@userreason/wizard 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,51 @@
-# Temporary Holding Version
+# @userreason/wizard
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Authenticated installation for UserReason. It shares the CLI client and credentials, uses the same onboarding endpoints, and generates integrations for React, Next.js, Vue and plain browser applications. This package is prepared for publication; no npm publication occurs during its build.
+
+Build the local CLI first, then the wizard:
+
+```sh
+cd ../ur-cli && npm ci && npm run build
+cd ../ur-wizard && npm ci && npm run typecheck && npm test
+node dist/bin.js --help
+```
+
+The wizard bundles the CLI client at build time. Its published runtime does not depend on the private `ur-types` package or a local file reference; its only runtime dependency is the OS credential-store binding.
+
+After publication:
+
+```sh
+npx -y @userreason/wizard@latest
+```
+
+It discovers the public WorkOS client ID from the configured API, reads the selected project's `package.json`, detects its framework/package manager, reuses an existing OS-stored login or starts public WorkOS device authentication, and selects or creates a workspace and site. `--client-id` remains available for explicit configuration. Only when the operation lacks an effective grant does it ask the human to approve installation permissions. A previously approved client can continue unattended until its grant expires or is revoked. Fresh clients may choose an existing workspace in the browser approval screen even before they have permission to list its name.
+
+```sh
+npx -y @userreason/wizard@latest \
+  --directory ./app \
+  --workspace WORKSPACE_UUID \
+  --site SITE_UUID \
+  --origin https://app.example.com \
+  --install \
+  --yes \
+  --json
+```
+
+For new resources, use `--workspace-name` and `--site-name` instead of their UUID flags. `--dev` selects the development API, development WorkOS client configuration and default site environment. `--environment` can select the site's environment independently of the API deployment. Production sites require HTTPS origins.
+
+`--install` installs `@userreason/js@^0.2.0` with the detected package manager and dependency scripts disabled. This requires that the remote-compatible SDK has been published first. `--skip-install` prepares the integration without changing dependencies; ensure your existing SDK supports `init({workspaceId, siteId, apiBaseUrl})`. SDK 0.1.x's local-survey API cannot connect to the Worker's remote campaign protocol.
+
+Generated files:
+
+- `userreason.config.json`: public workspace/site/API configuration and required SDK version.
+- `src/userreason.generated.tsx` for React/Next.js, or `src/userreason.generated.ts` for Vue/vanilla; written at the project root when there is no `src` directory.
+
+The generated React/Next component, Vue composable or vanilla initializer must be mounted/called once at the application root. The wizard prints the framework-specific instruction and includes lifecycle cleanup. It leaves existing application source unchanged so the integration can be reviewed. Files are reused if identical; changed files require `--force`, which creates a backup before replacement. Symlinked source directories are refused.
+
+React/Next initialization uses a browser layout effect with an SSR-safe fallback, so ordinary descendant `useEffect` calls can report their first event after initialization. Cleanup and reinitialization also run correctly during React Strict Mode's development remount. Descendant layout effects can run earlier: move their event reports to a passive effect or initialize UserReason through a controlled browser entry before rendering that tree. Vue initializes in the root `onBeforeMount`, ahead of descendant mount hooks; call the composable in the root setup before creating descendants. Neither framework starts the SDK during server rendering. Remote configuration still loads asynchronously: await `UserReason.ready()` when an event must wait for its targeting configuration. See [React layout effects](https://react.dev/reference/react/useLayoutEffect) and [Vue lifecycle hooks](https://vuejs.org/api/composition-api-lifecycle.html#onbeforemount).
+
+The wizard checks the public SDK configuration endpoint using the exact allowed host origin. Its result explicitly reports `hostConnectionVerified:false`: configuration availability is not proof of a real browser connection. Start the host application, mount the generated integration, and verify its config/session flow from that origin. No campaign is published merely by installing the SDK.
+
+Only public SDK configuration is written into the project. Login tokens remain in macOS Keychain, Windows Credential Manager or Linux Secret Service. WorkOS API keys and UserReason signing keys are never required by the wizard.
+
+Local tests use temporary projects and HTTP fixtures. Live login, grant approval, npm installation and host-origin operation require the configured WorkOS environment, migrations and deployed onboarding Worker.

package/dist/bin.js

@@ -0,0 +1,733 @@
+#!/usr/bin/env node
+
+// src/bin.ts
+import { parseArgs } from "node:util";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { createInterface } from "node:readline/promises";
+
+// ../ur-cli/dist/client.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// ../ur-cli/dist/contracts.js
+function object(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`Invalid ${label} response`);
+  return value;
+}
+function string(value, label) {
+  if (typeof value !== "string" || value.length === 0)
+    throw new Error(`Invalid ${label}`);
+  return value;
+}
+function uuid(value, label = "ID") {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value))
+    throw new Error(`${label} must be a UUID`);
+  return value;
+}
+function apiUrl(value) {
+  const url = new URL(value);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/")
+    throw new Error("API URL must be an origin without credentials, query or path");
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+    throw new Error("API URL must use HTTPS; loopback HTTP is allowed for local development");
+  return url.origin;
+}
+function origin(value, environment) {
+  const normalized = apiUrl(value);
+  if (environment === "production" && !normalized.startsWith("https://"))
+    throw new Error("Production sites require HTTPS origins");
+  return normalized;
+}
+function workspace(value) {
+  const data = object(value, "workspace");
+  return { ...data, id: uuid(string(data.id, "workspace ID")), name: string(data.name, "workspace name") };
