workos 0.15.2 → 0.17.0

package/dist/utils/analytics.js

@@ -1,12 +1,21 @@
+import os from 'node:os';
+import { basename } from 'node:path';
 import { v4 as uuidv4 } from 'uuid';
 import { debug } from './debug.js';
 import { telemetryClient } from './telemetry-client.js';
-import { WORKOS_TELEMETRY_ENABLED } from '../lib/constants.js';
+import { isTelemetryEnabled } from '../lib/preferences.js';
+import { getTelemetryUrl, getVersion } from '../lib/settings.js';
+import { getCredentials, isTokenExpired } from '../lib/credentials.js';
+import { getActiveEnvironment, isUnclaimedEnvironment } from '../lib/config-store.js';
+import { getDeviceId } from '../lib/device-id.js';
+import { sanitizeMessage, sanitizeStack } from './crash-reporter.js';
 export class Analytics {
     tags = {};
     sessionId;
     sessionStartTime;
     distinctId;
+    mode;
+    authMode = 'none';
     // Agent metrics tracking
     totalInputTokens = 0;
     totalOutputTokens = 0;
@@ -22,14 +31,90 @@ export class Analytics {
     setAccessToken(token) {
         telemetryClient.setAccessToken(token);
     }
+    setApiKeyAuth(apiKey) {
+        telemetryClient.setApiKeyAuth(apiKey);
+    }
+    setClaimTokenAuth(clientId, claimToken) {
+        telemetryClient.setClaimTokenAuth(clientId, claimToken);
+    }
+    /**
+     * Set the auth mode explicitly for special cases. Normal CLI flows should use
+     * `configureAuthFromAvailableSources()` so transport and auth.mode stay aligned.
+     */
+    setAuthMode(mode) {
+        this.authMode = mode;
+    }
     setGatewayUrl(url) {
         telemetryClient.setGatewayUrl(url);
     }
+    isEnabled() {
+        return isTelemetryEnabled();
+    }
+    /**
+     * Configure telemetry transport and auth.mode from all available CLI auth
+     * sources. Priority: stored JWT, unclaimed-environment claim token, active
+     * environment API key, then WORKOS_API_KEY.
+     */
+    configureAuthFromAvailableSources() {
+        if (!this.isEnabled())
+            return this.authMode;
+        this.authMode = 'none';
+        const creds = getCredentials();
+        // Only treat the JWT as usable auth when it is still valid. An expired
+        // access token would 401 against the telemetry guard and the event would
+        // be dropped, so fall through to claim-token / api-key auth instead.
+        if (creds?.accessToken && !isTokenExpired(creds)) {
+            telemetryClient.setAccessToken(creds.accessToken);
+            this.authMode = 'jwt';
+        }
+        // Preserve identity even when the token is expired.
+        if (creds?.userId) {
+            this.distinctId = creds.userId;
+        }
+        // Check for unclaimed environment — fall back to claim-token auth
+        // so unclaimed users' telemetry still reaches the backend.
+        try {
+            const env = getActiveEnvironment();
+            if (env && isUnclaimedEnvironment(env)) {
+                telemetryClient.setClaimTokenAuth(env.clientId, env.claimToken);
+                // Tag distinctId so unclaimed sessions are identifiable in analytics
+                this.distinctId = this.distinctId ?? `unclaimed:${env.clientId}`;
+                if (this.authMode === 'none')
+                    this.authMode = 'claim_token';
+            }
+            else if (env?.apiKey && this.authMode === 'none') {
+                telemetryClient.setApiKeyAuth(env.apiKey);
+                if (env.clientId)
+                    this.distinctId = this.distinctId ?? `env:${env.clientId}`;
+                this.authMode = 'api_key';
+            }
+        }
+        catch {
+            // Config-store failure is non-fatal for telemetry
+        }
+        // WORKOS_API_KEY covers API-key-only users. Lowest priority — JWT and
+        // claim-token auth have richer identity context when available.
