }),\n    },\n  });\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let inspector: { inspect: any } | undefined;\n  if (augmentedOptions.inspect) {\n    const originalLog = console.log;\n    let inspectUrl: string | undefined;\n\n    console.log = (...args: unknown[]) => {\n      const msg = args.join(' ');\n      if (typeof msg === 'string' && msg.startsWith('https://stately.ai/inspect/')) {\n        inspectUrl = msg;\n        console.log = originalLog;\n        console.log(`Opening XState inspector: ${inspectUrl}`);\n        void open(inspectUrl);\n      } else {\n        originalLog.apply(console, args);\n      }\n    };\n\n    // Dynamic import - @statelyai/inspect is a devDependency\n    const { createSkyInspector } = await import('@statelyai/inspect');\n    inspector = createSkyInspector();\n    setTimeout(() => {\n      console.log = originalLog;\n    }, 5000).unref();\n  }\n\n  actor = createActor(machineWithActors, {\n    input: { emitter, options: augmentedOptions },\n    inspect: inspector?.inspect,\n  });\n\n  await adapter.start();\n\n  // Start telemetry session\n  const mode = isNonInteractiveEnvironment() ? 'headless' : augmentedOptions.dashboard ? 'tui' : 'cli';\n  analytics.sessionStart(mode, getVersion());\n\n  let installerStatus: 'success' | 'error' | 'cancelled' = 'success';\n\n  // Handle ctrl+c by sending CANCEL to state machine for graceful shutdown\n  const handleSigint = () => {\n    installerStatus = 'cancelled';\n    actor?.send({ type: 'CANCEL' });\n  };\n  process.on('SIGINT', handleSigint);\n\n  try {\n    await new Promise<void>((resolve, reject) => {\n      actor!.subscribe({\n        complete: () => {\n          const snapshot = actor!.getSnapshot();\n          if (snapshot.value === 'error') {\n            const err = snapshot.context.error;\n            installerStatus = 'error';\n            reject(err ?? new Error('Wizard failed'));\n          } else if (snapshot.value === 'cancelled') {\n            installerStatus = 'cancelled';\n            resolve();\n          } else {\n            resolve();\n          }\n        },\n        error: (err) => {\n          installerStatus = 'error';\n          reject(err);\n        },\n      });\n\n      actor!.start();\n      actor!.send({ type: 'START' });\n    });\n  } catch (error) {\n    installerStatus = 'error';\n    logError('Wizard failed with error:', error instanceof Error ? error.stack || error.message : String(error));\n    throw error;\n  } finally {\n    process.off('SIGINT', handleSigint);\n    await analytics.shutdown(installerStatus);\n    await adapter.stop();\n  }\n}\n"]}

package/dist/lib/token-refresh-client.js

@@ -42,7 +42,7 @@ export async function refreshAccessToken(authkitDomain, clientId) {
             if (errorData.error === 'invalid_grant') {
                 return {
                     success: false,
-                    error: 'Session expired. Run `workos login` to re-authenticate.',
+                    error: 'Session expired. Run `workos auth login` to re-authenticate.',
                     errorType: 'invalid_grant',
                 };
             }