+}
+function site(value) {
+  const data = object(value, "site");
+  if (data.environment !== "development" && data.environment !== "production")
+    throw new Error("Invalid site environment");
+  if (!Array.isArray(data.allowed_origins) || !data.allowed_origins.every((item) => typeof item === "string"))
+    throw new Error("Invalid site origins");
+  return { ...data, id: uuid(string(data.id ?? data.site_id, "site ID")), workspace_id: uuid(string(data.workspace_id, "workspace ID")), name: string(data.name, "site name") };
+}
+function grantRequest(value) {
+  const data = object(value, "grant request");
+  if (!["pending", "approved", "rejected", "denied", "expired"].includes(String(data.status)))
+    throw new Error("Invalid grant request status");
+  if (data.approval_url !== void 0) {
+    const url = new URL(string(data.approval_url, "approval URL"));
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+      throw new Error("Invalid grant approval URL");
+  }
+  return { ...data, id: uuid(string(data.id, "grant request ID")) };
+}
+
+// ../ur-cli/dist/workos.js
+var AuthenticationError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+var sleep = (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds));
+var endpoint = "https://api.workos.com/user_management";
+function session(data, config) {
+  const user = object(data.user, "authenticated user");
+  if (user.email_verified !== true)
+    throw new AuthenticationError("email_unverified", "Complete email verification before continuing");
+  const accessToken = string(data.access_token, "access token");
+  let expiresAt = Date.now() + 12e4;
+  try {
+    const payload = object(JSON.parse(Buffer.from(accessToken.split(".")[1], "base64url").toString()), "token payload");
+    if (typeof payload.exp === "number" && Number.isFinite(payload.exp))
+      expiresAt = payload.exp * 1e3;
+  } catch {
+  }
+  return { accessToken, refreshToken: string(data.refresh_token, "refresh token"), expiresAt, userId: string(user.id, "user ID"), email: string(user.email, "email"), ...config };
+}
+async function post(path, body, fetcher, signal = AbortSignal.timeout(2e4)) {
+  const response = await fetcher(`${endpoint}/${path}`, { method: "POST", redirect: "error", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(body), signal });
+  const data = object(await response.json(), "authentication");
+  return { response, data };
+}
+async function login(config, credentials, onDevice, options = {}) {
+  const fetcher = options.fetcher ?? fetch, wait = options.sleep ?? sleep, now = options.now ?? Date.now;
+  const authorization = await post("authorize/device", { client_id: config.clientId }, fetcher);
+  if (!authorization.response.ok)
+    throw new AuthenticationError("device_authorization_failed", `Unable to start WorkOS login (${authorization.response.status})`);
+  const data = authorization.data;
+  const expiresIn = Number(data.expires_in), initialInterval = Number(data.interval);
+  if (!Number.isFinite(expiresIn) || expiresIn <= 0 || expiresIn > 1800 || !Number.isFinite(initialInterval) || initialInterval < 1 || initialInterval > 60)
+    throw new Error("Invalid device authorization timing");
+  const deviceCode = string(data.device_code, "device authorization code");
+  const verificationUri = string(data.verification_uri, "verification URL"), verificationUriComplete = string(data.verification_uri_complete, "complete verification URL");
+  for (const uri of [verificationUri, verificationUriComplete]) {
+    const url = new URL(uri);
+    if (url.protocol !== "https:" || url.username || url.password)
+      throw new Error("WorkOS returned an invalid verification URL");
+  }
+  await onDevice({ userCode: string(data.user_code, "user authorization code"), verificationUri, verificationUriComplete, expiresIn });
+  let interval = initialInterval;
+  const deadline = now() + expiresIn * 1e3;
+  while (now() < deadline) {
+    await wait(interval * 1e3);
+    if (now() >= deadline)
+      break;
+    let result;
+    try {
+      result = await post("authenticate", { grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: deviceCode, client_id: config.clientId }, fetcher, AbortSignal.timeout(Math.min(2e4, deadline - now())));
+    } catch {
+      interval = Math.min(interval * 2, 30);
+      continue;
+    }
+    if (result.response.ok) {
+      const authenticated = session(result.data, config);
+      await credentials.save(authenticated);
+      return authenticated;
+    }
+    const code = result.data.error ?? result.data.code;
+    if (code === "authorization_pending")
+      continue;
+    if (code === "slow_down") {
+      interval += 5;
+      continue;
+    }
+    if (result.response.status >= 500 || result.response.status === 429) {
+      interval = Math.min(interval * 2, 30);
+      continue;
+    }
+    if (code === "access_denied")
+      throw new AuthenticationError("access_denied", "Login was declined");
+    if (code === "expired_token")
+      break;
+    throw new AuthenticationError("authorization_failed", `WorkOS authorization failed (${result.response.status})`);
+  }
+  throw new AuthenticationError("expired_token", "The login code expired; run login again");
+}
+async function refresh(config, credentials, current, fetcher = fetch) {
+  const result = await post("authenticate", { grant_type: "refresh_token", refresh_token: current.refreshToken, client_id: config.clientId }, fetcher);
+  if (!result.response.ok) {
+    if (result.data.error === "invalid_grant" || result.data.code === "invalid_grant") {
+      await credentials.clear();
+      throw new AuthenticationError("invalid_grant", "Your session expired or was revoked; run userreason login again");
+    }
+    throw new AuthenticationError("refresh_failed", `Unable to refresh your session (${result.response.status}); the stored session was retained`);
+  }
+  const updated = session(result.data, config);
+  await credentials.save(updated);
+  return updated;
+}
+
+// ../ur-cli/dist/lock.js
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir as mkdir2, open, readFile as readFile2, unlink } from "node:fs/promises";
+import { join as join2 } from "node:path";
+
+// ../ur-cli/dist/config.js
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+var configDirectory = () => join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "userreason");
+async function discoverAuthConfig(url, development = false, fetcher = fetch) {
+  let response;
+  try {
+    response = await fetcher(`${apiUrl(url)}/onboarding/v1/auth-config`, { headers: { Accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(1e4) });
