@userreason/wizard 0.1.0 → 0.2.1

package/dist/bin.js

@@ -1,733 +1,764 @@
 #!/usr/bin/env node
+import { createRequire as createWizardRequire } from 'node:module'; import { fileURLToPath as wizardFileURLToPath } from 'node:url'; import { dirname as wizardDirname } from 'node:path'; const require = createWizardRequire(import.meta.url); const __filename = wizardFileURLToPath(import.meta.url); const __dirname = wizardDirname(__filename);
+import {
+  offerAgentNote,
+  planAgentNote
+} from "./chunk-ULHKVBPD.js";
+import {
+  offerAgentSkill,
+  planAgentSkill
+} from "./chunk-5Z5J6PY5.js";
+import {
+  offerCliAccess
+} from "./chunk-HACTNBV3.js";
+import {
+  offerGlobalCli
+} from "./chunk-JD5U4U26.js";
+import {
+  ensureCurrentWizard,
+  wizardVersion
+} from "./chunk-6CJ4ANMN.js";
+import {
+  Cancelled,
+  Terminal,
+  approvalStatus,
+  clean,
+  normalizeOrigin,
+  openBrowser
+} from "./chunk-SJVLAYGG.js";
+import {
+  BrowserConnectionUnavailable,
+  compatibilityCredentials,
+  connectInstallation,
+  memoryCredentials
+} from "./chunk-3RDJORRS.js";
+import {
+  clearInstallation,
+  resolveInstallation,
+  saveInstallation,
+  savedInstallation
+} from "./chunk-ZGZOBW2B.js";
+import {
+  applyIntegration,
+  detectInstallation,
+  integrationAdditions,
+  integrationPreview,
+  planIntegration
+} from "./chunk-5SC2K42Q.js";
+import {
+  SdkInstallError,
+  cliCommand,
+  cliInstallCommand,
+  devCommand,
+  hasCompatibleCli,
+  hasCompatibleSdk,
+  inspectProject,
+  installCli,
+  installSdk,
+  sdkInstallCommand,
+  verifyConfiguration,
+  writeIntegration
+} from "./chunk-YMSGDC4B.js";
+import "./chunk-OEGNGGZ2.js";
+import {
+  ApiError,
+  AuthenticationError,
+  UserReasonClient,
+  apiUrl,
+  credentialStoreKind,
+  detectAgentHarness,
+  login,
+  packageProfile,
+  resolveConfig,
+  resolveCredentials,
+  saveConfig,
+  uuid
+} from "./chunk-GGARVSPT.js";
+import "./chunk-WL3NOIM6.js";
 
 // src/bin.ts
 import { parseArgs } from "node:util";
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { createInterface } from "node:readline/promises";
+import { randomUUID } from "node:crypto";
+var help = `UserReason installation wizard
 
-// ../ur-cli/dist/client.js
-import { randomUUID as randomUUID2 } from "node:crypto";
+userreason-wizard [--directory PATH] [--origin URL]
 
-// ../ur-cli/dist/contracts.js
-function object(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    throw new Error(`Invalid ${label} response`);
-  return value;
-}
-function string(value, label) {
-  if (typeof value !== "string" || value.length === 0)
-    throw new Error(`Invalid ${label}`);
-  return value;
-}
-function uuid(value, label = "ID") {
-  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value))
-    throw new Error(`${label} must be a UUID`);
-  return value;
-}
-function apiUrl(value) {
-  const url = new URL(value);
-  if (url.username || url.password || url.search || url.hash || url.pathname !== "/")
-    throw new Error("API URL must be an origin without credentials, query or path");
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
-    throw new Error("API URL must use HTTPS; loopback HTTP is allowed for local development");
-  return url.origin;
-}
-function origin(value, environment) {
-  const normalized = apiUrl(value);
-  if (environment === "production" && !normalized.startsWith("https://"))
-    throw new Error("Production sites require HTTPS origins");
-  return normalized;
-}
-function workspace(value) {
-  const data = object(value, "workspace");
-  return { ...data, id: uuid(string(data.id, "workspace ID")), name: string(data.name, "workspace name") };
-}
-function site(value) {
-  const data = object(value, "site");
-  if (data.environment !== "development" && data.environment !== "production")
-    throw new Error("Invalid site environment");
-  if (!Array.isArray(data.allowed_origins) || !data.allowed_origins.every((item) => typeof item === "string"))
-    throw new Error("Invalid site origins");
-  return { ...data, id: uuid(string(data.id ?? data.site_id, "site ID")), workspace_id: uuid(string(data.workspace_id, "workspace ID")), name: string(data.name, "site name") };
-}
-function grantRequest(value) {
-  const data = object(value, "grant request");
-  if (!["pending", "approved", "rejected", "denied", "expired"].includes(String(data.status)))
-    throw new Error("Invalid grant request status");
-  if (data.approval_url !== void 0) {
-    const url = new URL(string(data.approval_url, "approval URL"));
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
-      throw new Error("Invalid grant approval URL");
-  }
-  return { ...data, id: uuid(string(data.id, "grant request ID")) };
-}
+--workspace UUID / --workspace-name NAME
+--site UUID / --site-name NAME
+--environment development|production (customer site environment)
+--api-environment development|production (UserReason API/login; default ${packageProfile().apiEnvironment})
+--framework react|next|vue|vanilla
+--skip-install (advanced: prepare without installing SDK/CLI packages)
+--install (force an SDK/CLI reinstall)
+--refresh (update SDK/CLI packages without browser onboarding)
+--integrate / --skip-integrate
+--global-cli / --skip-global-cli (optional global CLI install; also supported with --refresh)
+--cli-access / --skip-cli-access (optional ongoing CLI authorization)
+--agent-note / --skip-agent-note (optional note in existing AGENTS.md or CLAUDE.md)
+--agent-skill / --skip-agent-skill (optional feedback skill in .agents/skills/userreason)
+--yes (accept installation/root edits; global CLI, access and agent guidance need explicit flags; browser approval remains required)
+--dry-run (print the plan, as JSON with --json; nothing is signed in, written or installed)
+--diff (show the full patch for the application edit and the proposed guidance text)
+--interactive (ask questions even when an agent harness or CI is detected)
+--no-color (also NO_COLOR)
+--no-open (print the browser link without opening it)
+--session-only (keep compatibility login only in memory; do not persist credentials)
+--force (replace differing generated files)
+--debug (show package-manager logs), --json (structured result only on stdout)
+--dev (compatibility alias for --api-environment development)
+--credential-store file|keychain (default file; UR_CREDENTIAL_STORE also supported)
+--client-id CLIENT_ID, --api-url ORIGIN
 
-// ../ur-cli/dist/workos.js
-var AuthenticationError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-};
-var sleep = (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds));
-var endpoint = "https://api.workos.com/user_management";
-function session(data, config) {
-  const user = object(data.user, "authenticated user");
-  if (user.email_verified !== true)
-    throw new AuthenticationError("email_unverified", "Complete email verification before continuing");
-  const accessToken = string(data.access_token, "access token");
-  let expiresAt = Date.now() + 12e4;
-  try {
-    const payload = object(JSON.parse(Buffer.from(accessToken.split(".")[1], "base64url").toString()), "token payload");
-    if (typeof payload.exp === "number" && Number.isFinite(payload.exp))
-      expiresAt = payload.exp * 1e3;
-  } catch {
-  }
-  return { accessToken, refreshToken: string(data.refresh_token, "refresh token"), expiresAt, userId: string(user.id, "user ID"), email: string(user.email, "email"), ...config };
-}
-async function post(path, body, fetcher, signal = AbortSignal.timeout(2e4)) {
-  const response = await fetcher(`${endpoint}/${path}`, { method: "POST", redirect: "error", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(body), signal });
-  const data = object(await response.json(), "authentication");
-  return { response, data };
-}
-async function login(config, credentials, onDevice, options = {}) {
-  const fetcher = options.fetcher ?? fetch, wait = options.sleep ?? sleep, now = options.now ?? Date.now;
-  const authorization = await post("authorize/device", { client_id: config.clientId }, fetcher);
-  if (!authorization.response.ok)
-    throw new AuthenticationError("device_authorization_failed", `Unable to start WorkOS login (${authorization.response.status})`);
-  const data = authorization.data;
-  const expiresIn = Number(data.expires_in), initialInterval = Number(data.interval);
-  if (!Number.isFinite(expiresIn) || expiresIn <= 0 || expiresIn > 1800 || !Number.isFinite(initialInterval) || initialInterval < 1 || initialInterval > 60)
-    throw new Error("Invalid device authorization timing");
-  const deviceCode = string(data.device_code, "device authorization code");
-  const verificationUri = string(data.verification_uri, "verification URL"), verificationUriComplete = string(data.verification_uri_complete, "complete verification URL");
-  for (const uri of [verificationUri, verificationUriComplete]) {
-    const url = new URL(uri);
-    if (url.protocol !== "https:" || url.username || url.password)
-      throw new Error("WorkOS returned an invalid verification URL");
-  }
-  await onDevice({ userCode: string(data.user_code, "user authorization code"), verificationUri, verificationUriComplete, expiresIn });
-  let interval = initialInterval;
-  const deadline = now() + expiresIn * 1e3;
-  while (now() < deadline) {
-    await wait(interval * 1e3);
-    if (now() >= deadline)
-      break;
-    let result;
-    try {
-      result = await post("authenticate", { grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: deviceCode, client_id: config.clientId }, fetcher, AbortSignal.timeout(Math.min(2e4, deadline - now())));
-    } catch {
-      interval = Math.min(interval * 2, 30);
-      continue;
-    }
-    if (result.response.ok) {
-      const authenticated = session(result.data, config);
-      await credentials.save(authenticated);
-      return authenticated;
-    }
-    const code = result.data.error ?? result.data.code;
-    if (code === "authorization_pending")
-      continue;
-    if (code === "slow_down") {
-      interval += 5;
-      continue;
-    }
-    if (result.response.status >= 500 || result.response.status === 429) {
-      interval = Math.min(interval * 2, 30);
-      continue;
+The SDK and project-local CLI install automatically, unless compatible versions are already installed.
