Skip to content
This repository was archived by the owner on Jun 14, 2026. It is now read-only.

Commit e60bc8f

Browse files
ozturkberkayozturkberkay
committed
Use CIMD instead of DCR
1 parent 3f8114c commit e60bc8f

81 files changed

Lines changed: 5746 additions & 282 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/validate-changes/SKILL.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ name: validate-changes
33
description: You **must** use this when finalizing your work to validate your changes before code review.
44
---
55

6-
On a successful run, go over this checklist one by one and make sure each item
7-
is satisfied:
6+
Go over this checklist one by one and make sure each item is satisfied:
87

8+
- [ ] Ensure the implementation follows the design document. For each divergence
9+
you see, ask to update the design document or to fix the implementation.
910
- [ ] If local development environment changes were made, relevant files like
1011
`README.md`, `includes.sh`, and `Brewfile` are updated.
1112
- [ ] Files to ignore are added to `.gitignore`.

‎.agents/skills/workos/SKILL.md‎

Lines changed: 284 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,284 @@
1+
---
2+
name: workos
3+
description: Use when the user is implementing, debugging, or asking about WorkOS in any way — authentication, login, sign-up, sessions, access tokens, organization-scoped tokens, device authorization, SSO, SAML, SCIM, Directory Sync, RBAC, roles, permissions, FGA, MFA, Vault, Audit Logs, Admin Portal, webhooks, events, user management, email, custom domains, AuthKit (any framework), backend SDKs, migrations from Auth0/Clerk/Cognito/Firebase/Supabase/Stytch, or WorkOS API references. Routes to the right reference and gotchas.
4+
---
5+
6+
# WorkOS Skill Router
7+
8+
## How to Use
9+
10+
When a user needs help with WorkOS, consult the tables below to route to the right reference.
11+
12+
## Loading References
13+
14+
**All references** are topic files in the `references/` directory. Read the file and follow its instructions (fetch docs first, then use gotchas to avoid common traps).
15+
16+
**Exception**: Widget requests use the `workos-widgets` skill via the Skill tool — it has its own multi-framework orchestration.
17+
18+
## Topic → Reference Map
19+
20+
### AuthKit Installation (Read `references/{name}.md`)
21+
22+
| User wants to... | Read file |
23+
| ----------------------------------- | --------------------------------------------- |
24+
| Install AuthKit in Next.js | `references/workos-authkit-nextjs.md` |
25+
| Install AuthKit in React SPA | `references/workos-authkit-react.md` |
26+
| Install AuthKit with React Router | `references/workos-authkit-react-router.md` |
27+
| Install AuthKit with TanStack Start | `references/workos-authkit-tanstack-start.md` |
28+
| Install AuthKit with SvelteKit | `references/workos-authkit-sveltekit.md` |
29+
| Install AuthKit in vanilla JS | `references/workos-authkit-vanilla-js.md` |
30+
| AuthKit architecture reference | `references/workos-authkit-base.md` |
31+
| Add WorkOS Widgets | Load `workos-widgets` skill via Skill tool |
32+
33+
### Backend SDK Installation (Read `references/{name}.md`)
34+
35+
| User wants to... | Read file |
36+
| ---------------------------------- | ---------------------------------- |
37+
| Install AuthKit in Node.js backend | `references/workos-node.md` |
38+
| Install AuthKit in Python | `references/workos-python.md` |
39+
| Install AuthKit in .NET | `references/workos-dotnet.md` |
40+
| Install AuthKit in Go | `references/workos-go.md` |
41+
| Install AuthKit in Ruby | `references/workos-ruby.md` |
42+
| Install AuthKit in PHP | `references/workos-php.md` |
43+
| Install AuthKit in PHP Laravel | `references/workos-php-laravel.md` |
44+
| Install AuthKit in Kotlin | `references/workos-kotlin.md` |
45+
| Install AuthKit in Elixir | `references/workos-elixir.md` |
46+
47+
### Features (Read `references/{name}.md`)
48+
49+
| User wants to... | Read file |
50+
| ------------------------------- | ------------------------------------- |
51+
| Configure Single Sign-On | `references/workos-sso.md` |
52+
| Set up Directory Sync | `references/workos-directory-sync.md` |
53+
| Implement RBAC / roles | `references/workos-rbac.md` |
54+
| Encrypt data with Vault | `references/workos-vault.md` |
55+
| Handle WorkOS Events / webhooks | `references/workos-events.md` |
56+
| Set up Audit Logs | `references/workos-audit-logs.md` |
57+
| Enable Admin Portal | `references/workos-admin-portal.md` |
58+
| Add Multi-Factor Auth | `references/workos-mfa.md` |
59+
| Configure email delivery | `references/workos-email.md` |
60+
| Set up Custom Domains | `references/workos-custom-domains.md` |
61+
| Set up IdP integration | `references/workos-integrations.md` |
62+
63+
### API References (Read `references/{name}.md`)
64+
65+
Feature topic files above include endpoint tables for their respective APIs. Use these API-only references when no feature topic exists:
66+
67+
| User wants to... | Read file |
68+
| -------------------------- | --------------------------------------- |
69+
| AuthKit API Reference | `references/workos-api-authkit.md` |
70+