+  } catch {
+    throw new Error("Unable to discover UserReason authentication configuration. Check the API deployment or supply its public --client-id.");
+  }
+  if (!response.ok)
+    throw new Error(`UserReason authentication configuration is unavailable (${response.status}). Configure WorkOS in the Worker before running the wizard.`);
+  if (!response.headers.get("content-type")?.toLowerCase().startsWith("application/json") || !response.body)
+    throw new Error("Invalid UserReason authentication configuration response");
+  const reader = response.body.getReader(), chunks = [];
+  let bytes = 0;
+  try {
+    while (true) {
+      const part = await reader.read();
+      if (part.done)
+        break;
+      bytes += part.value.byteLength;
+      if (bytes > 4096) {
+        await reader.cancel();
+        throw new Error("UserReason authentication configuration response is too large");
+      }
+      chunks.push(part.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const buffer = new Uint8Array(bytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    buffer.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  let config;
+  try {
+    config = object(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer)), "authentication configuration");
+  } catch {
+    throw new Error("Invalid UserReason authentication configuration response");
+  }
+  if (Object.keys(config).some((key) => !["client_id", "authkit_domain", "environment"].includes(key)) || typeof config.client_id !== "string" || !/^client_[A-Za-z0-9]{1,230}$/.test(config.client_id) || typeof config.authkit_domain !== "string" || config.authkit_domain.length > 2048)
+    throw new Error("Invalid UserReason authentication configuration response");
+  const domain = apiUrl(config.authkit_domain);
+  if (!domain.startsWith("https://") || domain !== config.authkit_domain)
+    throw new Error("Invalid WorkOS AuthKit domain in authentication configuration");
+  if (config.environment !== "local" && config.environment !== (development ? "development" : "production"))
+    throw new Error("API authentication environment does not match the selected CLI environment; use --dev for development");
+  return config.client_id;
+}
+async function resolveConfig(options = {}) {
+  const environment = options.development ? "development" : "production";
+  let saved = {};
+  try {
+    const root = object(JSON.parse(await readFile(join(configDirectory(), "config.json"), "utf8")), "configuration");
+    saved = object(root[environment] ?? {}, "environment configuration");
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw new Error("Unable to read UserReason configuration");
+  }
+  const url = apiUrl(options.apiUrl ?? process.env.UR_API_URL ?? (typeof saved.apiUrl === "string" ? saved.apiUrl : options.development ? "https://api-dev.userreason.com" : "https://api.userreason.com"));
+  const configured = options.clientId ?? (options.development ? process.env.UR_WORKOS_DEV_CLIENT_ID : void 0) ?? process.env.UR_WORKOS_CLIENT_ID ?? (typeof saved.clientId === "string" ? saved.clientId : void 0);
+  const clientId = configured ?? await discoverAuthConfig(url, options.development);
+  if (!/^client_[A-Za-z0-9]+$/.test(clientId))
+    throw new Error("Set UR_WORKOS_CLIENT_ID or pass --client-id with the public WorkOS client ID. Never supply a WorkOS API key.");
+  return { apiUrl: url, clientId };
+}
+async function saveConfig(config, development = false) {
+  await mkdir(configDirectory(), { recursive: true, mode: 448 });
+  let existing = {};
+  try {
+    existing = object(JSON.parse(await readFile(join(configDirectory(), "config.json"), "utf8")), "configuration");
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw new Error("Unable to read UserReason configuration");
+  }
+  existing[development ? "development" : "production"] = config;
+  await writeFile(join(configDirectory(), "config.json"), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+}
+
+// ../ur-cli/dist/lock.js
+async function withSessionLock(config, operation) {
+  const directory = join2(configDirectory(), "locks");
+  await mkdir2(directory, { recursive: true, mode: 448 });
+  const path = join2(directory, createHash("sha256").update(`${config.apiUrl}
+${config.clientId}`).digest("hex") + ".lock");
+  const id = randomUUID(), deadline = Date.now() + 35e3;
+  while (true) {
+    try {
+      const file = await open(path, "wx", 384);
+      await file.writeFile(JSON.stringify({ id, createdAt: Date.now() }));
+      await file.close();
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw new Error("Unable to lock the UserReason credential store");
+      try {
+        const old = JSON.parse(await readFile2(path, "utf8"));
+        if (typeof old.createdAt === "number" && Date.now() - old.createdAt > 12e4) {
+          await unlink(path);
+          continue;
+        }
+      } catch {
+      }
+      if (Date.now() >= deadline)
+        throw new Error("Another UserReason process is refreshing credentials; try again shortly");
+      await new Promise((resolve2) => setTimeout(resolve2, 150));
+    }
+  }
+  try {
+    return await operation();
+  } finally {
+    try {
+      const own = JSON.parse(await readFile2(path, "utf8"));
+      if (own.id === id)
+        await unlink(path);
+    } catch {
+    }
+  }
+}
+
+// ../ur-cli/dist/client.js
+var ApiError = class extends Error {
+  status;
+  code;
+  approvalUrl;
+  constructor(status, code, approvalUrl) {
+    super(`UserReason request failed (${status}, ${code})${approvalUrl ? `. Approve access at ${approvalUrl}` : ""}`);
+    this.status = status;
+    this.code = code;
+    this.approvalUrl = approvalUrl;
+  }
+};
+var UserReasonClient = class {
+  config;
+  credentials;
+  options;
+  fetcher;
+  constructor(config, credentials, options = {}) {
+    this.config = config;
+    this.credentials = credentials;
+    this.options = options;
+    this.fetcher = options.fetcher ?? fetch;
+  }
+  async token(forceRefresh = false, previous) {
+    const lock = this.options.lock ?? ((operation) => withSessionLock(this.config, operation));
+    return lock(async () => {
+      const current = await this.credentials.load();
+      if (!current)
+        throw new Error("Run userreason login first");
+      if (current.apiUrl !== this.config.apiUrl || current.clientId !== this.config.clientId)
+        throw new Error("Stored login belongs to a different environment or WorkOS client");
+      if (current.expiresAt > Date.now() + 6e4 && (!forceRefresh || current.accessToken !== previous))