package/dist/lib/token-refresh-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-refresh-client.js","sourceRoot":"","sources":["../../src/lib/token-refresh-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAuBlD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,QAAgB;IAC9E,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,4BAA4B;YACnC,SAAS,EAAE,eAAe;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,aAAa,eAAe,CAAC;IACjD,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAEzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,SAAS,EAAE,QAAQ;aACpB,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAChE,QAAQ,CAAC,iCAAiC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAE7D,IAAI,SAAS,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACxC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,yDAAyD;oBAChE,SAAS,EAAE,eAAe;iBAC3B,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK;gBACrD,SAAS,EAAE,QAAQ;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEtD,OAAO,CAAC,wDAAwD,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAErG,OAAO;YACL,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,iBAAiB;YACnD,SAAS;SACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1D,QAAQ,CAAC,mCAAmC,CAAC,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;gBAChC,SAAS,EAAE,SAAS;aACrB,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kBAAmB,KAAe,CAAC,OAAO,EAAE;YACnD,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,cAAsB,CAAC,GAAG,EAAE,GAAG,IAAI;IACtF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,IAAI,SAAS,CAAC;AAC/C,CAAC","sourcesContent":["/**\n * Token refresh client for WorkOS OAuth\n */\n\nimport { logInfo, logError } from '../utils/debug.js';\nimport { getCredentials } from './credentials.js';\n\nexport interface RefreshResult {\n  success: boolean;\n  accessToken?: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  error?: string;\n  errorType?: 'invalid_grant' | 'network' | 'server' | 'unknown';\n}\n\ninterface TokenRefreshResponse {\n  access_token: string;\n  refresh_token?: string;\n  token_type: string;\n  expires_in: number;\n}\n\ninterface TokenErrorResponse {\n  error: string;\n  error_description?: string;\n}\n\nconst REFRESH_TIMEOUT_MS = 30_000;\n\n/**\n * Refresh access token using stored refresh token.\n *\n * @param authkitDomain - The AuthKit domain (e.g., https://auth.workos.com)\n * @param clientId - OAuth client ID\n * @returns RefreshResult with new tokens or error details\n */\nexport async function refreshAccessToken(authkitDomain: string, clientId: string): Promise<RefreshResult> {\n  const creds = getCredentials();\n\n  if (!creds?.refreshToken) {\n    return {\n      success: false,\n      error: 'No refresh token available',\n      errorType: 'invalid_grant',\n    };\n  }\n\n  const tokenUrl = `${authkitDomain}/oauth2/token`;\n  logInfo('[token-refresh] Attempting token refresh');\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: creds.refreshToken,\n        client_id: clientId,\n      }),\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (!response.ok) {\n      const errorData = (await response.json()) as TokenErrorResponse;\n      logError('[token-refresh] Refresh failed:', errorData.error);\n\n      if (errorData.error === 'invalid_grant') {\n        return {\n          success: false,\n          error: 'Session expired. Run `workos login` to re-authenticate.',\n          errorType: 'invalid_grant',\n        };\n      }\n\n      return {\n        success: false,\n        error: errorData.error_description || errorData.error,\n        errorType: 'server',\n      };\n    }\n\n    const data = (await response.json()) as TokenRefreshResponse;\n    const expiresAt = Date.now() + data.expires_in * 1000;\n\n    logInfo('[token-refresh] Token refreshed successfully, expires:', new Date(expiresAt).toISOString());\n\n    return {\n      success: true,\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token, // May be rotated\n      expiresAt,\n    };\n  } catch (error) {\n    if (error instanceof Error && error.name === 'AbortError') {\n      logError('[token-refresh] Refresh timed out');\n      return {\n        success: false,\n        error: 'Token refresh timed out',\n        errorType: 'network',\n      };\n    }\n\n    logError('[token-refresh] Network error:', error);\n    return {\n      success: false,\n      error: `Network error: ${(error as Error).message}`,\n      errorType: 'network',\n    };\n  }\n}\n\n/**\n * Check if token needs refresh (expires within threshold).\n */\nexport function tokenNeedsRefresh(expiresAt: number, thresholdMs: number = 2 * 60 * 1000): boolean {\n  return Date.now() + thresholdMs >= expiresAt;\n}\n"]}