| Organization API Reference | `references/workos-api-organization.md` |
71+
72+
### Migrations (Read `references/{name}.md`)
73+
74+
| User wants to... | Read file |
75+
| ----------------------------------- | ----------------------------------------------------- |
76+
| Migrate from Auth0 | `references/workos-migrate-auth0.md` |
77+
| Migrate from AWS Cognito | `references/workos-migrate-aws-cognito.md` |
78+
| Migrate from Better Auth | `references/workos-migrate-better-auth.md` |
79+
| Migrate from Clerk | `references/workos-migrate-clerk.md` |
80+
| Migrate from Descope | `references/workos-migrate-descope.md` |
81+
| Migrate from Firebase | `references/workos-migrate-firebase.md` |
82+
| Migrate from Stytch | `references/workos-migrate-stytch.md` |
83+
| Migrate from Supabase Auth | `references/workos-migrate-supabase-auth.md` |
84+
| Migrate from the standalone SSO API | `references/workos-migrate-the-standalone-sso-api.md` |
85+
| Migrate from other services | `references/workos-migrate-other-services.md` |
86+
87+
### Management (Read `references/{name}.md`)
88+
89+
| User wants to... | Read file |
90+
| ---------------------------------------- | --------------------------------- |
91+
| Manage WorkOS resources via CLI commands | `references/workos-management.md` |
92+
93+
## Routing Decision Tree
94+
95+
Apply these rules in order. First match wins.
96+
97+
### 1. Migration Context
98+
99+
**Triggers**: User mentions migrating FROM another provider (Auth0, Clerk, Cognito, Firebase, Supabase, Stytch, Descope, Better Auth, standalone SSO API).
100+
101+
**Action**: Read `references/workos-migrate-[provider].md` where `[provider]` matches the source system. If provider is not in the table, read `references/workos-migrate-other-services.md`.
102+
103+
**Why this wins**: Migration context overrides feature-specific routing because users need provider-specific data export and transformation steps.
104+
105+
---
106+
107+
### 2. API Reference Request
108+
109+
**Triggers**: User explicitly asks about "API endpoints", "request format", "response schema", "API reference", or mentions inspecting HTTP details.
110+
111+
**Action**: For features with topic files (SSO, Directory Sync, RBAC, Vault, Events, Audit Logs, Admin Portal), read the feature topic file — it includes an endpoint table. For AuthKit or Organization APIs, read `references/workos-api-[domain].md`.
112+
113+
**Why this wins**: API references are low-level; feature topics are high-level but include endpoint tables for quick reference.
114+
115+
---
116+
117+
### 3. Feature-Specific Request
118+
119+
**Triggers**: User mentions a specific WorkOS feature by name (SSO, MFA, Directory Sync, Audit Logs, Vault, RBAC, Admin Portal, Custom Domains, Events, Integrations, Email).
120+
121+
**Action**: Read `references/workos-[feature].md` where `[feature]` is the lowercase slug (sso, mfa, directory-sync, audit-logs, vault, rbac, admin-portal, custom-domains, events, integrations, email).
122+
123+
**Exception**: Widget requests load the `workos-widgets` skill via the Skill tool — it has its own orchestration.
124+
125+
**Disambiguation**: If user mentions BOTH a feature and "API", route to the feature topic file (it includes endpoints). If they mention MULTIPLE features, route to the MOST SPECIFIC one first (e.g., "SSO with MFA" → route to SSO; user can request MFA separately).
126+
127+
---
128+
129+
### 4. AuthKit Installation
130+
131+
**Triggers**: User mentions authentication setup, login flow, sign-up, session management, or explicitly says "AuthKit" WITHOUT mentioning a specific feature like SSO or MFA.
132+
133+
**Action**: Detect framework and language using the priority-ordered checks below. Read the corresponding reference file.
134+
135+
**Disambiguation**:
136+
137+
- If user says "SSO login via AuthKit", route to `workos-sso` (#3) — feature wins over framework.
138+
- If user says "React login with Google", route to AuthKit React (#4) — this is AuthKit-level auth, not SSO API.
139+
- If user is ALREADY using AuthKit and wants to add a feature (e.g., "add MFA to my AuthKit app"), route to the feature reference (#3), not back to AuthKit installation.
140+
141+
#### Framework Detection Priority (AuthKit only)
142+
143+
Check in this exact order. First match wins:
144+
145+
```
146+
1. `@tanstack/start` in package.json dependencies
147+
→ Read: references/workos-authkit-tanstack-start.md
148+
149+
2. `@sveltejs/kit` in package.json dependencies
150+
→ Read: references/workos-authkit-sveltekit.md
151+
152+
3. `react-router` or `react-router-dom` in package.json dependencies
153+
→ Read: references/workos-authkit-react-router.md
154+
155+
4. `next.config.js` OR `next.config.mjs` OR `next.config.ts` exists in project root
156+
→ Read: references/workos-authkit-nextjs.md
157+
158+
5. (`vite.config.js` OR `vite.config.ts` exists) AND `react` in package.json dependencies
159+
→ Read: references/workos-authkit-react.md
160+
161+
6. NONE of the above detected
162+
→ Read: references/workos-authkit-vanilla-js.md
163+
```
164+
165+
#### Language Detection (Backend SDKs)
166+
167+
If the project is NOT a JavaScript/TypeScript frontend framework, check:
168+
169+
```
170+
1. `pyproject.toml` OR `requirements.txt` OR `setup.py` exists
171+
→ Read: references/workos-python.md
172+
173+
2. `go.mod` exists
174+
→ Read: references/workos-go.md
175+
176+
3. `Gemfile` exists OR `config/routes.rb` exists
177+
→ Read: references/workos-ruby.md
178+
179+
4. `composer.json` exists AND `laravel/framework` in dependencies
180+
→ Read: references/workos-php-laravel.md
181+
182+
5. `composer.json` exists (without Laravel)
183+
→ Read: references/workos-php.md
184+
185+
6. `*.csproj` OR `*.sln` exists
186+
→ Read: references/workos-dotnet.md
187+
188+
7. `build.gradle.kts` OR `build.gradle` exists
189+
→ Read: references/workos-kotlin.md
190+
191+
8. `mix.exs` exists
192+
→ Read: references/workos-elixir.md
193+
194+
9. `package.json` exists with `express` / `fastify` / `hono` / `koa` (backend JS)
195+
→ Read: references/workos-node.md
196+
```
197+
198+
**Why this order**: TanStack, SvelteKit, and React Router are MORE specific than Next.js/Vite+React. A project can have both Next.js AND React Router; in that case, React Router wins because it's more specific. Vanilla JS is the fallback when no framework is detected. Backend languages are checked when no frontend framework is found.
199+
200+
**Edge case — multiple frameworks detected**: If you detect conflicting signals (e.g., both `next.config.js` and `@tanstack/start`), ASK the user which one they want to use. Do NOT guess.
201+
202+
**Edge case — framework unclear from context**: If the user says "add login" but you cannot scan files (remote repo, no access), ASK: "Which framework/language are you using?" Do NOT default without confirmation.
203+
204+
---
205+
206+
### 5. Integration Setup
207+
208+
**Triggers**: User mentions connecting to external IdPs, configuring third-party integrations, or asks "how do I integrate with [provider]".
209+
210+
**Action**: Read `references/workos-integrations.md`.
211+
212+
**Why separate from SSO**: SSO covers the authentication flow; Integrations covers IdP configuration and connection setup. If user mentions BOTH ("set up Google SSO"), route to SSO (#3) — it will reference Integrations where needed.
213+
214+
---
215+
216+
### 6. Management / CLI Operations
217+
218+
**Triggers**: User mentions managing WorkOS resources (organizations, users, roles, permissions), seeding data, or CLI management commands.
219+
220+
**Action**: Read `references/workos-management.md`.
221+
222+
---
223+
224+
### 7. Vague or General Request
225+
226+
**Triggers**: User says "help with WorkOS", "WorkOS setup", "what can WorkOS do", or provides no feature-specific context.
227+
228+
**Action**:
229+
230+
1. WebFetch https://workos.com/docs/llms.txt
231+
2. Scan the index for the section that best matches the user's likely intent
232+
3. WebFetch the specific section URL
233+
4. Summarize capabilities and ASK the user what they want to accomplish
234+
235+
**Do NOT guess a feature** — force disambiguation by showing options.
236+
237+
---
238+
239+
### 8. No Match / Ambiguous
240+
241+
**Triggers**: None of the above rules match, OR the request is genuinely ambiguous.
242+
243+
**Action**:
244+
245+
1. WebFetch https://workos.com/docs/llms.txt
246+
2. Search the index for keywords from the user's request
247+
3. If you find a match, WebFetch that section URL and proceed
248+
4. If NO match, respond: "I couldn't find a WorkOS feature matching '[user's term]'. Could you clarify? For example: authentication, SSO, MFA, directory sync, audit logs, etc."
249+
250+
---
251+
252+
## Edge Cases
253+
254+
### User mentions multiple features
255+
256+
Route to the MOST SPECIFIC reference first. Example: "SSO with MFA and directory sync" → route to `workos-sso` first. After completing SSO setup, the user can request MFA and Directory Sync separately.
257+
258+
### User mentions a feature + API reference
259+
260+
Route to the feature topic file — it includes an endpoint table. Example: "SSO API endpoints" → `workos-sso.md`.
261+
262+
### User wants to ADD a feature to an existing AuthKit setup
263+
264+
Route to the feature reference (#3), not back to AuthKit installation. Example: "I'm using AuthKit in Next.js and want to add SSO" → `workos-sso.md`.
265+
266+
### User mentions a provider but no feature
267+
268+
Route to Integrations (#5). Example: "How do I connect Okta?" → `workos-integrations.md`.
269+
270+
### User mentions a provider AND a feature
271+
272+
Route to the feature reference (#3). Example: "Set up Okta SSO" → `workos-sso.md` (it will reference Integrations for Okta setup).
273+
274+
### Unknown framework for AuthKit
275+
276+
If you cannot detect framework and the user hasn't specified, ASK: "Which framework/language are you using?" Do NOT default without confirmation.
277+
278+
### Framework conflicts (multiple frameworks detected)
279+
280+
If detection finds conflicting signals (e.g., both Next.js and TanStack Start configs), ASK: "I see both [framework A] and [framework B]. Which one do you want to use for AuthKit?"
281+
282+
### User provides no context at all
283+
284+
Follow step #7 (Vague or General Request): fetch llms.txt, show options, and force disambiguation.