+Domains are unrestricted by default; --origin optionally adds an exact restriction.
+Bare hostnames are accepted; explicit HTTP localhost restrictions require --environment development.
+Reruns detect SDK initialization and resume unfinished installations from local wizard state. Legacy userreason.config.json is still readable.
+Prompts are off when stdin or stdout is not a terminal, with --yes or --json, in CI, and in agent harnesses (--interactive overrides the last two).
+`;
+var nameError = (value) => !value.trim() || value.trim().length > 240 ? "Enter a name between 1 and 240 characters." : void 0;
+var currentStep = "Reading wizard options";
+var activeTerminal;
+var frameworkLabel = (framework) => framework === "next" ? "Next.js" : framework;
+var lowerFirst = (value) => value.charAt(0).toLowerCase() + value.slice(1);
+async function main() {
+  const { values } = parseArgs({
+    allowPositionals: false,
+    options: {
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" },
+      dev: { type: "boolean" },
+      "api-environment": { type: "string" },
+      yes: { type: "boolean" },
+      install: { type: "boolean" },
+      refresh: { type: "boolean" },
+      "skip-install": { type: "boolean" },
+      integrate: { type: "boolean" },
+      "skip-integrate": { type: "boolean" },
+      "agent-note": { type: "boolean" },
+      "skip-agent-note": { type: "boolean" },
+      "agent-skill": { type: "boolean" },
+      "skip-agent-skill": { type: "boolean" },
+      "global-cli": { type: "boolean" },
+      "skip-global-cli": { type: "boolean" },
+      "cli-access": { type: "boolean" },
+      "skip-cli-access": { type: "boolean" },
+      "dry-run": { type: "boolean" },
+      diff: { type: "boolean" },
+      interactive: { type: "boolean" },
+      "no-color": { type: "boolean" },
+      "no-open": { type: "boolean" },
+      "session-only": { type: "boolean" },
+      force: { type: "boolean" },
+      debug: { type: "boolean" },
+      json: { type: "boolean" },
+      directory: { type: "string" },
+      origin: { type: "string" },
+      workspace: { type: "string" },
+      "workspace-name": { type: "string" },
+      site: { type: "string" },
+      "site-name": { type: "string" },
+      environment: { type: "string" },
+      framework: { type: "string" },
+      "credential-store": { type: "string" },
+      "client-id": { type: "string" },
+      "api-url": { type: "string" }
     }
-    if (code === "access_denied")
-      throw new AuthenticationError("access_denied", "Login was declined");
-    if (code === "expired_token")
-      break;
-    throw new AuthenticationError("authorization_failed", `WorkOS authorization failed (${result.response.status})`);
+  });
+  const version = await wizardVersion();
+  if (values.version) {
+    process.stdout.write(version + "\n");
+    return;
   }
-  throw new AuthenticationError("expired_token", "The login code expired; run login again");
-}
-async function refresh(config, credentials, current, fetcher = fetch) {
-  const result = await post("authenticate", { grant_type: "refresh_token", refresh_token: current.refreshToken, client_id: config.clientId }, fetcher);
-  if (!result.response.ok) {
-    if (result.data.error === "invalid_grant" || result.data.code === "invalid_grant") {
-      await credentials.clear();
-      throw new AuthenticationError("invalid_grant", "Your session expired or was revoked; run userreason login again");
-    }
-    throw new AuthenticationError("refresh_failed", `Unable to refresh your session (${result.response.status}); the stored session was retained`);
+  if (values.help) {
+    process.stdout.write(help);
+    return;
   }
-  const updated = session(result.data, config);
-  await credentials.save(updated);
-  return updated;
-}
-
-// ../ur-cli/dist/lock.js
-import { createHash, randomUUID } from "node:crypto";
-import { mkdir as mkdir2, open, readFile as readFile2, unlink } from "node:fs/promises";
-import { join as join2 } from "node:path";
-
-// ../ur-cli/dist/config.js
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-var configDirectory = () => join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "userreason");
-async function discoverAuthConfig(url, development = false, fetcher = fetch) {
-  let response;
-  try {
-    response = await fetcher(`${apiUrl(url)}/onboarding/v1/auth-config`, { headers: { Accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(1e4) });
-  } catch {
-    throw new Error("Unable to discover UserReason authentication configuration. Check the API deployment or supply its public --client-id.");
+  if (values["credential-store"] !== void 0) credentialStoreKind(values["credential-store"]);
+  if (values["api-environment"] !== void 0 && !["production", "development"].includes(values["api-environment"]))
+    throw new Error("API environment must be development or production");
+  if (values.dev && values["api-environment"] === "production")
+    throw new Error("Conflicting API environments: --dev selects development. Remove --dev or use --api-environment development.");
+  const embeddedProfile = packageProfile();
+  const apiEnvironment = values["api-environment"] ?? (values.dev ? "development" : embeddedProfile.apiEnvironment);
+  const developmentApi = apiEnvironment === "development";
+  const newSiteEnvironment = values.environment ?? apiEnvironment;
+  if (values["global-cli"] && values["skip-global-cli"]) throw new Error("Choose --global-cli or --skip-global-cli");
+  if (values["global-cli"] && values["skip-install"]) throw new Error("--global-cli requires project package installation; omit --skip-install");
+  if (values["cli-access"] && values["skip-cli-access"]) throw new Error("Choose --cli-access or --skip-cli-access");
+  if (values["cli-access"] && values["session-only"]) throw new Error("Ongoing CLI access requires persistent credentials; omit --session-only");
+  if (values.install && values["skip-install"]) throw new Error("Choose either --install or --skip-install");
+  if (values["dry-run"] && values.refresh) throw new Error("Choose either --dry-run or --refresh");
+  if (values.refresh && (values["skip-install"] || values.workspace || values.site || values["workspace-name"] || values["site-name"]))
+    throw new Error("--refresh updates packages in an existing integration; omit setup/resource flags and --skip-install");
+  if (values.integrate && values["skip-integrate"])
+    throw new Error("Choose either --integrate or --skip-integrate");
+  if (values["agent-note"] && values["skip-agent-note"])
+    throw new Error("Choose either --agent-note or --skip-agent-note");
+  if (values["agent-skill"] && values["skip-agent-skill"])
+    throw new Error("Choose either --agent-skill or --skip-agent-skill");
+  if (values.workspace && values["workspace-name"])
+    throw new Error("Choose an existing workspace or a new workspace name");
+  if (values.site && values["site-name"]) throw new Error("Choose an existing site or a new site name");
+  if (values.framework && !["react", "next", "vue", "vanilla"].includes(values.framework))
+    throw new Error("Unsupported framework");
+  if (values.environment && !["production", "development"].includes(values.environment))
+    throw new Error("Site environment must be development or production");
+  if (values.origin !== void 0)
+    normalizeOrigin(values.origin, values.environment === "production" ? "production" : "development");
+  for (const value of [values["workspace-name"], values["site-name"]])
+    if (value !== void 0 && nameError(value)) throw new Error(nameError(value));
+  currentStep = "Checking the current wizard build";
+  const startup = await ensureCurrentWizard(embeddedProfile, version, { onRestart: (message) => process.stderr.write(message + "\n") });
+  if (startup.exitCode !== void 0) {
+    process.exitCode = startup.exitCode;
+    return;
   }
-  if (!response.ok)
-    throw new Error(`UserReason authentication configuration is unavailable (${response.status}). Configure WorkOS in the Worker before running the wizard.`);
-  if (!response.headers.get("content-type")?.toLowerCase().startsWith("application/json") || !response.body)
-    throw new Error("Invalid UserReason authentication configuration response");
-  const reader = response.body.getReader(), chunks = [];
-  let bytes = 0;
-  try {
-    while (true) {
-      const part = await reader.read();
-      if (part.done)
-        break;
-      bytes += part.value.byteLength;
-      if (bytes > 4096) {
-        await reader.cancel();
-        throw new Error("UserReason authentication configuration response is too large");
+  const profile = startup.profile;
+  const harness = detectAgentHarness();
+  const tty = Boolean(process.stdin.isTTY && process.stdout.isTTY && process.env.TERM !== "dumb");
+  const explicitlyQuiet = Boolean(values.yes || values.json);
+  const interactive = tty && !explicitlyQuiet && (!harness || Boolean(values.interactive));
+  const terminal = new Terminal(interactive, Boolean(values.json), { color: !values["no-color"] });
+  activeTerminal = terminal;
+  const { c, S } = terminal.kit;
+  const dot = ` ${S.dot} `;
+  const environmentNote = developmentApi ? `development API${newSiteEnvironment !== apiEnvironment ? `, new sites are ${newSiteEnvironment}` : ""}` : newSiteEnvironment !== apiEnvironment ? `new sites are ${newSiteEnvironment}` : void 0;
+  terminal.header({
+    mode: values.refresh ? "refresh" : "setup",
+    version,
+    detail: [
+      ...profile.kind === "local-development" ? [`dev build ${profile.buildId.slice(0, 12)} (sdk ${profile.sdkVersion}, cli ${profile.cliVersion})`] : [],
+      ...environmentNote ? [environmentNote] : []