+{"version":3,"file":"token-refresh-client.js","sourceRoot":"","sources":["../../src/lib/token-refresh-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAuBlD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,QAAgB;IAC9E,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,4BAA4B;YACnC,SAAS,EAAE,eAAe;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,aAAa,eAAe,CAAC;IACjD,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAEzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,SAAS,EAAE,QAAQ;aACpB,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAChE,QAAQ,CAAC,iCAAiC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAE7D,IAAI,SAAS,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACxC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8DAA8D;oBACrE,SAAS,EAAE,eAAe;iBAC3B,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK;gBACrD,SAAS,EAAE,QAAQ;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEtD,OAAO,CAAC,wDAAwD,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAErG,OAAO;YACL,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,iBAAiB;YACnD,SAAS;SACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1D,QAAQ,CAAC,mCAAmC,CAAC,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;gBAChC,SAAS,EAAE,SAAS;aACrB,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kBAAmB,KAAe,CAAC,OAAO,EAAE;YACnD,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,cAAsB,CAAC,GAAG,EAAE,GAAG,IAAI;IACtF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,IAAI,SAAS,CAAC;AAC/C,CAAC","sourcesContent":["/**\n * Token refresh client for WorkOS OAuth\n */\n\nimport { logInfo, logError } from '../utils/debug.js';\nimport { getCredentials } from './credentials.js';\n\nexport interface RefreshResult {\n  success: boolean;\n  accessToken?: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  error?: string;\n  errorType?: 'invalid_grant' | 'network' | 'server' | 'unknown';\n}\n\ninterface TokenRefreshResponse {\n  access_token: string;\n  refresh_token?: string;\n  token_type: string;\n  expires_in: number;\n}\n\ninterface TokenErrorResponse {\n  error: string;\n  error_description?: string;\n}\n\nconst REFRESH_TIMEOUT_MS = 30_000;\n\n/**\n * Refresh access token using stored refresh token.\n *\n * @param authkitDomain - The AuthKit domain (e.g., https://auth.workos.com)\n * @param clientId - OAuth client ID\n * @returns RefreshResult with new tokens or error details\n */\nexport async function refreshAccessToken(authkitDomain: string, clientId: string): Promise<RefreshResult> {\n  const creds = getCredentials();\n\n  if (!creds?.refreshToken) {\n    return {\n      success: false,\n      error: 'No refresh token available',\n      errorType: 'invalid_grant',\n    };\n  }\n\n  const tokenUrl = `${authkitDomain}/oauth2/token`;\n  logInfo('[token-refresh] Attempting token refresh');\n\n  try {\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: creds.refreshToken,\n        client_id: clientId,\n      }),\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeout);\n\n    if (!response.ok) {\n      const errorData = (await response.json()) as TokenErrorResponse;\n      logError('[token-refresh] Refresh failed:', errorData.error);\n\n      if (errorData.error === 'invalid_grant') {\n        return {\n          success: false,\n          error: 'Session expired. Run `workos auth login` to re-authenticate.',\n          errorType: 'invalid_grant',\n        };\n      }\n\n      return {\n        success: false,\n        error: errorData.error_description || errorData.error,\n        errorType: 'server',\n      };\n    }\n\n    const data = (await response.json()) as TokenRefreshResponse;\n    const expiresAt = Date.now() + data.expires_in * 1000;\n\n    logInfo('[token-refresh] Token refreshed successfully, expires:', new Date(expiresAt).toISOString());\n\n    return {\n      success: true,\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token, // May be rotated\n      expiresAt,\n    };\n  } catch (error) {\n    if (error instanceof Error && error.name === 'AbortError') {\n      logError('[token-refresh] Refresh timed out');\n      return {\n        success: false,\n        error: 'Token refresh timed out',\n        errorType: 'network',\n      };\n    }\n\n    logError('[token-refresh] Network error:', error);\n    return {\n      success: false,\n      error: `Network error: ${(error as Error).message}`,\n      errorType: 'network',\n    };\n  }\n}\n\n/**\n * Check if token needs refresh (expires within threshold).\n */\nexport function tokenNeedsRefresh(expiresAt: number, thresholdMs: number = 2 * 60 * 1000): boolean {\n  return Date.now() + thresholdMs >= expiresAt;\n}\n"]}