+        return current;
+      return refresh(this.config, this.credentials, current, this.fetcher);
+    });
+  }
+  async request(path, body) {
+    if (!path.startsWith("/onboarding/v1/") || path.includes("//") || path.includes("\\"))
+      throw new Error("Invalid UserReason API path");
+    let session2 = await this.token();
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const response = await this.fetcher(this.config.apiUrl + path, { method: body === void 0 ? "GET" : "POST", redirect: "error", headers: { Authorization: `Bearer ${session2.accessToken}`, "x-ur-client": "cli", "Content-Type": "application/json" }, ...body === void 0 ? {} : { body: JSON.stringify(body) }, signal: AbortSignal.timeout(2e4) });
+      if (response.status === 401 && attempt === 0) {
+        session2 = await this.token(true, session2.accessToken);
+        continue;
+      }
+      let result;
+      try {
+        result = await response.json();
+      } catch {
+        throw new ApiError(response.status, "invalid_response");
+      }
+      if (!response.ok) {
+        const data = object(result, "error"), detail = typeof data.error === "object" && data.error ? object(data.error, "error") : data;
+        const code = typeof detail.code === "string" && /^[a-z0-9_:-]{1,100}$/i.test(detail.code) ? detail.code : typeof data.error === "string" && /^[a-z0-9_:-]{1,100}$/i.test(data.error) ? data.error : "request_failed";
+        const candidate = detail.approval_url ?? data.approval_url;
+        let approvalUrl;
+        if (typeof candidate === "string") {
+          try {
+            const url = new URL(candidate);
+            if (url.protocol === "https:" && !url.username && !url.password)
+              approvalUrl = url.toString();
+          } catch {
+          }
+        }
+        throw new ApiError(response.status, code, approvalUrl);
+      }
+      return result;
+    }
+    throw new ApiError(401, "authentication_required");
+  }
+  async account() {
+    const data = object(await this.request("/onboarding/v1/account"), "account"), user = object(data.user, "user");
+    uuid(string(user.id, "user ID"));
+    if (!Array.isArray(data.workspaces) || !Array.isArray(data.grants))
+      throw new Error("Invalid account memberships");
+    return { ...data, user, workspaces: data.workspaces.map(workspace) };
+  }
+  async createWorkspace(name, options = {}) {
+    if (!name.trim() || name.length > 240)
+      throw new Error("Workspace name must contain 1\u2013240 characters");
+    const value = object(await this.request("/onboarding/v1/workspaces", { request_id: uuid(options.requestId ?? randomUUID2()), workspace_id: uuid(options.workspaceId ?? randomUUID2()), name: name.trim() }), "workspace creation");
+    return workspace(value.workspace ?? value);
+  }
+  async sites(workspaceId) {
+    const data = object(await this.request(`/onboarding/v1/workspaces/${uuid(workspaceId)}/sites`), "sites"), items = data.items ?? data.sites;
+    if (!Array.isArray(items))
+      throw new Error("Invalid site list");
+    return items.map(site);
+  }
+  async createSite(input) {
+    if (!input.name.trim() || input.name.length > 240)
+      throw new Error("Site name must contain 1\u2013240 characters");
+    const value = object(await this.request("/onboarding/v1/sites", { request_id: uuid(input.requestId ?? randomUUID2()), workspace_id: uuid(input.workspaceId), site_id: uuid(input.siteId ?? randomUUID2()), name: input.name.trim(), environment: input.environment, allowed_origins: input.origins }), "site creation");
+    return site(value.site ?? value);
+  }
+  async requestGrant(input) {
+    if (!input.scopes.length || input.scopes.length > 7)
+      throw new Error("Request at least one supported permission");
+    return grantRequest(await this.request("/onboarding/v1/grants/request", { request_id: uuid(input.requestId ?? randomUUID2()), workspace_id: input.workspaceId ? uuid(input.workspaceId) : null, site_ids: input.siteIds?.map((id) => uuid(id)) ?? null, scopes: [...new Set(input.scopes)] }));
+  }
+  async grantStatus(id) {
+    return grantRequest(await this.request(`/onboarding/v1/grants/requests/${uuid(id)}`));
+  }
+  /** The server parses the complete versioned command and derives authorization from the verified caller. */
+  async command(input) {
+    uuid(string(input.workspace_id, "workspace ID"));
+    uuid(string(input.request_id, "request ID"));
+    if (typeof input.action !== "string" || !/^[a-z]+\.[a-z]+$/.test(input.action))
+      throw new Error("Command requires a supported resource.action");
+    if (input.action === "workspace.create" || input.action === "site.create")
+      throw new Error("Use workspace create or site create for authenticated onboarding");
+    return this.request("/onboarding/v1/command", input);
+  }
+  async query(input) {
+    if (!["sites", "surveys", "campaigns", "events", "responses", "audits"].includes(input.resource))
+      throw new Error("Unsupported query resource");
+    const limit = input.limit ?? 50;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+      throw new Error("Query limit must be an integer from 1 to 100");
+    return this.request("/onboarding/v1/query", { workspace_id: uuid(input.workspaceId), ...input.siteId ? { site_id: uuid(input.siteId) } : {}, resource: input.resource, limit, ...input.after ? { after: uuid(input.after) } : {} });
+  }
+  async waitForGrant(id, options = {}) {
+    const deadline = Date.now() + (options.timeoutMs ?? 3e5);
+    do {
+      const request = await this.grantStatus(id);
+      options.onStatus?.(request);
+      if (request.status === "approved")
+        return request;
+      if (request.status !== "pending")
+        throw new Error(`Access request ${request.status}; request access again if needed`);
+      if (request.expires_at && Date.parse(request.expires_at) <= Date.now())
+        throw new Error("Access request expired; request access again");
+      await new Promise((resolve2) => setTimeout(resolve2, options.intervalMs ?? 2e3));
+    } while (Date.now() < deadline);
+    throw new Error("Access approval timed out; check userreason grant status --id " + id);
+  }
+};
+
+// ../ur-cli/dist/credentials.js
+import { createHash as createHash2 } from "node:crypto";
+function keychainCredentials(config) {
+  const account = createHash2("sha256").update(`${config.apiUrl}
+${config.clientId}`).digest("hex");
+  async function entry() {
+    try {
+      const { Entry } = await import("@napi-rs/keyring");
+      return new Entry("com.userreason.cli", account, { linux: { store: "secret-service" } });