+    ]
+  });
+  if (!interactive) terminal.info(`API environment: ${apiEnvironment}${dot}Site environment for new sites: ${newSiteEnvironment}`);
+  if (tty && harness && !explicitlyQuiet && !values.interactive)
+    terminal.info(`Agent session detected (${harness})${dot}${c.muted("prompts are off, flags decide")}`);
+  currentStep = "Inspecting the project";
+  const project = await inspectProject(
+    values.directory ?? process.cwd(),
+    values.framework
+  );
+  terminal.info(`${clean(project.name)} ${c.muted(`(${frameworkLabel(project.framework)}, ${project.packageManager})`)}`);
+  if (values.refresh) {
+    currentStep = "Refreshing UserReason packages";
+    const existing = await detectInstallation(project);
+    if (!existing) throw new Error("No UserReason initialization found. Run the wizard without --refresh to set up this application.");
+    const expectedApi = developmentApi ? "https://api-dev.userreason.com" : "https://api.userreason.com";
+    if (existing.apiBaseUrl !== expectedApi && !values["api-url"])
+      throw new Error("The existing integration uses a different API. Select its --api-environment or pass its --api-url before refreshing.");
+    if (values["api-url"] && existing.apiBaseUrl !== apiUrl(values["api-url"])) throw new Error("The existing integration uses a different API URL.");
+    const options = { profile, verbose: values.debug, onWarning: (message) => terminal.warn(message) };
+    const updated = [];
+    const started = Date.now();
+    await terminal.task("Updating UserReason packages", async () => {
+      if (!await hasCompatibleSdk(project, profile) || values.install) {
+        await installSdk(project, options);
+        updated.push("@userreason/js");
       }
-      chunks.push(part.value);
-    }
-  } finally {
-    reader.releaseLock();
-  }
-  const buffer = new Uint8Array(bytes);
-  let offset = 0;
-  for (const chunk of chunks) {
-    buffer.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  let config;
-  try {
-    config = object(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer)), "authentication configuration");
-  } catch {
-    throw new Error("Invalid UserReason authentication configuration response");
-  }
-  if (Object.keys(config).some((key) => !["client_id", "authkit_domain", "environment"].includes(key)) || typeof config.client_id !== "string" || !/^client_[A-Za-z0-9]{1,230}$/.test(config.client_id) || typeof config.authkit_domain !== "string" || config.authkit_domain.length > 2048)
-    throw new Error("Invalid UserReason authentication configuration response");
-  const domain = apiUrl(config.authkit_domain);
-  if (!domain.startsWith("https://") || domain !== config.authkit_domain)
-    throw new Error("Invalid WorkOS AuthKit domain in authentication configuration");
-  if (config.environment !== "local" && config.environment !== (development ? "development" : "production"))
-    throw new Error("API authentication environment does not match the selected CLI environment; use --dev for development");
-  return config.client_id;
-}
-async function resolveConfig(options = {}) {
-  const environment = options.development ? "development" : "production";
-  let saved = {};
-  try {
-    const root = object(JSON.parse(await readFile(join(configDirectory(), "config.json"), "utf8")), "configuration");
-    saved = object(root[environment] ?? {}, "environment configuration");
-  } catch (error) {
-    if (error.code !== "ENOENT")
-      throw new Error("Unable to read UserReason configuration");
-  }
-  const url = apiUrl(options.apiUrl ?? process.env.UR_API_URL ?? (typeof saved.apiUrl === "string" ? saved.apiUrl : options.development ? "https://api-dev.userreason.com" : "https://api.userreason.com"));
-  const configured = options.clientId ?? (options.development ? process.env.UR_WORKOS_DEV_CLIENT_ID : void 0) ?? process.env.UR_WORKOS_CLIENT_ID ?? (typeof saved.clientId === "string" ? saved.clientId : void 0);
-  const clientId = configured ?? await discoverAuthConfig(url, options.development);
-  if (!/^client_[A-Za-z0-9]+$/.test(clientId))
-    throw new Error("Set UR_WORKOS_CLIENT_ID or pass --client-id with the public WorkOS client ID. Never supply a WorkOS API key.");
-  return { apiUrl: url, clientId };
-}
-async function saveConfig(config, development = false) {
-  await mkdir(configDirectory(), { recursive: true, mode: 448 });
-  let existing = {};
-  try {
-    existing = object(JSON.parse(await readFile(join(configDirectory(), "config.json"), "utf8")), "configuration");
-  } catch (error) {
-    if (error.code !== "ENOENT")
-      throw new Error("Unable to read UserReason configuration");
-  }
-  existing[development ? "development" : "production"] = config;
-  await writeFile(join(configDirectory(), "config.json"), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
-}
-
-// ../ur-cli/dist/lock.js
-async function withSessionLock(config, operation) {
-  const directory = join2(configDirectory(), "locks");
-  await mkdir2(directory, { recursive: true, mode: 448 });
-  const path = join2(directory, createHash("sha256").update(`${config.apiUrl}
-${config.clientId}`).digest("hex") + ".lock");
-  const id = randomUUID(), deadline = Date.now() + 35e3;
-  while (true) {
-    try {
-      const file = await open(path, "wx", 384);
-      await file.writeFile(JSON.stringify({ id, createdAt: Date.now() }));
-      await file.close();
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST")
-        throw new Error("Unable to lock the UserReason credential store");
-      try {
-        const old = JSON.parse(await readFile2(path, "utf8"));
-        if (typeof old.createdAt === "number" && Date.now() - old.createdAt > 12e4) {
-          await unlink(path);
-          continue;
-        }
-      } catch {
+      if (!await hasCompatibleCli(project, profile) || values.install) {
+        await installCli(project, options);
+        updated.push("@userreason/cli");
       }
-      if (Date.now() >= deadline)
-        throw new Error("Another UserReason process is refreshing credentials; try again shortly");
-      await new Promise((resolve2) => setTimeout(resolve2, 150));
-    }
+    }, () => updated.length ? `Updated ${updated.map((name) => c.code(name)).join(", ")} ${c.muted(`(${project.packageManager}, ${Math.max(1, Math.round((Date.now() - started) / 1e3))}s)`)}` : "UserReason packages are already current");
+    const globalCli2 = await offerGlobalCli(project, terminal, { installed: true, requested: values["global-cli"], skip: !values["global-cli"], force: values.install, verbose: values.debug, profile, preview: Boolean(values.diff) });
+    const agentNote2 = await offerAgentNote(project, terminal, { installed: true, requested: values["agent-note"], skip: !values["agent-note"], preview: Boolean(values.diff) });
+    const agentSkill2 = await offerAgentSkill(project, terminal, { installed: true, requested: values["agent-skill"], skip: !values["agent-skill"], preview: Boolean(values.diff) });
+    const cliAccess2 = values["cli-access"] ? await offerCliAccess(await resolveConfig({ development: developmentApi, apiUrl: existing.apiBaseUrl, clientId: values["client-id"], credentialStore: values["credential-store"] }), terminal, { installed: true, requested: true, noOpen: values["no-open"], development: developmentApi, preview: Boolean(values.diff) }) : { status: "skipped" };
+    const untouched = [!values["global-cli"] && ["global command", "--global-cli"], !values["agent-note"] && ["AGENTS.md note", "--agent-note"], !values["agent-skill"] && ["agent skill", "--agent-skill"], !values["cli-access"] && ["CLI access", "--cli-access"]].filter(Boolean);
+    terminal.block("Ready", [
+      c.muted("Reload or restart your app to load the updated SDK."),
+      ...untouched.length ? [c.muted(`Not touched (${untouched.map(([name]) => name).join(", ")})`), `${c.muted("Add")} ${c.code(untouched.map(([, flag]) => flag).join(" "))} ${c.muted("to include them")}`] : []
+    ], { kind: "done" });
+    if (values.json) process.stdout.write(JSON.stringify({
+      global_cli: globalCli2,
+      cli_access: cliAccess2,
+      refreshed: true,
+      sdk_installed: true,
+      cli_installed: true,
+      api_environment: apiEnvironment,
+      wizard_version: version,
+      sdk_required_version: profile.sdkVersion,
+      cli_required_version: profile.cliVersion,
+      build_id: profile.buildId,
+      agent_note: agentNote2,
+      agent_skill: agentSkill2
+    }) + "\n");
+    return;
   }
-  try {
-    return await operation();
-  } finally {
-    try {
-      const own = JSON.parse(await readFile2(path, "utf8"));
-      if (own.id === id)
-        await unlink(path);
-    } catch {
+  currentStep = "Preparing the application integration";
+  const plan = values["skip-integrate"] ? void 0 : await planIntegration(project);
+  if (plan && plan.status !== "ready") terminal.info(plan.reason);
+  const sdkCurrent = await hasCompatibleSdk(project, profile), cliCurrent = await hasCompatibleCli(project, profile);
+  const packages = [!sdkCurrent || values.install ? "@userreason/js" : "", !cliCurrent || values.install ? "@userreason/cli" : ""].filter(Boolean);
+  if (values["dry-run"]) {
+    currentStep = "Planning without changes";
+    const additions2 = plan ? integrationAdditions(plan) : void 0;
+    const note = values["skip-agent-note"] ? void 0 : await planAgentNote(project, { beforeInstall: true }).catch(() => void 0);
+    const skill = values["skip-agent-skill"] ? void 0 : await planAgentSkill(project).catch(() => void 0);
+    const steps = [
+      { action: "approve", needs: "browser" },
+      ...packages.length ? [{ action: "install", packages }] : [],