package/dist/lib/token-refresh.js

@@ -17,7 +17,7 @@ export async function ensureValidToken() {
         logInfo('[ensureValidToken] Token expired, re-authentication required');
         return {
             success: false,
-            error: 'Session expired. Run `workos login` to re-authenticate.',
+            error: 'Session expired. Run `workos auth login` to re-authenticate.',
         };
     }
     logInfo('[ensureValidToken] Token valid');

package/dist/lib/token-refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/lib/token-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAe,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAQ5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,yCAAyC,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,uCAAuC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,CAAC,oCAAoC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAExE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,8DAA8D,CAAC,CAAC;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,yDAAyD;SACjE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { getCredentials, isTokenExpired, Credentials } from './credentials.js';\nimport { logInfo } from '../utils/debug.js';\n\nexport interface TokenValidationResult {\n  success: boolean;\n  credentials?: Credentials;\n  error?: string;\n}\n\n/**\n * Check if the current token is valid.\n * If expired, returns an error prompting re-authentication.\n * No refresh is attempted - refresh tokens are not stored for security.\n */\nexport async function ensureValidToken(): Promise<TokenValidationResult> {\n  const creds = getCredentials();\n\n  if (!creds) {\n    logInfo('[ensureValidToken] No credentials found');\n    return { success: false, error: 'Not authenticated' };\n  }\n\n  logInfo(`[ensureValidToken] Token expiresAt: ${new Date(creds.expiresAt).toISOString()}`);\n  logInfo(`[ensureValidToken] Current time: ${new Date().toISOString()}`);\n\n  if (isTokenExpired(creds)) {\n    logInfo('[ensureValidToken] Token expired, re-authentication required');\n    return {\n      success: false,\n      error: 'Session expired. Run `workos login` to re-authenticate.',\n    };\n  }\n\n  logInfo('[ensureValidToken] Token valid');\n  return { success: true, credentials: creds };\n}\n"]}
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/lib/token-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAe,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAQ5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,yCAAyC,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,uCAAuC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,CAAC,oCAAoC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAExE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,8DAA8D,CAAC,CAAC;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8DAA8D;SACtE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import { getCredentials, isTokenExpired, Credentials } from './credentials.js';\nimport { logInfo } from '../utils/debug.js';\n\nexport interface TokenValidationResult {\n  success: boolean;\n  credentials?: Credentials;\n  error?: string;\n}\n\n/**\n * Check if the current token is valid.\n * If expired, returns an error prompting re-authentication.\n * No refresh is attempted - refresh tokens are not stored for security.\n */\nexport async function ensureValidToken(): Promise<TokenValidationResult> {\n  const creds = getCredentials();\n\n  if (!creds) {\n    logInfo('[ensureValidToken] No credentials found');\n    return { success: false, error: 'Not authenticated' };\n  }\n\n  logInfo(`[ensureValidToken] Token expiresAt: ${new Date(creds.expiresAt).toISOString()}`);\n  logInfo(`[ensureValidToken] Current time: ${new Date().toISOString()}`);\n\n  if (isTokenExpired(creds)) {\n    logInfo('[ensureValidToken] Token expired, re-authentication required');\n    return {\n      success: false,\n      error: 'Session expired. Run `workos auth login` to re-authenticate.',\n    };\n  }\n\n  logInfo('[ensureValidToken] Token valid');\n  return { success: true, credentials: creds };\n}\n"]}

package/dist/lib/version-check.js

@@ -28,7 +28,8 @@ export async function checkForUpdates() {
         if (lt(currentVersion, latestVersion)) {
             hasWarned = true;
             yellow(`Update available: ${currentVersion} → ${latestVersion}`);
-            dim(`Run: npx workos@latest`);
+            dim('Run: npx workos@latest');
+            console.log();
         }
     }
     catch {