+    } catch {
+      throw new Error("UserReason cannot access the OS credential store. Enable macOS Keychain, Windows Credential Manager or Linux Secret Service; credentials will not be written to a plaintext file.");
+    }
+  }
+  return {
+    async load() {
+      let serialized;
+      try {
+        serialized = (await entry()).getPassword();
+      } catch (error) {
+        if (/No entry|NoEntry|not found|not exist/i.test(String(error.message)))
+          return null;
+        throw new Error("Unable to read the UserReason OS credential-store entry");
+      }
+      if (!serialized)
+        return null;
+      try {
+        const session2 = JSON.parse(serialized);
+        if (session2.apiUrl !== config.apiUrl || session2.clientId !== config.clientId || typeof session2.accessToken !== "string" || typeof session2.refreshToken !== "string" || typeof session2.expiresAt !== "number")
+          throw new Error();
+        return session2;
+      } catch {
+        throw new Error("Invalid stored UserReason session; run userreason logout, then login again");
+      }
+    },
+    async save(session2) {
+      try {
+        (await entry()).setPassword(JSON.stringify(session2));
+      } catch {
+        throw new Error("Unable to save the UserReason session in the OS credential store");
+      }
+    },
+    async clear() {
+      try {
+        (await entry()).deletePassword();
+      } catch (error) {
+        if (!/No entry|NoEntry|not found|not exist/i.test(String(error.message)))
+          throw new Error("Unable to remove the UserReason OS credential-store entry");
+      }
+    }
+  };
+}
+
+// src/project.ts
+import { lstat, readFile as readFile3, writeFile as writeFile2, access, copyFile } from "node:fs/promises";
+import { join as join3, resolve, dirname } from "node:path";
+import { spawn } from "node:child_process";
+var exists = async (path) => {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+};
+async function inspectProject(directory, framework) {
+  directory = resolve(directory);
+  const metadata = await lstat(directory);
+  if (!metadata.isDirectory()) throw new Error("Project directory must be an existing directory");
+  const text = await readFile3(join3(directory, "package.json"), "utf8");
+  if (text.length > 1e6) throw new Error("Project package.json is too large");
+  const data = JSON.parse(text);
+  if (!data || typeof data !== "object" || Array.isArray(data)) throw new Error("Invalid project package.json");
+  const dependencies = { ...data.dependencies, ...data.devDependencies };
+  const inferred = dependencies.next ? "next" : dependencies.react ? "react" : dependencies.vue ? "vue" : "vanilla";
+  const packageManager = typeof data.packageManager === "string" && /^(pnpm|yarn)@/.test(data.packageManager) ? data.packageManager.split("@")[0] : await exists(join3(directory, "pnpm-lock.yaml")) ? "pnpm" : await exists(join3(directory, "yarn.lock")) ? "yarn" : "npm";
+  const yarnMajor = packageManager === "yarn" ? typeof data.packageManager === "string" && /^yarn@\d+/.test(data.packageManager) ? Number(data.packageManager.slice(5).split(".")[0]) : await exists(join3(directory, ".yarnrc.yml")) ? 4 : 1 : void 0;
+  return { directory, framework: framework ?? inferred, sourceDirectory: await exists(join3(directory, "src")) ? join3(directory, "src") : directory, packageManager, yarnMajor, name: typeof data.name === "string" && data.name ? data.name : "My site" };
+}
+function integrationSource(framework, config) {
+  const options = JSON.stringify(config, null, 2);
+  const base = `// Generated by the UserReason wizard. Contains public SDK configuration only.
+`;
+  if (framework === "next" || framework === "react") return {
+    filename: "userreason.generated.tsx",
+    content: `${framework === "next" ? "'use client';\n" : ""}${base}import { useEffect, useLayoutEffect } from 'react';
+import UserReason from '@userreason/js';
+
+// Initialize before descendant passive effects; no effects run during SSR.
+const useBrowserLayoutEffect = typeof window === 'undefined' ? useEffect : useLayoutEffect;
+
+export function UserReasonProvider() {
+  useBrowserLayoutEffect(() => {
+    UserReason.init(${options});
+    return () => UserReason.destroy();
+  }, []);
+  return null;
+}
+`,
+    instruction: framework === "next" ? "Import UserReasonProvider into your root layout and render <UserReasonProvider /> once inside <body>." : "Import UserReasonProvider into your root application and render <UserReasonProvider /> once."
+  };
+  if (framework === "vue") return { filename: "userreason.generated.ts", content: `${base}import { onBeforeMount, onBeforeUnmount } from 'vue';
+import UserReason from '@userreason/js';
+
+export function useUserReason() {
+  onBeforeMount(() => UserReason.init(${options}));
+  onBeforeUnmount(() => UserReason.destroy());
+}
+`, instruction: "Import useUserReason into your root Vue component and call it once inside setup()." };
+  return { filename: "userreason.generated.ts", content: `${base}import UserReason from '@userreason/js';
+
+export function initializeUserReason() {
+  UserReason.init(${options});
+  return () => UserReason.destroy();
+}
+`, instruction: "Import initializeUserReason at your application entry and call it once after the document body is available. Call the returned cleanup function on teardown." };
+}
+async function writeGenerated(path, content, force) {
+  try {
+    await writeFile2(path, content, { flag: "wx", mode: 420 });
+    return;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const metadata = await lstat(path);
+  if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error(`Refusing to overwrite a non-file: ${path}`);
+  if (await readFile3(path, "utf8") === content) return;
+  if (!force) throw new Error(`Existing file differs: ${path}. Review it and rerun with --force to create a backup and replace it.`);
+  await copyFile(path, `${path}.backup-${Date.now()}`);
+  await writeFile2(path, content, { mode: 420 });
+}
+async function writeIntegration(project, config, force = false) {
+  const helper = integrationSource(project.framework, config), configPath = join3(project.directory, "userreason.config.json"), helperPath = join3(project.sourceDirectory, helper.filename);
+  const source = await lstat(dirname(helperPath));
+  if (!source.isDirectory() || source.isSymbolicLink()) throw new Error("Source directory must be a real directory inside the project");
+  await writeGenerated(configPath, JSON.stringify({ schemaVersion: 1, sdkVersion: ">=0.2.0", ...config }, null, 2) + "\n", force);
+  await writeGenerated(helperPath, helper.content, force);