+      ...additions2 ? [{ action: "edit", file: additions2.path, status: "ready", added_lines: additions2.added.length, flag: "--integrate", recommended: true }] : [],
+      ...note && "path" in note ? [{ action: "write", file: note.file, flag: "--agent-note", status: "ready", recommended: true }] : [],
+      ...skill && "files" in skill ? [{ action: "write", file: ".agents/skills/userreason", flag: "--agent-skill", status: "ready", recommended: true }] : [],
+      ...!values["skip-cli-access"] && !values["session-only"] ? [{ action: "authorize", flag: "--cli-access", needs: "browser", recommended: true }] : [],
+      ...!values["skip-global-cli"] && !values["skip-install"] ? [{ action: "install_global", flag: "--global-cli", recommended: false }] : []
+    ];
+    const launcher = profile.kind === "local-development" ? `npx -y --prefer-online --registry=${profile.registry} @userreason/wizard@latest` : "npx -y @userreason/wizard@latest";
+    const run = [launcher, "--yes", ...steps.filter((step) => "recommended" in step && step.recommended && "flag" in step && step.flag && step.action !== "authorize").map((step) => step.flag)].join(" ");
+    if (values.json) {
+      process.stdout.write(JSON.stringify({
+        dry_run: true,
+        project: { framework: project.framework, package_manager: project.packageManager, name: project.name },
+        steps,
+        site: "Pass --site UUID to use an existing site, or --site-name NAME to create one.",
+        run
+      }, null, 2) + "\n");
+    } else {
+      terminal.info(`Dry run${dot}${c.muted("nothing is signed in, written or installed")}`);
+      terminal.block("Plan", terminal.kit.cols(steps.map((step) => {
+        const what = "file" in step ? String(step.file) : "packages" in step && step.packages ? step.packages.join(" ") : "needs" in step ? String(step.needs) : "";
+        const flag = "flag" in step && step.flag ? `(${step.flag})` : "";
+        const label = "recommended" in step ? step.recommended ? "recommended" : "optional" : "";
+        return [c.code(step.action), [[what, flag].filter(Boolean).join(" "), label].filter(Boolean).join(dot)];
+      })), { kind: "next", each: true });
+      terminal.block("Run it", [c.code(run)], { kind: "next", each: true });
     }
+    return;
   }
-}
-
-// ../ur-cli/dist/client.js
-var ApiError = class extends Error {
-  status;
-  code;
-  approvalUrl;
-  constructor(status, code, approvalUrl) {
-    super(`UserReason request failed (${status}, ${code})${approvalUrl ? `. Approve access at ${approvalUrl}` : ""}`);
-    this.status = status;
-    this.code = code;
-    this.approvalUrl = approvalUrl;
-  }
-};
-var UserReasonClient = class {
-  config;
-  credentials;
-  options;
-  fetcher;
-  constructor(config, credentials, options = {}) {
-    this.config = config;
-    this.credentials = credentials;
-    this.options = options;
-    this.fetcher = options.fetcher ?? fetch;
-  }
-  async token(forceRefresh = false, previous) {
-    const lock = this.options.lock ?? ((operation) => withSessionLock(this.config, operation));
-    return lock(async () => {
-      const current = await this.credentials.load();
-      if (!current)
-        throw new Error("Run userreason login first");
-      if (current.apiUrl !== this.config.apiUrl || current.clientId !== this.config.clientId)
-        throw new Error("Stored login belongs to a different environment or WorkOS client");
-      if (current.expiresAt > Date.now() + 6e4 && (!forceRefresh || current.accessToken !== previous))
-        return current;
-      return refresh(this.config, this.credentials, current, this.fetcher);
+  currentStep = "Discovering authentication configuration";
+  const config = await resolveConfig({
+    development: developmentApi,
+    apiUrl: values["api-url"],
+    clientId: values["client-id"],
+    credentialStore: values["credential-store"]
+  });
+  let resumeStorageBlocked = false;
+  const warnResumeStorage = () => {
+    if (resumeStorageBlocked) return;
+    resumeStorageBlocked = true;
+    terminal.warn(`Resume details can't be saved
+  ${c.muted("If setup is interrupted, choose the same workspace and site on rerun.")}`);
+  };
+  currentStep = "Reading saved installation details";
+  const saved = !values["workspace-name"] && !values["site-name"] && !(values.workspace && values.site) ? await savedInstallation(project, config.apiUrl, warnResumeStorage) : void 0;
+  if (saved && saved.apiBaseUrl !== config.apiUrl && !values.force)
+    throw new Error(
+      "Saved installation belongs to a different API. Review the configuration and use --force to replace it."
+    );
+  let workspaceChoice = values.workspace ? uuid(values.workspace) : saved?.workspaceId;
+  const siteChoice = values.site ? uuid(values.site) : saved?.siteId;
+  const resumed = Boolean(saved && !values.workspace && !values.site);
+  if (siteChoice && !workspaceChoice) {
+    currentStep = "Resolving the existing site";
+    const origin = values.origin ? normalizeOrigin(values.origin, newSiteEnvironment === "development" ? "development" : "production") : void 0;
+    workspaceChoice = (await resolveInstallation({ siteId: siteChoice, apiBaseUrl: config.apiUrl }, origin)).workspaceId;
+  }
+  let credentials = resolveCredentials(config), client = new UserReasonClient(config, credentials), connection;
+  const open = async (url) => !values["no-open"] && await openBrowser(url);
+  const approvalWait = async (label, url, note) => {
+    const opened = await open(url);
+    if (opened && values.debug) terminal.info(url);
+    const text = opened ? label : "Open this link to approve";
+    return terminal.waiting(note ? `${text}${dot}${note}` : text, opened ? {} : { link: url });
+  };
+  const deviceSignIn = async () => {
+    let waiting2;
+    await login(config, credentials, async (device) => {
+      waiting2 = await approvalWait("Sign in in the browser", device.verificationUriComplete, `${c.muted("code")} ${c.code(device.userCode)}`);
     });
-  }
-  async request(path, body) {
-    if (!path.startsWith("/onboarding/v1/") || path.includes("//") || path.includes("\\"))
-      throw new Error("Invalid UserReason API path");
-    let session2 = await this.token();
-    for (let attempt = 0; attempt < 2; attempt++) {
-      const response = await this.fetcher(this.config.apiUrl + path, { method: body === void 0 ? "GET" : "POST", redirect: "error", headers: { Authorization: `Bearer ${session2.accessToken}`, "x-ur-client": "cli", "Content-Type": "application/json" }, ...body === void 0 ? {} : { body: JSON.stringify(body) }, signal: AbortSignal.timeout(2e4) });
-      if (response.status === 401 && attempt === 0) {
-        session2 = await this.token(true, session2.accessToken);
-        continue;
-      }
-      let result;
-      try {
-        result = await response.json();
-      } catch {
-        throw new ApiError(response.status, "invalid_response");
+    waiting2?.stop("Signed in");
+  };
+  let waiting;
+  let unrestrictedOrigins = false;
+  currentStep = "Connecting browser sign-in and approval";
+  try {
+    connection = await connectInstallation(
+      config,
+      {
+        projectName: project.name.slice(0, 240),
+        workspaceId: workspaceChoice,
+        workspaceName: values["workspace-name"],
+        siteId: siteChoice
+      },
+      async (url, code) => {
+        const note = code ? `${c.muted("code")} ${c.code(code)}` : void 0;
+        const opened = await open(url);
+        if (opened && values.debug) terminal.info(url);
+        const label = opened ? "Approve in the browser" : "Open this link to approve";
+        waiting = terminal.waiting(note ? `${label}${dot}${note}` : label, opened ? {} : { link: url });
+        const progressNote = note ? `${dot}${note}` : "";
+        approvalProgress = (value) => waiting?.update(`${value.phase === "waiting" ? label : approvalStatus(value)}${progressNote}`);
+      },
+      {
+        onCapabilities: (value) => {
+          unrestrictedOrigins = value.unrestrictedOrigins;
+        },
+        onProgress: (value) => approvalProgress?.(value)
       }
-      if (!response.ok) {
-        const data = object(result, "error"), detail = typeof data.error === "object" && data.error ? object(data.error, "error") : data;
-        const code = typeof detail.code === "string" && /^[a-z0-9_:-]{1,100}$/i.test(detail.code) ? detail.code : typeof data.error === "string" && /^[a-z0-9_:-]{1,100}$/i.test(data.error) ? data.error : "request_failed";
-        const candidate = detail.approval_url ?? data.approval_url;
-        let approvalUrl;
-        if (typeof candidate === "string") {
-          try {
-            const url = new URL(candidate);
-            if (url.protocol === "https:" && !url.username && !url.password)
-              approvalUrl = url.toString();
-          } catch {
-          }
-        }
-        throw new ApiError(response.status, code, approvalUrl);
+    );
+    waiting?.stop();
+    credentials = memoryCredentials(connection.session);
+    client = new UserReasonClient(config, credentials, {
+      lock: (operation) => operation()
+    });
+  } catch (error) {
+    waiting?.stop();
+    if (!(error instanceof BrowserConnectionUnavailable)) throw error;
+    terminal.info(`This API uses the earlier sign-in flow${dot}${c.muted("installation approval opens after sign-in")}`);
+    const compatibility = await compatibilityCredentials(
+      credentials,
+      Boolean(values["session-only"]),
+      async (error2) => {
+        terminal.warn(error2.message);
+        if (!terminal.interactive)
+          throw new Error(
+            "The selected credential store is unavailable. Rerun with --session-only to keep login only in memory."