‎.agents/skills/workos/references/workos-admin-portal.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# WorkOS Admin Portal
2+
3+
## Docs
4+
5+
- https://workos.com/docs/admin-portal/index
6+
- https://workos.com/docs/admin-portal/example-apps
7+
- https://workos.com/docs/admin-portal/custom-branding
8+
- https://workos.com/docs/reference/admin-portal
9+
- https://workos.com/docs/reference/admin-portal/portal-link
10+
- https://workos.com/docs/reference/admin-portal/portal-link/generate
11+
- https://workos.com/docs/reference/admin-portal/provider-icons
12+
If this file conflicts with fetched docs, follow the docs.
13+
14+
## Gotchas
15+
16+
- Portal links are single-use and time-limited. Visiting an expired or already-used link returns 404. Must generate a new link each time.
17+
- Do NOT email portal links directly from your backend. Links are exposed in email logs. Instead, store the link and have your app's settings page redirect to it.
18+
- The `intent` parameter determines which configuration screens appear. It cannot be changed after link generation — must generate a new link for a different intent.
19+
- Only one active portal link exists per organization at a time. Revoke the old one before generating a new one.
20+
- Domain verification may be required before SSO activation. Some configurations need DNS TXT records or email verification first.
21+
- API key must start with `sk_` (secret key). Using `pk_` (publishable key) returns "Unauthorized."
22+
23+
## Endpoints
24+
25+
| Endpoint | Description |
26+
| ----------------------- | ------------------------------------- |
27+
| `/admin-portal` | admin-portal |
28+
| `/portal-link` | admin-portal - portal-link |
29+
| `/portal-link/generate` | admin-portal - portal-link - generate |
30+
| `/provider-icons` | admin-portal - provider-icons |

0 commit comments

Comments
 (0)