+  return { files: [configPath, helperPath], instruction: helper.instruction };
+}
+async function installSdk(project) {
+  const args = project.packageManager === "npm" ? ["install", "--ignore-scripts", "@userreason/js@^0.2.0"] : project.packageManager === "pnpm" ? ["add", "--ignore-scripts", "@userreason/js@^0.2.0"] : (project.yarnMajor ?? 1) >= 2 ? ["add", "--mode=skip-builds", "@userreason/js@^0.2.0"] : ["add", "--ignore-scripts", "@userreason/js@^0.2.0"];
+  await new Promise((resolve2, reject) => {
+    const child = spawn(project.packageManager, args, { cwd: project.directory, stdio: ["ignore", process.stderr, process.stderr], shell: false, env: { ...process.env, YARN_ENABLE_SCRIPTS: "false", npm_config_ignore_scripts: "true" } });
+    child.on("error", () => reject(new Error(`Unable to start ${project.packageManager}; install @userreason/js@^0.2.0 manually`)));
+    child.on("exit", (code) => code === 0 ? resolve2() : reject(new Error("SDK installation failed. Publish/install the remote-compatible @userreason/js >=0.2.0 package, then rerun the wizard using the existing workspace/site.")));
+  });
+}
+async function verifyConfiguration(config, hostOrigin, fetcher = fetch) {
+  const response = await fetcher(`${config.apiBaseUrl}/v1/sdk/${config.workspaceId}/${config.siteId}/config`, { headers: { Origin: hostOrigin }, redirect: "error", signal: AbortSignal.timeout(2e4) });
+  if (!response.ok) throw new Error(`Site configuration check failed (${response.status}); verify its allowed origins and Worker deployment`);
+  const data = await response.json();
+  if (data.workspace_id !== config.workspaceId || data.site_id !== config.siteId || !data.payload || typeof data.payload !== "object") throw new Error("Worker returned a configuration for a different or invalid site");
+  return { configured: true, hostConnectionVerified: false };
+}
+
+// src/bin.ts
+var help = `UserReason installation wizard
+
+userreason-wizard [--directory PATH] [--dev] [--origin URL]
+
+--workspace UUID / --workspace-name NAME
+--site UUID / --site-name NAME
+--environment development|production
+--framework react|next|vue|vanilla
+--install / --skip-install
+--yes (non-interactive; requires workspace/site selections or names and origin)
+--force (back up and replace generated files)
+--client-id CLIENT_ID, --api-url ORIGIN, --json
+
+Requires remote-compatible @userreason/js >=0.2.0. Only public configuration is written to your project.
+`;
+async function main() {
+  const parsed = parseArgs({ allowPositionals: false, options: { help: { type: "boolean", short: "h" }, dev: { type: "boolean" }, yes: { type: "boolean" }, install: { type: "boolean" }, "skip-install": { type: "boolean" }, force: { type: "boolean" }, json: { type: "boolean" }, directory: { type: "string" }, origin: { type: "string" }, workspace: { type: "string" }, "workspace-name": { type: "string" }, site: { type: "string" }, "site-name": { type: "string" }, environment: { type: "string" }, framework: { type: "string" }, "client-id": { type: "string" }, "api-url": { type: "string" } } });
+  const values = parsed.values;
+  if (values.help) {
+    process.stdout.write(help);
+    return;
+  }
+  if (values.install && values["skip-install"]) throw new Error("Choose either --install or --skip-install");
+  const framework = values.framework;
+  if (framework && !["react", "next", "vue", "vanilla"].includes(framework)) throw new Error("Unsupported framework");
+  const project = await inspectProject(values.directory ?? process.cwd(), framework);
+  const config = await resolveConfig({ development: values.dev, apiUrl: values["api-url"], clientId: values["client-id"] });
+  const credentials = keychainCredentials(config), client = new UserReasonClient(config, credentials);
+  const interactive = !values.yes && process.stdin.isTTY;
+  const terminal = interactive ? createInterface({ input: process.stdin, output: process.stderr }) : void 0;
+  const ask = async (question, fallback) => {
+    if (!terminal) {
+      if (fallback !== void 0) return fallback;
+      throw new Error(`Missing selection: ${question}. Supply the corresponding command option for non-interactive use.`);
+    }
+    return (await terminal.question(question + (fallback ? ` [${fallback}]` : "") + ": ")).trim() || fallback || "";
+  };
+  const approve = async (workspaceId) => {
+    const request = await client.requestGrant({ workspaceId, scopes: workspaceId ? ["workspace:read", "site:read", "site:create", "site:update"] : ["workspace:create", "workspace:read", "site:read", "site:create", "site:update"] });
+    if (request.status === "approved") return request;
+    if (request.approval_url) process.stderr.write(`Approve this installation in your browser: ${request.approval_url}
+`);
+    return client.waitForGrant(request.id);
+  };
+  const authorized = async (operation, workspaceId) => {
+    try {
+      return await operation();
+    } catch (error) {
+      if (!(error instanceof ApiError) || error.status !== 403 || !["authorization_required", "grant_required"].includes(error.code)) throw error;
+      await approve(workspaceId);
+      return operation();
+    }
+  };
+  try {
+    let stored = await credentials.load();
+    if (!stored) {
+      stored = await login(config, credentials, (device) => {
+        process.stderr.write(`Sign in at ${device.verificationUriComplete}
+Confirm code: ${device.userCode}
+`);
+      });
+      await saveConfig(config, values.dev);
+    }
+    let account;
+    try {
+      account = await client.account();
+    } catch (error) {
+      if (!(error instanceof AuthenticationError) || error.code !== "invalid_grant") throw error;
+      await login(config, credentials, (device) => {
+        process.stderr.write(`Sign in at ${device.verificationUriComplete}
+Confirm code: ${device.userCode}
+`);
+      });
+      account = await client.account();
+    }
+    let selectedWorkspace;
+    if (values.workspace) {
+      const requestedId = uuid(values.workspace);
+      selectedWorkspace = account.workspaces.find((item) => item.id === requestedId);
+      if (!selectedWorkspace) {
+        await approve(requestedId);
+        account = await client.account();
+        selectedWorkspace = account.workspaces.find((item) => item.id === requestedId);
+      }
+      if (!selectedWorkspace) throw new Error("Selected workspace is not available to this approved client");
+    } else if (!values["workspace-name"] && account.workspaces.length) {
+      process.stderr.write(account.workspaces.map((item, index) => `${index + 1}. ${item.name} (${item.id})`).join("\n") + "\n");