+          );
+        return terminal.confirm("Keep this session in memory only? No credentials will be saved.");
       }
-      return result;
+    );
+    credentials = compatibility.credentials;
+    client = new UserReasonClient(
+      config,
+      credentials,
+      compatibility.sessionOnly ? { lock: (operation) => operation() } : {}
+    );
+    if (compatibility.sessionOnly) terminal.info("Login is kept only in memory for this run.");
+    if (!compatibility.session) {
+      await deviceSignIn();
+      if (!compatibility.sessionOnly) await saveConfig(config, developmentApi);
     }
-    throw new ApiError(401, "authentication_required");
-  }
-  async account() {
-    const data = object(await this.request("/onboarding/v1/account"), "account"), user = object(data.user, "user");
-    uuid(string(user.id, "user ID"));
-    if (!Array.isArray(data.workspaces) || !Array.isArray(data.grants))
-      throw new Error("Invalid account memberships");
-    return { ...data, user, workspaces: data.workspaces.map(workspace) };
-  }
-  async createWorkspace(name, options = {}) {
-    if (!name.trim() || name.length > 240)
-      throw new Error("Workspace name must contain 1\u2013240 characters");
-    const value = object(await this.request("/onboarding/v1/workspaces", { request_id: uuid(options.requestId ?? randomUUID2()), workspace_id: uuid(options.workspaceId ?? randomUUID2()), name: name.trim() }), "workspace creation");
-    return workspace(value.workspace ?? value);
-  }
-  async sites(workspaceId) {
-    const data = object(await this.request(`/onboarding/v1/workspaces/${uuid(workspaceId)}/sites`), "sites"), items = data.items ?? data.sites;
-    if (!Array.isArray(items))
-      throw new Error("Invalid site list");
-    return items.map(site);
-  }
-  async createSite(input) {
-    if (!input.name.trim() || input.name.length > 240)
-      throw new Error("Site name must contain 1\u2013240 characters");
-    const value = object(await this.request("/onboarding/v1/sites", { request_id: uuid(input.requestId ?? randomUUID2()), workspace_id: uuid(input.workspaceId), site_id: uuid(input.siteId ?? randomUUID2()), name: input.name.trim(), environment: input.environment, allowed_origins: input.origins }), "site creation");
-    return site(value.site ?? value);
-  }
-  async requestGrant(input) {
-    if (!input.scopes.length || input.scopes.length > 7)
-      throw new Error("Request at least one supported permission");
-    return grantRequest(await this.request("/onboarding/v1/grants/request", { request_id: uuid(input.requestId ?? randomUUID2()), workspace_id: input.workspaceId ? uuid(input.workspaceId) : null, site_ids: input.siteIds?.map((id) => uuid(id)) ?? null, scopes: [...new Set(input.scopes)] }));
   }
-  async grantStatus(id) {
-    return grantRequest(await this.request(`/onboarding/v1/grants/requests/${uuid(id)}`));
-  }
-  /** The server parses the complete versioned command and derives authorization from the verified caller. */
-  async command(input) {
-    uuid(string(input.workspace_id, "workspace ID"));
-    uuid(string(input.request_id, "request ID"));
-    if (typeof input.action !== "string" || !/^[a-z]+\.[a-z]+$/.test(input.action))
-      throw new Error("Command requires a supported resource.action");
-    if (input.action === "workspace.create" || input.action === "site.create")
-      throw new Error("Use workspace create or site create for authenticated onboarding");
-    return this.request("/onboarding/v1/command", input);
-  }
-  async query(input) {
-    if (!["sites", "surveys", "campaigns", "events", "responses", "audits"].includes(input.resource))
-      throw new Error("Unsupported query resource");
-    const limit = input.limit ?? 50;
-    if (!Number.isInteger(limit) || limit < 1 || limit > 100)
-      throw new Error("Query limit must be an integer from 1 to 100");
-    return this.request("/onboarding/v1/query", { workspace_id: uuid(input.workspaceId), ...input.siteId ? { site_id: uuid(input.siteId) } : {}, resource: input.resource, limit, ...input.after ? { after: uuid(input.after) } : {} });
-  }
-  async waitForGrant(id, options = {}) {
-    const deadline = Date.now() + (options.timeoutMs ?? 3e5);
-    do {
-      const request = await this.grantStatus(id);
-      options.onStatus?.(request);
-      if (request.status === "approved")
-        return request;
-      if (request.status !== "pending")
-        throw new Error(`Access request ${request.status}; request access again if needed`);
-      if (request.expires_at && Date.parse(request.expires_at) <= Date.now())
-        throw new Error("Access request expired; request access again");
-      await new Promise((resolve2) => setTimeout(resolve2, options.intervalMs ?? 2e3));
-    } while (Date.now() < deadline);
-    throw new Error("Access approval timed out; check userreason grant status --id " + id);
-  }
-};
-
-// ../ur-cli/dist/credentials.js
-import { createHash as createHash2 } from "node:crypto";
-function keychainCredentials(config) {
-  const account = createHash2("sha256").update(`${config.apiUrl}
-${config.clientId}`).digest("hex");
-  async function entry() {
+  const approve = async (workspaceId, creation = true) => {
+    const request = await client.requestGrant({
+      workspaceId,
+      scopes: [
+        ...!workspaceId ? ["workspace:create"] : [],
+        "workspace:read",
+        "site:read",
+        ...creation ? ["site:create"] : []
+      ]
+    });
+    if (request.status === "approved") return request;
+    const pending = request.approval_url ? await approvalWait("Approve installation in the browser", request.approval_url) : terminal.waiting("Waiting for installation approval");
     try {
-      const { Entry } = await import("@napi-rs/keyring");
-      return new Entry("com.userreason.cli", account, { linux: { store: "secret-service" } });
-    } catch {
-      throw new Error("UserReason cannot access the OS credential store. Enable macOS Keychain, Windows Credential Manager or Linux Secret Service; credentials will not be written to a plaintext file.");
-    }
-  }
-  return {
-    async load() {
-      let serialized;
-      try {
-        serialized = (await entry()).getPassword();
-      } catch (error) {
-        if (/No entry|NoEntry|not found|not exist/i.test(String(error.message)))
-          return null;
-        throw new Error("Unable to read the UserReason OS credential-store entry");
-      }
-      if (!serialized)
-        return null;
-      try {
-        const session2 = JSON.parse(serialized);
-        if (session2.apiUrl !== config.apiUrl || session2.clientId !== config.clientId || typeof session2.accessToken !== "string" || typeof session2.refreshToken !== "string" || typeof session2.expiresAt !== "number")
-          throw new Error();
-        return session2;
-      } catch {
-        throw new Error("Invalid stored UserReason session; run userreason logout, then login again");
-      }
-    },
-    async save(session2) {
-      try {
-        (await entry()).setPassword(JSON.stringify(session2));
-      } catch {
-        throw new Error("Unable to save the UserReason session in the OS credential store");
-      }
-    },
-    async clear() {
-      try {
-        (await entry()).deletePassword();
-      } catch (error) {
-        if (!/No entry|NoEntry|not found|not exist/i.test(String(error.message)))
-          throw new Error("Unable to remove the UserReason OS credential-store entry");
-      }
-    }
-  };
-}
-
-// src/project.ts
-import { lstat, readFile as readFile3, writeFile as writeFile2, access, copyFile } from "node:fs/promises";
-import { join as join3, resolve, dirname } from "node:path";
-import { spawn } from "node:child_process";
-var exists = async (path) => {
-  try {
-    await access(path);
-    return true;
-  } catch {
-    return false;
-  }
-};
-async function inspectProject(directory, framework) {
-  directory = resolve(directory);
-  const metadata = await lstat(directory);
-  if (!metadata.isDirectory()) throw new Error("Project directory must be an existing directory");
-  const text = await readFile3(join3(directory, "package.json"), "utf8");
-  if (text.length > 1e6) throw new Error("Project package.json is too large");
-  const data = JSON.parse(text);
-  if (!data || typeof data !== "object" || Array.isArray(data)) throw new Error("Invalid project package.json");
-  const dependencies = { ...data.dependencies, ...data.devDependencies };
-  const inferred = dependencies.next ? "next" : dependencies.react ? "react" : dependencies.vue ? "vue" : "vanilla";
-  const packageManager = typeof data.packageManager === "string" && /^(pnpm|yarn)@/.test(data.packageManager) ? data.packageManager.split("@")[0] : await exists(join3(directory, "pnpm-lock.yaml")) ? "pnpm" : await exists(join3(directory, "yarn.lock")) ? "yarn" : "npm";
-  const yarnMajor = packageManager === "yarn" ? typeof data.packageManager === "string" && /^yarn@\d+/.test(data.packageManager) ? Number(data.packageManager.slice(5).split(".")[0]) : await exists(join3(directory, ".yarnrc.yml")) ? 4 : 1 : void 0;
-  return { directory, framework: framework ?? inferred, sourceDirectory: await exists(join3(directory, "src")) ? join3(directory, "src") : directory, packageManager, yarnMajor, name: typeof data.name === "string" && data.name ? data.name : "My site" };
-}
-function integrationSource(framework, config) {
-  const options = JSON.stringify(config, null, 2);
-  const base = `// Generated by the UserReason wizard. Contains public SDK configuration only.
-`;
-  if (framework === "next" || framework === "react") return {
-    filename: "userreason.generated.tsx",
-    content: `${framework === "next" ? "'use client';\n" : ""}${base}import { useEffect, useLayoutEffect } from 'react';
-import UserReason from '@userreason/js';
-
-// Initialize before descendant passive effects; no effects run during SSR.
-const useBrowserLayoutEffect = typeof window === 'undefined' ? useEffect : useLayoutEffect;
-
-export function UserReasonProvider() {
-  useBrowserLayoutEffect(() => {
-    UserReason.init(${options});
-    return () => UserReason.destroy();
-  }, []);
-  return null;
-}
-`,
-    instruction: framework === "next" ? "Import UserReasonProvider into your root layout and render <UserReasonProvider /> once inside <body>." : "Import UserReasonProvider into your root application and render <UserReasonProvider /> once."