package/dist/lib/version-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../../src/lib/version-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AACpE,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,IAAI,SAAS,GAAG,KAAK,CAAC;AAMtB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,SAAS;QAAE,OAAO;IAEtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO;QAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;QACnC,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;QAEpC,0CAA0C;QAC1C,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO;QAE5D,gCAAgC;QAChC,IAAI,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;YACtC,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,qBAAqB,cAAc,MAAM,aAAa,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC","sourcesContent":["import { lt, valid } from 'semver';\nimport { yellow, dim } from '../utils/logging.js';\nimport { getVersion } from './settings.js';\n\nconst NPM_REGISTRY_URL = 'https://registry.npmjs.org/workos/latest';\nconst TIMEOUT_MS = 500;\n\nlet hasWarned = false;\n\ninterface NpmPackageInfo {\n  version: string;\n}\n\n/**\n * Check npm registry for latest version and warn if outdated.\n * Runs asynchronously, fails silently on any error.\n * Safe to call without awaiting (fire-and-forget).\n */\nexport async function checkForUpdates(): Promise<void> {\n  if (hasWarned) return;\n\n  try {\n    const response = await fetch(NPM_REGISTRY_URL, {\n      signal: AbortSignal.timeout(TIMEOUT_MS),\n    });\n\n    if (!response.ok) return;\n\n    const data = (await response.json()) as NpmPackageInfo;\n    const latestVersion = data.version;\n    const currentVersion = getVersion();\n\n    // Validate both versions are valid semver\n    if (!valid(latestVersion) || !valid(currentVersion)) return;\n\n    // Only warn if current < latest\n    if (lt(currentVersion, latestVersion)) {\n      hasWarned = true;\n      yellow(`Update available: ${currentVersion} → ${latestVersion}`);\n      dim(`Run: npx workos@latest`);\n    }\n  } catch {\n    // Silently ignore all errors (timeout, network, parse, etc.)\n  }\n}\n\n/**\n * Reset warning state (for testing).\n * @internal\n */\nexport function _resetWarningState(): void {\n  hasWarned = false;\n}\n"]}
+{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../../src/lib/version-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AACpE,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,IAAI,SAAS,GAAG,KAAK,CAAC;AAMtB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,SAAS;QAAE,OAAO;IAEtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO;QAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;QACnC,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;QAEpC,0CAA0C;QAC1C,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO;QAE5D,gCAAgC;QAChC,IAAI,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;YACtC,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,qBAAqB,cAAc,MAAM,aAAa,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC","sourcesContent":["import { lt, valid } from 'semver';\nimport { yellow, dim } from '../utils/logging.js';\nimport { getVersion } from './settings.js';\n\nconst NPM_REGISTRY_URL = 'https://registry.npmjs.org/workos/latest';\nconst TIMEOUT_MS = 500;\n\nlet hasWarned = false;\n\ninterface NpmPackageInfo {\n  version: string;\n}\n\n/**\n * Check npm registry for latest version and warn if outdated.\n * Runs asynchronously, fails silently on any error.\n * Safe to call without awaiting (fire-and-forget).\n */\nexport async function checkForUpdates(): Promise<void> {\n  if (hasWarned) return;\n\n  try {\n    const response = await fetch(NPM_REGISTRY_URL, {\n      signal: AbortSignal.timeout(TIMEOUT_MS),\n    });\n\n    if (!response.ok) return;\n\n    const data = (await response.json()) as NpmPackageInfo;\n    const latestVersion = data.version;\n    const currentVersion = getVersion();\n\n    // Validate both versions are valid semver\n    if (!valid(latestVersion) || !valid(currentVersion)) return;\n\n    // Only warn if current < latest\n    if (lt(currentVersion, latestVersion)) {\n      hasWarned = true;\n      yellow(`Update available: ${currentVersion} → ${latestVersion}`);\n      dim('Run: npx workos@latest');\n      console.log();\n    }\n  } catch {\n    // Silently ignore all errors (timeout, network, parse, etc.)\n  }\n}\n\n/**\n * Reset warning state (for testing).\n * @internal\n */\nexport function _resetWarningState(): void {\n  hasWarned = false;\n}\n"]}