+      const selected = await ask("Workspace number, or 'new'", interactive ? "1" : void 0);
+      if (selected !== "new") selectedWorkspace = account.workspaces[Number(selected) - 1];
+      if (selected !== "new" && !selectedWorkspace) throw new Error("Invalid workspace selection");
+    }
+    if (!selectedWorkspace) {
+      const name = values["workspace-name"] ?? await ask("New workspace name");
+      const ids = { requestId: randomUUID3(), workspaceId: randomUUID3() };
+      try {
+        selectedWorkspace = await client.createWorkspace(name, ids);
+      } catch (error) {
+        if (!(error instanceof ApiError) || error.status !== 403 || !["authorization_required", "grant_required"].includes(error.code)) throw error;
+        process.stderr.write("Approve a new workspace or select an existing workspace in the browser.\n");
+        const approved = await approve();
+        account = await client.account();
+        const approvedGrant = account.grants.find((value) => value && typeof value === "object" && "id" in value && value.id === approved.grant_id);
+        if (approvedGrant?.workspace_id) {
+          selectedWorkspace = account.workspaces.find((item) => item.id === approvedGrant.workspace_id);
+          if (!selectedWorkspace) throw new Error("The approved workspace also needs workspace:read permission for installation");
+          process.stderr.write(`Continuing in the workspace selected during approval: ${selectedWorkspace.name}
+`);
+        } else selectedWorkspace = await client.createWorkspace(name, ids);
+      }
+    }
+    const workspaceId = selectedWorkspace.id;
+    const sites = await authorized(() => client.sites(workspaceId), workspaceId);
+    let selectedSite;
+    if (values.site) {
+      selectedSite = sites.find((item) => item.id === uuid(values.site));
+      if (!selectedSite) throw new Error("Selected site is not in this workspace");
+    } else if (!values["site-name"] && sites.length) {
+      process.stderr.write(sites.map((item, index) => `${index + 1}. ${item.name} (${item.id})`).join("\n") + "\n");
+      const selected = await ask("Site number, or 'new'", interactive ? "1" : void 0);
+      if (selected !== "new") selectedSite = sites[Number(selected) - 1];
+      if (selected !== "new" && !selectedSite) throw new Error("Invalid site selection");
+    }
+    const environment = selectedSite?.environment ?? values.environment ?? (values.dev ? "development" : "production");
+    if (environment !== "production" && environment !== "development") throw new Error("Invalid site environment");
+    const hostOrigin = origin(values.origin ?? await ask("Host site origin", selectedSite?.allowed_origins[0]), environment);
+    if (selectedSite && !selectedSite.allowed_origins.includes(hostOrigin)) throw new Error("This origin is not allowed for the selected site. Add it through the dashboard before continuing.");
+    if (!selectedSite) {
+      const input = { workspaceId, name: values["site-name"] ?? await ask("Site name", project.name), environment, origins: [hostOrigin], requestId: randomUUID3(), siteId: randomUUID3() };
+      selectedSite = await authorized(() => client.createSite(input), workspaceId);
+    }
+    const installation = { workspaceId: selectedWorkspace.id, siteId: selectedSite.id, apiBaseUrl: config.apiUrl };
+    const shouldInstall = values.install || !values["skip-install"] && interactive && /^y(es)?$/i.test(await ask("Install @userreason/js >=0.2.0 now?", "yes"));
+    if (shouldInstall) await installSdk(project);
+    const generated = await writeIntegration(project, installation, values.force);
+    const verification = await verifyConfiguration(installation, hostOrigin);
+    process.stderr.write(`${generated.instruction}
+Start your application and visit the host site to exercise the SDK session/config flow. Configuration availability is checked; a real browser connection has not been verified.
+`);
+    process.stdout.write(JSON.stringify({ workspace: selectedWorkspace, site: selectedSite, framework: project.framework, files: generated.files, sdk_installed: Boolean(shouldInstall), sdk_required_version: ">=0.2.0", verification, next_step: generated.instruction }, null, values.json ? void 0 : 2) + "\n");
+  } finally {
+    terminal?.close();
+  }
+}
+main().catch((error) => {
+  const message = error instanceof Error ? error.message : "Installation failed";
+  process.stderr.write((process.argv.includes("--json") ? JSON.stringify({ error: "wizard_failed", message }) : message) + "\n");
+  process.exitCode = 1;
+});

package/dist/project.js

@@ -0,0 +1,108 @@
+// src/project.ts
+import { lstat, readFile, writeFile, access, copyFile } from "node:fs/promises";
+import { join, resolve, dirname } from "node:path";
+import { spawn } from "node:child_process";
+var exists = async (path) => {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+};
+async function inspectProject(directory, framework) {
+  directory = resolve(directory);
+  const metadata = await lstat(directory);
+  if (!metadata.isDirectory()) throw new Error("Project directory must be an existing directory");
+  const text = await readFile(join(directory, "package.json"), "utf8");
+  if (text.length > 1e6) throw new Error("Project package.json is too large");
+  const data = JSON.parse(text);
+  if (!data || typeof data !== "object" || Array.isArray(data)) throw new Error("Invalid project package.json");
+  const dependencies = { ...data.dependencies, ...data.devDependencies };
+  const inferred = dependencies.next ? "next" : dependencies.react ? "react" : dependencies.vue ? "vue" : "vanilla";
+  const packageManager = typeof data.packageManager === "string" && /^(pnpm|yarn)@/.test(data.packageManager) ? data.packageManager.split("@")[0] : await exists(join(directory, "pnpm-lock.yaml")) ? "pnpm" : await exists(join(directory, "yarn.lock")) ? "yarn" : "npm";
+  const yarnMajor = packageManager === "yarn" ? typeof data.packageManager === "string" && /^yarn@\d+/.test(data.packageManager) ? Number(data.packageManager.slice(5).split(".")[0]) : await exists(join(directory, ".yarnrc.yml")) ? 4 : 1 : void 0;
+  return { directory, framework: framework ?? inferred, sourceDirectory: await exists(join(directory, "src")) ? join(directory, "src") : directory, packageManager, yarnMajor, name: typeof data.name === "string" && data.name ? data.name : "My site" };
+}
+function integrationSource(framework, config) {
+  const options = JSON.stringify(config, null, 2);
+  const base = `// Generated by the UserReason wizard. Contains public SDK configuration only.