-  };
-  if (framework === "vue") return { filename: "userreason.generated.ts", content: `${base}import { onBeforeMount, onBeforeUnmount } from 'vue';
-import UserReason from '@userreason/js';
-
-export function useUserReason() {
-  onBeforeMount(() => UserReason.init(${options}));
-  onBeforeUnmount(() => UserReason.destroy());
-}
-`, instruction: "Import useUserReason into your root Vue component and call it once inside setup()." };
-  return { filename: "userreason.generated.ts", content: `${base}import UserReason from '@userreason/js';
-
-export function initializeUserReason() {
-  UserReason.init(${options});
-  return () => UserReason.destroy();
-}
-`, instruction: "Import initializeUserReason at your application entry and call it once after the document body is available. Call the returned cleanup function on teardown." };
-}
-async function writeGenerated(path, content, force) {
-  try {
-    await writeFile2(path, content, { flag: "wx", mode: 420 });
-    return;
-  } catch (error) {
-    if (error.code !== "EEXIST") throw error;
-  }
-  const metadata = await lstat(path);
-  if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error(`Refusing to overwrite a non-file: ${path}`);
-  if (await readFile3(path, "utf8") === content) return;
-  if (!force) throw new Error(`Existing file differs: ${path}. Review it and rerun with --force to create a backup and replace it.`);
-  await copyFile(path, `${path}.backup-${Date.now()}`);
-  await writeFile2(path, content, { mode: 420 });
-}
-async function writeIntegration(project, config, force = false) {
-  const helper = integrationSource(project.framework, config), configPath = join3(project.directory, "userreason.config.json"), helperPath = join3(project.sourceDirectory, helper.filename);
-  const source = await lstat(dirname(helperPath));
-  if (!source.isDirectory() || source.isSymbolicLink()) throw new Error("Source directory must be a real directory inside the project");
-  await writeGenerated(configPath, JSON.stringify({ schemaVersion: 1, sdkVersion: ">=0.2.0", ...config }, null, 2) + "\n", force);
-  await writeGenerated(helperPath, helper.content, force);
-  return { files: [configPath, helperPath], instruction: helper.instruction };
-}
-async function installSdk(project) {
-  const args = project.packageManager === "npm" ? ["install", "--ignore-scripts", "@userreason/js@^0.2.0"] : project.packageManager === "pnpm" ? ["add", "--ignore-scripts", "@userreason/js@^0.2.0"] : (project.yarnMajor ?? 1) >= 2 ? ["add", "--mode=skip-builds", "@userreason/js@^0.2.0"] : ["add", "--ignore-scripts", "@userreason/js@^0.2.0"];
-  await new Promise((resolve2, reject) => {
-    const child = spawn(project.packageManager, args, { cwd: project.directory, stdio: ["ignore", process.stderr, process.stderr], shell: false, env: { ...process.env, YARN_ENABLE_SCRIPTS: "false", npm_config_ignore_scripts: "true" } });
-    child.on("error", () => reject(new Error(`Unable to start ${project.packageManager}; install @userreason/js@^0.2.0 manually`)));
-    child.on("exit", (code) => code === 0 ? resolve2() : reject(new Error("SDK installation failed. Publish/install the remote-compatible @userreason/js >=0.2.0 package, then rerun the wizard using the existing workspace/site.")));
-  });
-}
-async function verifyConfiguration(config, hostOrigin, fetcher = fetch) {
-  const response = await fetcher(`${config.apiBaseUrl}/v1/sdk/${config.workspaceId}/${config.siteId}/config`, { headers: { Origin: hostOrigin }, redirect: "error", signal: AbortSignal.timeout(2e4) });
-  if (!response.ok) throw new Error(`Site configuration check failed (${response.status}); verify its allowed origins and Worker deployment`);
-  const data = await response.json();
-  if (data.workspace_id !== config.workspaceId || data.site_id !== config.siteId || !data.payload || typeof data.payload !== "object") throw new Error("Worker returned a configuration for a different or invalid site");
-  return { configured: true, hostConnectionVerified: false };
-}
-
-// src/bin.ts
-var help = `UserReason installation wizard
-
-userreason-wizard [--directory PATH] [--dev] [--origin URL]
-
---workspace UUID / --workspace-name NAME
---site UUID / --site-name NAME
---environment development|production
---framework react|next|vue|vanilla
---install / --skip-install
---yes (non-interactive; requires workspace/site selections or names and origin)
---force (back up and replace generated files)
---client-id CLIENT_ID, --api-url ORIGIN, --json
-
-Requires remote-compatible @userreason/js >=0.2.0. Only public configuration is written to your project.
-`;
-async function main() {
-  const parsed = parseArgs({ allowPositionals: false, options: { help: { type: "boolean", short: "h" }, dev: { type: "boolean" }, yes: { type: "boolean" }, install: { type: "boolean" }, "skip-install": { type: "boolean" }, force: { type: "boolean" }, json: { type: "boolean" }, directory: { type: "string" }, origin: { type: "string" }, workspace: { type: "string" }, "workspace-name": { type: "string" }, site: { type: "string" }, "site-name": { type: "string" }, environment: { type: "string" }, framework: { type: "string" }, "client-id": { type: "string" }, "api-url": { type: "string" } } });
-  const values = parsed.values;
-  if (values.help) {
-    process.stdout.write(help);
-    return;
-  }
-  if (values.install && values["skip-install"]) throw new Error("Choose either --install or --skip-install");
-  const framework = values.framework;
-  if (framework && !["react", "next", "vue", "vanilla"].includes(framework)) throw new Error("Unsupported framework");
-  const project = await inspectProject(values.directory ?? process.cwd(), framework);
-  const config = await resolveConfig({ development: values.dev, apiUrl: values["api-url"], clientId: values["client-id"] });
-  const credentials = keychainCredentials(config), client = new UserReasonClient(config, credentials);
-  const interactive = !values.yes && process.stdin.isTTY;
-  const terminal = interactive ? createInterface({ input: process.stdin, output: process.stderr }) : void 0;
-  const ask = async (question, fallback) => {
-    if (!terminal) {
-      if (fallback !== void 0) return fallback;
-      throw new Error(`Missing selection: ${question}. Supply the corresponding command option for non-interactive use.`);
+      const granted = await client.waitForGrant(request.id);
+      pending.stop("Installation approved");
+      return granted;
+    } catch (error) {
+      pending.stop();
+      throw error;
     }
-    return (await terminal.question(question + (fallback ? ` [${fallback}]` : "") + ": ")).trim() || fallback || "";
-  };
-  const approve = async (workspaceId) => {
-    const request = await client.requestGrant({ workspaceId, scopes: workspaceId ? ["workspace:read", "site:read", "site:create", "site:update"] : ["workspace:create", "workspace:read", "site:read", "site:create", "site:update"] });
-    if (request.status === "approved") return request;
-    if (request.approval_url) process.stderr.write(`Approve this installation in your browser: ${request.approval_url}
-`);
-    return client.waitForGrant(request.id);
   };
   const authorized = async (operation, workspaceId) => {
     try {
       return await operation();
     } catch (error) {
-      if (!(error instanceof ApiError) || error.status !== 403 || !["authorization_required", "grant_required"].includes(error.code)) throw error;
-      await approve(workspaceId);
+      if (!(error instanceof ApiError) || error.status !== 403 || !["authorization_required", "grant_required"].includes(error.code) || connection)
+        throw error;
+      await approve(workspaceId, !siteChoice);
       return operation();
     }
   };
+  currentStep = "Loading the approved account";
+  let account;
   try {
-    let stored = await credentials.load();
-    if (!stored) {
-      stored = await login(config, credentials, (device) => {
-        process.stderr.write(`Sign in at ${device.verificationUriComplete}
-Confirm code: ${device.userCode}
-`);
-      });
-      await saveConfig(config, values.dev);
+    account = await client.account();
+  } catch (error) {
+    if (!(error instanceof AuthenticationError) || error.code !== "invalid_grant") throw error;
+    await deviceSignIn();
+    account = await client.account();
+  }
+  const who = connection ? clean(connection.session.email) : void 0;
+  let selectedWorkspace;
+  const approvedWorkspace = connection?.workspaceId ?? workspaceChoice;
+  if (approvedWorkspace) {
+    selectedWorkspace = account.workspaces.find((item) => item.id === approvedWorkspace);
+    if (!selectedWorkspace && !connection) {
+      await approve(approvedWorkspace, !siteChoice);
+      account = await client.account();
+      selectedWorkspace = account.workspaces.find((item) => item.id === approvedWorkspace);
     }
-    let account;
+    if (!selectedWorkspace) throw new Error("The selected workspace is not available to this installation");
+    if (who) terminal.success(`Signed in as ${who} ${c.muted(`(workspace ${clean(selectedWorkspace.name)})`)}`);
+  } else {
+    if (who) terminal.success(`Signed in as ${who}`);
+    if (!connection?.workspaceName && !values["workspace-name"] && account.workspaces.length) {
+      const selected = await terminal.select(
+        "Workspace",
+        [
+          ...account.workspaces.map((item) => ({
+            value: item.id,
+            label: item.name
+          })),
+          { value: "new", label: "New workspace" }
+        ],
+        account.workspaces[0]?.id
+      );
+      selectedWorkspace = account.workspaces.find((item) => item.id === selected);
+    }
+  }
+  if (!who && selectedWorkspace) terminal.success(`Workspace: ${clean(selectedWorkspace.name)}`);
+  let selectedSite;
+  currentStep = "Selecting the workspace and site";
+  const siteDetail = (item) => `${item.environment}, ${item.allowed_origins.map(clean).join(", ") || "any domain"}`;
+  if (selectedWorkspace) {
+    const sites = await authorized(() => client.sites(selectedWorkspace.id), selectedWorkspace.id);
+    if (siteChoice) {
+      selectedSite = sites.find((item) => item.id === siteChoice);
+      if (!selectedSite) throw new Error("The selected site is not available in this workspace");
+      terminal.info(resumed ? `Resuming an interrupted setup${dot}${c.muted(`${clean(selectedWorkspace.name)} ${S.arrow} ${clean(selectedSite.name)}`)}` : `Site ${c.code(clean(selectedSite.name))} ${c.muted(`(${siteDetail(selectedSite)})`)}`);
+    } else if (!values["site-name"] && sites.length) {
+      const width = Math.max(...sites.map((item) => clean(item.name).length));
+      const selected = await terminal.select(
+        "Site",
+        [
+          ...sites.map((item) => ({
+            value: item.id,