package/dist/utils/exit-codes.js

@@ -24,7 +24,7 @@ export function exitWithCode(code, error) {
 export function exitWithAuthRequired(message) {
     exitWithCode(ExitCode.AUTH_REQUIRED, {
         code: 'auth_required',
-        message: message ?? 'Not authenticated. Run `workos login` in an interactive terminal, or set WORKOS_API_KEY.',
+        message: message ?? 'Not authenticated. Run `workos auth login` in an interactive terminal, or set WORKOS_API_KEY.',
     });
 }
 //# sourceMappingURL=exit-codes.js.map

package/dist/utils/exit-codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"exit-codes.js","sourceRoot":"","sources":["../../src/utils/exit-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,OAAO,EAAE,CAAC;IACV,aAAa,EAAE,CAAC;IAChB,SAAS,EAAE,CAAC;IACZ,aAAa,EAAE,CAAC;CACR,CAAC;AAIX,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,IAAmB,EAAE,KAAyC;IACzF,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,YAAY,CAAC,QAAQ,CAAC,aAAa,EAAE;QACnC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,OAAO,IAAI,0FAA0F;KAC/G,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Standardized exit codes following gh CLI convention.\n *\n * 0 = Success\n * 1 = General error\n * 2 = Cancelled (e.g., Ctrl+C, user cancelled prompt)\n * 4 = Authentication required\n */\n\nimport { outputError } from './output.js';\n\nexport const ExitCode = {\n  SUCCESS: 0,\n  GENERAL_ERROR: 1,\n  CANCELLED: 2,\n  AUTH_REQUIRED: 4,\n} as const;\n\nexport type ExitCodeValue = (typeof ExitCode)[keyof typeof ExitCode];\n\n/** Exit with a specific code, optionally writing a structured error first. */\nexport function exitWithCode(code: ExitCodeValue, error?: { code: string; message: string }): never {\n  if (error) {\n    outputError(error);\n  }\n  process.exit(code);\n}\n\n/** Convenience: exit with code 4 and auth-required error. */\nexport function exitWithAuthRequired(message?: string): never {\n  exitWithCode(ExitCode.AUTH_REQUIRED, {\n    code: 'auth_required',\n    message: message ?? 'Not authenticated. Run `workos login` in an interactive terminal, or set WORKOS_API_KEY.',\n  });\n}\n"]}
+{"version":3,"file":"exit-codes.js","sourceRoot":"","sources":["../../src/utils/exit-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,OAAO,EAAE,CAAC;IACV,aAAa,EAAE,CAAC;IAChB,SAAS,EAAE,CAAC;IACZ,aAAa,EAAE,CAAC;CACR,CAAC;AAIX,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,IAAmB,EAAE,KAAyC;IACzF,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,YAAY,CAAC,QAAQ,CAAC,aAAa,EAAE;QACnC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,OAAO,IAAI,+FAA+F;KACpH,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Standardized exit codes following gh CLI convention.\n *\n * 0 = Success\n * 1 = General error\n * 2 = Cancelled (e.g., Ctrl+C, user cancelled prompt)\n * 4 = Authentication required\n */\n\nimport { outputError } from './output.js';\n\nexport const ExitCode = {\n  SUCCESS: 0,\n  GENERAL_ERROR: 1,\n  CANCELLED: 2,\n  AUTH_REQUIRED: 4,\n} as const;\n\nexport type ExitCodeValue = (typeof ExitCode)[keyof typeof ExitCode];\n\n/** Exit with a specific code, optionally writing a structured error first. */\nexport function exitWithCode(code: ExitCodeValue, error?: { code: string; message: string }): never {\n  if (error) {\n    outputError(error);\n  }\n  process.exit(code);\n}\n\n/** Convenience: exit with code 4 and auth-required error. */\nexport function exitWithAuthRequired(message?: string): never {\n  exitWithCode(ExitCode.AUTH_REQUIRED, {\n    code: 'auth_required',\n    message: message ?? 'Not authenticated. Run `workos auth login` in an interactive terminal, or set WORKOS_API_KEY.',\n  });\n}\n"]}