+`;
+  if (framework === "next" || framework === "react") return {
+    filename: "userreason.generated.tsx",
+    content: `${framework === "next" ? "'use client';\n" : ""}${base}import { useEffect, useLayoutEffect } from 'react';
+import UserReason from '@userreason/js';
+
+// Initialize before descendant passive effects; no effects run during SSR.
+const useBrowserLayoutEffect = typeof window === 'undefined' ? useEffect : useLayoutEffect;
+
+export function UserReasonProvider() {
+  useBrowserLayoutEffect(() => {
+    UserReason.init(${options});
+    return () => UserReason.destroy();
+  }, []);
+  return null;
+}
+`,
+    instruction: framework === "next" ? "Import UserReasonProvider into your root layout and render <UserReasonProvider /> once inside <body>." : "Import UserReasonProvider into your root application and render <UserReasonProvider /> once."
+  };
+  if (framework === "vue") return { filename: "userreason.generated.ts", content: `${base}import { onBeforeMount, onBeforeUnmount } from 'vue';
+import UserReason from '@userreason/js';
+
+export function useUserReason() {
+  onBeforeMount(() => UserReason.init(${options}));
+  onBeforeUnmount(() => UserReason.destroy());
+}
+`, instruction: "Import useUserReason into your root Vue component and call it once inside setup()." };
+  return { filename: "userreason.generated.ts", content: `${base}import UserReason from '@userreason/js';
+
+export function initializeUserReason() {
+  UserReason.init(${options});
+  return () => UserReason.destroy();
+}
+`, instruction: "Import initializeUserReason at your application entry and call it once after the document body is available. Call the returned cleanup function on teardown." };
+}
+async function writeGenerated(path, content, force) {
+  try {
+    await writeFile(path, content, { flag: "wx", mode: 420 });
+    return;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const metadata = await lstat(path);
+  if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error(`Refusing to overwrite a non-file: ${path}`);
+  if (await readFile(path, "utf8") === content) return;
+  if (!force) throw new Error(`Existing file differs: ${path}. Review it and rerun with --force to create a backup and replace it.`);
+  await copyFile(path, `${path}.backup-${Date.now()}`);
+  await writeFile(path, content, { mode: 420 });
+}
+async function writeIntegration(project, config, force = false) {
+  const helper = integrationSource(project.framework, config), configPath = join(project.directory, "userreason.config.json"), helperPath = join(project.sourceDirectory, helper.filename);
+  const source = await lstat(dirname(helperPath));
+  if (!source.isDirectory() || source.isSymbolicLink()) throw new Error("Source directory must be a real directory inside the project");
+  await writeGenerated(configPath, JSON.stringify({ schemaVersion: 1, sdkVersion: ">=0.2.0", ...config }, null, 2) + "\n", force);
+  await writeGenerated(helperPath, helper.content, force);
+  return { files: [configPath, helperPath], instruction: helper.instruction };
+}
+async function installSdk(project) {
+  const args = project.packageManager === "npm" ? ["install", "--ignore-scripts", "@userreason/js@^0.2.0"] : project.packageManager === "pnpm" ? ["add", "--ignore-scripts", "@userreason/js@^0.2.0"] : (project.yarnMajor ?? 1) >= 2 ? ["add", "--mode=skip-builds", "@userreason/js@^0.2.0"] : ["add", "--ignore-scripts", "@userreason/js@^0.2.0"];
+  await new Promise((resolve2, reject) => {
+    const child = spawn(project.packageManager, args, { cwd: project.directory, stdio: ["ignore", process.stderr, process.stderr], shell: false, env: { ...process.env, YARN_ENABLE_SCRIPTS: "false", npm_config_ignore_scripts: "true" } });
+    child.on("error", () => reject(new Error(`Unable to start ${project.packageManager}; install @userreason/js@^0.2.0 manually`)));
+    child.on("exit", (code) => code === 0 ? resolve2() : reject(new Error("SDK installation failed. Publish/install the remote-compatible @userreason/js >=0.2.0 package, then rerun the wizard using the existing workspace/site.")));
+  });
+}
+async function verifyConfiguration(config, hostOrigin, fetcher = fetch) {
+  const response = await fetcher(`${config.apiBaseUrl}/v1/sdk/${config.workspaceId}/${config.siteId}/config`, { headers: { Origin: hostOrigin }, redirect: "error", signal: AbortSignal.timeout(2e4) });
+  if (!response.ok) throw new Error(`Site configuration check failed (${response.status}); verify its allowed origins and Worker deployment`);
+  const data = await response.json();
+  if (data.workspace_id !== config.workspaceId || data.site_id !== config.siteId || !data.payload || typeof data.payload !== "object") throw new Error("Worker returned a configuration for a different or invalid site");
+  return { configured: true, hostConnectionVerified: false };
+}
+export {
+  inspectProject,
+  installSdk,
+  integrationSource,
+  verifyConfiguration,
+  writeIntegration
+};

package/package.json

@@ -1,6 +1,36 @@
 {
   "name": "@userreason/wizard",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Authenticated UserReason SDK installation wizard",
+  "type": "module",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "bin": {
+    "userreason-wizard": "dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node --test tests/*.test.mjs",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "@napi-rs/keyring": "2.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "@userreason/cli": "file:../ur-cli",
+    "esbuild": "^0.28.0",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "react-test-renderer": "19.2.4",
+    "typescript": "^5.9.0",
+    "vue": "3.5.43"
+  }
+}