+            label: `${clean(item.name).padEnd(width)}  ${c.muted(siteDetail(item))}`
+          })),
+          { value: "new", label: "New site" }
+        ],
+        sites[0]?.id
+      );
+      selectedSite = sites.find((item) => item.id === selected);
+    }
+  }
+  const environment = selectedSite?.environment ?? newSiteEnvironment;
+  if (environment !== "production" && environment !== "development")
+    throw new Error("Invalid site environment");
+  const validateOrigin = (value) => {
     try {
-      account = await client.account();
+      const normalized = normalizeOrigin(value, environment);
+      if (selectedSite?.allowed_origins.length && !selectedSite.allowed_origins.includes(normalized))
+        return `This site allows ${selectedSite.allowed_origins.join(", ")}. Choose one or add your origin through the dashboard.`;
+    } catch (error) {
+      return error instanceof Error ? error.message : "Enter a valid app origin";
+    }
+  };
+  const rawOrigin = values.origin ?? selectedSite?.allowed_origins[0];
+  const invalidOrigin = rawOrigin ? validateOrigin(rawOrigin) : void 0;
+  if (invalidOrigin) throw new Error(invalidOrigin);
+  const hostOrigin = rawOrigin ? normalizeOrigin(rawOrigin, environment) : void 0;
+  if (!selectedSite && !hostOrigin && !unrestrictedOrigins)
+    throw new Error("This API has not enabled domain-free installation yet. Deploy the updated UserReason Worker, or use --origin to configure an explicit restriction. No workspace or site was created.");
+  const siteName = selectedSite?.name ?? values["site-name"] ?? await terminal.text("Site name", project.name.slice(0, 240), nameError);
+  const workspaceName = selectedWorkspace?.name ?? connection?.workspaceName ?? values["workspace-name"] ?? await terminal.text("New workspace name", void 0, nameError);
+  if (nameError(siteName) || nameError(workspaceName))
+    throw new Error("Workspace and site names must contain 1\u2013240 characters");
+  const workspaceIds = selectedWorkspace ? void 0 : { requestId: randomUUID(), workspaceId: randomUUID() };
+  const siteIds = selectedSite ? void 0 : { requestId: randomUUID(), siteId: randomUUID() };
+  const installation = {
+    workspaceId: selectedWorkspace?.id ?? workspaceIds.workspaceId,
+    siteId: selectedSite?.id ?? siteIds.siteId,
+    apiBaseUrl: config.apiUrl
+  };
+  currentStep = "Preparing the application integration";
+  const reviewed = values["skip-integrate"] ? void 0 : await planIntegration(project, installation);
+  const additions = reviewed ? integrationAdditions(reviewed) : void 0;
+  const legacyNext = project.framework === "next" && !project.nextInstrumentation && plan?.status !== "integrated";
+  const noteProbe = values["skip-agent-note"] ? void 0 : await planAgentNote(project, { beforeInstall: true }).catch(() => void 0);
+  const skillProbe = values["skip-agent-skill"] ? void 0 : await planAgentSkill(project).catch(() => void 0);
+  const inPlace = [
+    noteProbe && !("path" in noteProbe) && noteProbe.status === "already_present" ? `${noteProbe.file ?? "AGENTS.md"} note` : "",
+    skillProbe && !("files" in skillProbe) && skillProbe.status === "already_present" ? "Agent skill" : ""
+  ].filter(Boolean);
+  if (inPlace.length) terminal.info(`Already in place${dot}${c.muted(inPlace.join(", "))}`);
+  const installRow = packages.length ? `${c.muted("install")}  ${c.code(packages.join("  "))}` : c.muted(`nothing to install${dot}@userreason/js and @userreason/cli are current`);
+  if (reviewed?.status === "ready" && additions) {
+    if (values.diff) terminal.note(integrationPreview(reviewed), `Diff${dot}${additions.path}`);
+    else terminal.block("Changes", [
+      additions.created ? `${c.code(additions.path)} ${c.muted("(new file)")}` : `${c.code(additions.path)}${c.muted(`:${additions.line}`)}`,
+      ...additions.added.map((line) => `${c.good("+")} ${clean(line)}`),
+      ...legacyNext ? [`${c.code(`userreason.client.${project.typescript ? "tsx" : "jsx"}`)} ${c.muted("(new file, generated)")}`] : [],
+      installRow
+    ]);
+  } else terminal.block("Changes", [reviewed?.status === "integrated" && !packages.length ? c.muted(`nothing to edit${dot}@userreason/js and @userreason/cli are current`) : installRow]);
+  const extras = [];
+  if (reviewed?.status === "ready" && additions) extras.push({ value: "edit", label: `${additions.created ? "Create" : "Edit"} ${additions.path}`, hint: "add UserReason.init", initial: true });
+  if (noteProbe && "path" in noteProbe) extras.push({ value: "note", label: `${noteProbe.file} ${noteProbe.replacement ? "note update" : "note"}`, hint: "user-feedback guidance", initial: true });
+  if (skillProbe && "files" in skillProbe) extras.push({ value: "skill", label: skillProbe.update ? "Agent skill update" : "Agent skill", hint: ".agents/skills/userreason", initial: true });
+  if (!values["skip-cli-access"] && !values["session-only"]) extras.push({ value: "access", label: "Ongoing CLI access", hint: "second approval (90 days)", initial: true });
+  if (!values["skip-global-cli"] && !values["skip-install"]) extras.push({ value: "global", label: "Global userreason command", hint: `optional${dot}npm i -g, replaces the current global CLI`, initial: Boolean(values["global-cli"]) });
+  const picked = interactive ? new Set(extras.length ? await terminal.multiselect(`Set up ${c.muted(`${dot.trim()} recommended steps are selected`)}`, extras, extras.filter((item) => item.initial).map((item) => item.value)) : []) : void 0;
+  const integrate = Boolean(reviewed?.status === "ready" && (picked ? picked.has("edit") : values.integrate || values.yes));
+  const choice = (key, flag, skipFlag) => picked ? { requested: picked.has(key), skip: !picked.has(key) } : { requested: Boolean(values[flag]), skip: skipFlag };
+  const noteChoice = choice("note", "agent-note", Boolean(values["skip-agent-note"]));
+  const skillChoice = choice("skill", "agent-skill", Boolean(values["skip-agent-skill"]));
+  const globalChoice = choice("global", "global-cli", Boolean(values["skip-global-cli"] || values["skip-install"]));
+  const accessChoice = choice("access", "cli-access", Boolean(values["skip-cli-access"] || values["session-only"]));
+  terminal.cancelState = "some steps are done; rerun the wizard to continue";
+  if (!selectedWorkspace) {
+    currentStep = "Creating the workspace";
+    try {
+      selectedWorkspace = await client.createWorkspace(workspaceName, workspaceIds);
     } catch (error) {
-      if (!(error instanceof AuthenticationError) || error.code !== "invalid_grant") throw error;
-      await login(config, credentials, (device) => {
-        process.stderr.write(`Sign in at ${device.verificationUriComplete}
-Confirm code: ${device.userCode}
-`);
-      });
+      if (!(error instanceof ApiError) || error.status !== 403 || connection || !["authorization_required", "grant_required"].includes(error.code))
+        throw error;
+      const granted = await approve();
       account = await client.account();
+      const grant = account.grants.find(
+        (item) => item && typeof item === "object" && "id" in item && item.id === granted.grant_id
+      );
+      if (grant?.workspace_id)
+        throw new Error(
+          "An existing workspace was selected in the browser. Rerun the wizard to choose its site."
+        );
+      selectedWorkspace = await client.createWorkspace(workspaceName, workspaceIds);
     }
-    let selectedWorkspace;
-    if (values.workspace) {
-      const requestedId = uuid(values.workspace);
-      selectedWorkspace = account.workspaces.find((item) => item.id === requestedId);
-      if (!selectedWorkspace) {
-        await approve(requestedId);
-        account = await client.account();
-        selectedWorkspace = account.workspaces.find((item) => item.id === requestedId);
+    terminal.success(`Created workspace ${c.code(clean(selectedWorkspace.name))}`);
+  }
+  if (!selectedSite) {
+    currentStep = "Creating the site";
+    selectedSite = await authorized(
+      () => client.createSite({
+        workspaceId: selectedWorkspace.id,
+        name: siteName,
+        environment,
+        origins: hostOrigin ? [hostOrigin] : [],
+        requestId: siteIds.requestId,
+        siteId: siteIds.siteId
+      }),
+      selectedWorkspace.id
+    );
+    terminal.success(`Created site ${c.code(clean(selectedSite.name))}`);
+  }
+  currentStep = "Saving optional installation resume details";
+  if (!await saveInstallation(project.directory, installation)) warnResumeStorage();
+  currentStep = "Preparing initialization files";
+  const generated = await writeIntegration(project, installation, values.force, legacyNext);
+  const existingPlan = plan?.status === "integrated" ? reviewed : plan;
+  if (existingPlan?.status === "manual") terminal.warn(existingPlan.reason);
+  let sdkInstalled = sdkCurrent;
+  let cliInstalled = cliCurrent;
+  const shouldInstall = !values["skip-install"] && Boolean(values.install || !sdkInstalled);
+  const shouldInstallCli = !values["skip-install"] && Boolean(values.install || !cliInstalled);
+  let installFailed = false;
+  if (shouldInstall || shouldInstallCli) {
+    currentStep = "Installing the SDK and CLI";
+    const warnings = [];
+    const failures = [];
+    const started = Date.now();
+    const installed = [];
+    await terminal.task("Installing @userreason/js, @userreason/cli", async () => {
+      if (shouldInstall) {
+        try {
+          await installSdk(project, { profile, verbose: values.debug, onWarning: (message) => {
+            warnings.push(message);
+          } });
+          sdkInstalled = true;
+          installed.push("@userreason/js");
+        } catch (error) {
+          if (!(error instanceof SdkInstallError)) throw error;
+          failures.push({ error, command: sdkInstallCommand(project), title: "Install SDK manually" });
+          return;
+        }
       }
-      if (!selectedWorkspace) throw new Error("Selected workspace is not available to this approved client");
-    } else if (!values["workspace-name"] && account.workspaces.length) {
-      process.stderr.write(account.workspaces.map((item, index) => `${index + 1}. ${item.name} (${item.id})`).join("\n") + "\n");
-      const selected = await ask("Workspace number, or 'new'", interactive ? "1" : void 0);
-      if (selected !== "new") selectedWorkspace = account.workspaces[Number(selected) - 1];
-      if (selected !== "new" && !selectedWorkspace) throw new Error("Invalid workspace selection");
-    }
-    if (!selectedWorkspace) {
-      const name = values["workspace-name"] ?? await ask("New workspace name");
-      const ids = { requestId: randomUUID3(), workspaceId: randomUUID3() };
-      try {
-        selectedWorkspace = await client.createWorkspace(name, ids);
-      } catch (error) {
-        if (!(error instanceof ApiError) || error.status !== 403 || !["authorization_required", "grant_required"].includes(error.code)) throw error;
-        process.stderr.write("Approve a new workspace or select an existing workspace in the browser.\n");
-        const approved = await approve();
-        account = await client.account();
-        const approvedGrant = account.grants.find((value) => value && typeof value === "object" && "id" in value && value.id === approved.grant_id);
-        if (approvedGrant?.workspace_id) {
-          selectedWorkspace = account.workspaces.find((item) => item.id === approvedGrant.workspace_id);
-          if (!selectedWorkspace) throw new Error("The approved workspace also needs workspace:read permission for installation");
-          process.stderr.write(`Continuing in the workspace selected during approval: ${selectedWorkspace.name}
-`);
-        } else selectedWorkspace = await client.createWorkspace(name, ids);
+      if (shouldInstallCli) {
+        try {
+          await installCli(project, { profile, verbose: values.debug, onWarning: (message) => {
+            warnings.push(message);
+          } });
+          cliInstalled = true;
+          installed.push("@userreason/cli");
+        } catch (error) {
+          if (!(error instanceof SdkInstallError)) throw error;
+          failures.push({ error, command: cliInstallCommand(project, profile), title: "Install CLI manually" });
+        }
       }
+    }, () => installed.length ? `Installed ${installed.map((name) => c.code(name)).join(", ")} ${c.muted(`(${project.packageManager}${Date.now() - started >= 2e3 ? `, ${Math.round((Date.now() - started) / 1e3)}s` : ""})`)}` : void 0);
+    for (const message of warnings) terminal.warn(message);
+    for (const failure of failures) {
+      installFailed = true;
+      process.exitCode = 1;
+      terminal.error(failure.error.message);
+      terminal.note(`${failure.command}
+
+Then rerun the wizard. Your saved workspace and site will be reused.`, failure.title);
     }
-    const workspaceId = selectedWorkspace.id;
-    const sites = await authorized(() => client.sites(workspaceId), workspaceId);
-    let selectedSite;
-    if (values.site) {
-      selectedSite = sites.find((item) => item.id === uuid(values.site));
-      if (!selectedSite) throw new Error("Selected site is not in this workspace");
-    } else if (!values["site-name"] && sites.length) {
-      process.stderr.write(sites.map((item, index) => `${index + 1}. ${item.name} (${item.id})`).join("\n") + "\n");
-      const selected = await ask("Site number, or 'new'", interactive ? "1" : void 0);
-      if (selected !== "new") selectedSite = sites[Number(selected) - 1];
-      if (selected !== "new" && !selectedSite) throw new Error("Invalid site selection");
-    }
-    const environment = selectedSite?.environment ?? values.environment ?? (values.dev ? "development" : "production");
-    if (environment !== "production" && environment !== "development") throw new Error("Invalid site environment");
-    const hostOrigin = origin(values.origin ?? await ask("Host site origin", selectedSite?.allowed_origins[0]), environment);
-    if (selectedSite && !selectedSite.allowed_origins.includes(hostOrigin)) throw new Error("This origin is not allowed for the selected site. Add it through the dashboard before continuing.");
-    if (!selectedSite) {
-      const input = { workspaceId, name: values["site-name"] ?? await ask("Site name", project.name), environment, origins: [hostOrigin], requestId: randomUUID3(), siteId: randomUUID3() };
-      selectedSite = await authorized(() => client.createSite(input), workspaceId);
-    }
-    const installation = { workspaceId: selectedWorkspace.id, siteId: selectedSite.id, apiBaseUrl: config.apiUrl };
-    const shouldInstall = values.install || !values["skip-install"] && interactive && /^y(es)?$/i.test(await ask("Install @userreason/js >=0.2.0 now?", "yes"));
-    if (shouldInstall) await installSdk(project);
-    const generated = await writeIntegration(project, installation, values.force);
-    const verification = await verifyConfiguration(installation, hostOrigin);
-    process.stderr.write(`${generated.instruction}
-Start your application and visit the host site to exercise the SDK session/config flow. Configuration availability is checked; a real browser connection has not been verified.
-`);
-    process.stdout.write(JSON.stringify({ workspace: selectedWorkspace, site: selectedSite, framework: project.framework, files: generated.files, sdk_installed: Boolean(shouldInstall), sdk_required_version: ">=0.2.0", verification, next_step: generated.instruction }, null, values.json ? void 0 : 2) + "\n");
-  } finally {
-    terminal?.close();
-  }
+  } else if (sdkInstalled) terminal.success(`UserReason packages already installed ${c.muted("(compatible versions)")}`);
+  if (integrate && reviewed && !installFailed) {
+    currentStep = "Applying the application initialization";
+    const concrete = await planIntegration(project, installation);
+    if (reviewed.status !== "ready" || concrete.status !== "ready" || concrete.path !== reviewed.path || concrete.before !== reviewed.before || concrete.after !== reviewed.after)
+      throw new Error("The application entry changed after the preview. Rerun to review it again.");
+    await applyIntegration(concrete);
+    if (concrete.before === null) generated.files.push(concrete.path);
+    terminal.success(`${concrete.before === null ? "Created" : "Edited"} ${c.code(additions?.path ?? "")}`);
+  }
+  const integrated = Boolean(integrate && !installFailed || existingPlan?.status === "integrated");
+  if (!integrated && !installFailed) terminal.note(generated.instruction, "Application integration");
+  currentStep = "Checking site configuration";
+  const verification = await terminal.task(
+    "Checking site configuration",
+    () => verifyConfiguration(installation, hostOrigin ?? "https://installation.userreason.invalid"),
+    "Site configuration reachable"
+  );
+  if (integrated && sdkInstalled && !installFailed) {
+    currentStep = "Clearing optional installation resume details";
+    if (!await clearInstallation(project.directory, config.apiUrl) && !resumeStorageBlocked)
+      terminal.warn("Setup is complete, but optional resume storage could not be cleared. The installed application initialization takes precedence on reruns.");
+  }
+  const completed = integrated && sdkInstalled && cliInstalled && !installFailed;
+  if (picked && !completed && !installFailed && (picked.has("note") || picked.has("skill")))
+    terminal.warn("The note and skill wait for an initialized SDK. Rerun with the entry edit selected, or apply the initialization yourself first.");
+  currentStep = "Offering the optional user feedback note";
+  const agentNote = await offerAgentNote(project, terminal, { installed: completed, ...noteChoice, preview: Boolean(values.diff) });
+  currentStep = "Offering the optional feedback agent skill";
+  const agentSkill = await offerAgentSkill(project, terminal, { installed: completed, ...skillChoice, preview: Boolean(values.diff) });
+  currentStep = "Offering the optional global CLI";
+  const globalCli = await offerGlobalCli(project, terminal, { installed: cliInstalled && !installFailed, ...globalChoice, force: values.install, verbose: values.debug, profile, preview: Boolean(values.diff) });
+  currentStep = "Offering ongoing CLI access";
+  const cliAccess = await offerCliAccess(config, terminal, { installed: cliInstalled && !installFailed, ...accessChoice, noOpen: values["no-open"], development: developmentApi, preview: Boolean(values.diff) });
+  const nextStep = installFailed ? `Run ${sdkInstalled ? cliInstallCommand(project, profile) : sdkInstallCommand(project, profile)} in your normal terminal, then rerun the wizard to finish setup.` : integrated ? "Start your app and open it in the browser to connect the SDK." : generated.instruction;
+  const siteLine = `${clean(selectedWorkspace.name)} ${S.arrow} ${clean(selectedSite.name)} ${c.muted(`(${siteDetail(selectedSite)})`)}`;
+  terminal.block(installFailed ? "Saved" : "Ready", [c.muted(installFailed ? "SDK installation is pending. After installing, rerun the wizard; your site is reused." : "SDK not connected yet. Start your app to connect it.")], { suffix: siteLine, kind: installFailed ? "warn" : "done" });
+  const start = devCommand(project);
+  const nextRows = installFailed ? [[c.code(sdkInstalled ? cliInstallCommand(project, profile) : sdkInstallCommand(project, profile)), "then rerun the wizard"]] : [
+    ...start ? [[c.code(start), "start your app"]] : [],
+    ...cliInstalled ? [[c.code(`${cliCommand(project)} prompt list`), "surveys for this site"], [c.code(`${cliCommand(project)} login --open`), `connect a teammate (after ${project.packageManager} install)`]] : []
+  ];
+  if (nextRows.length) terminal.block("Next steps", terminal.kit.cols(nextRows), { kind: "next", each: true });
+  if (values.json)
+    process.stdout.write(
+      JSON.stringify({
+        global_cli: globalCli,
+        cli_access: cliAccess,
+        workspace: selectedWorkspace,
+        site: selectedSite,
+        framework: project.framework,
+        api_environment: apiEnvironment,
+        files: generated.files,
+        sdk_installed: sdkInstalled,
+        cli_installed: cliInstalled,
+        ...installFailed ? { sdk_install_command: sdkInstallCommand(project, profile), cli_install_command: cliInstallCommand(project, profile), installation_pending: true } : {},
+        wizard_version: version,
+        sdk_required_version: profile.sdkVersion,
+        cli_required_version: profile.cliVersion,
+        integrated,
+        agent_note: agentNote,
+        agent_skill: agentSkill,
+        verification,
+        next_step: nextStep
+      }) + "\n"
+    );
 }
+var approvalProgress;
 main().catch((error) => {
-  const message = error instanceof Error ? error.message : "Installation failed";
-  process.stderr.write((process.argv.includes("--json") ? JSON.stringify({ error: "wizard_failed", message }) : message) + "\n");
+  const detail = error instanceof Error ? error.message : "Installation failed";
+  if (error instanceof Cancelled) {
+    if (activeTerminal) activeTerminal.cancelled();
+    process.stderr.write(detail + "\n");
+    process.exitCode = 130;
+    return;
+  }
+  const message = `${currentStep}: ${detail}`;
+  if (process.argv.includes("--json"))
+    process.stdout.write(JSON.stringify({ error: "wizard_failed", step: currentStep, message }) + "\n");
+  else if (activeTerminal?.interactive)
+    activeTerminal.error(clean(detail), [`while ${lowerFirst(currentStep)}`]);
+  else process.stderr.write(message + "\n");
   process.exitCode = 1;
 });