+        if (this.authMode === 'none' && process.env.WORKOS_API_KEY) {
+            telemetryClient.setApiKeyAuth(process.env.WORKOS_API_KEY);
+            this.authMode = 'api_key';
+        }
+        return this.authMode;
+    }
+    /**
+     * Initialize telemetry for non-installer commands.
+     * Sets telemetry URL from default config and loads auth credentials.
+     */
+    initForNonInstaller() {
+        if (!this.isEnabled())
+            return;
+        telemetryClient.setGatewayUrl(getTelemetryUrl());
+        this.configureAuthFromAvailableSources();
+    }
     setTag(key, value) {
         this.tags[key] = value;
     }
     capture(eventName, properties) {
-        if (!WORKOS_TELEMETRY_ENABLED)
+        if (!this.isEnabled())
             return;
         debug(`[Analytics] capture: ${eventName}`, properties);
         // Accumulate primitive values as tags for the session.end event
@@ -42,19 +127,64 @@ export class Analytics {
         }
     }
     captureException(error, properties = {}) {
-        if (!WORKOS_TELEMETRY_ENABLED)
+        if (!this.isEnabled())
             return;
-        debug('[Analytics] captureException:', error.message, properties);
-        this.tags['error.type'] = error.name;
-        this.tags['error.message'] = error.message;
+        // Sanitize BEFORE logging — raw error.message can carry Bearer tokens /
+        // sk_ keys / JWTs on auth-failure paths, which would surface in stdout
+        // under WORKOS_DEBUG=1.
+        const { type, message } = this.extractErrorFields(error);
+        debug('[Analytics] captureException:', message, properties);
+        this.tags['error.type'] = type;
+        this.tags['error.message'] = message;
     }
     async getFeatureFlag(_flagKey) {
         // Feature flags not implemented yet
         return undefined;
     }
+    /** All capture methods that record error details MUST go through this. */
+    extractErrorFields(error) {
+        return {
+            type: error.name,
+            message: sanitizeMessage(error.message),
+        };
+    }
+    detectCiProvider() {
+        if (process.env.GITHUB_ACTIONS)
+            return 'github-actions';
+        if (process.env.BUILDKITE)
+            return 'buildkite';
+        if (process.env.CIRCLECI)
+            return 'circleci';
+        if (process.env.GITLAB_CI)
+            return 'gitlab-ci';
+        if (process.env.JENKINS_URL)
+            return 'jenkins';
+        return undefined;
+    }
+    getEnvFingerprint() {
+        let osVersion;
+        try {
+            osVersion = os.release();
+        }
+        catch {
+            osVersion = 'unknown';
+        }
+        const ciProvider = this.detectCiProvider();
+        return {
+            'device.id': getDeviceId(),
+            'auth.mode': this.authMode,
+            'env.os': process.platform,
+            'env.os_version': osVersion,
+            'env.node_version': process.version,
+            'env.shell': basename(process.env.SHELL ?? process.env.COMSPEC ?? 'unknown'),
+            'env.ci': Boolean(process.env.CI || process.env.GITHUB_ACTIONS || process.env.BUILDKITE),
+            ...(ciProvider ? { 'env.ci_provider': ciProvider } : {}),
+        };
+    }
     sessionStart(mode, version) {
-        if (!WORKOS_TELEMETRY_ENABLED)
+        if (!this.isEnabled())
             return;
+        this.mode = mode;
         const event = {
             type: 'session.start',
             sessionId: this.sessionId,
@@ -63,39 +193,42 @@ export class Analytics {
                 'installer.version': version,
                 'installer.mode': mode,
                 'workos.user_id': this.distinctId,
+                ...this.getEnvFingerprint(),
             },
         };
         telemetryClient.queueEvent(event);
     }
     stepCompleted(name, durationMs, success, error) {
-        if (!WORKOS_TELEMETRY_ENABLED)
+        if (!this.isEnabled())
             return;
         const event = {
             type: 'step',
             sessionId: this.sessionId,
             timestamp: new Date().toISOString(),
             name,
+            startTimestamp: new Date(Date.now() - durationMs).toISOString(),
             durationMs,
             success,
-            error: error ? { type: error.name, message: error.message } : undefined,
+            error: error ? this.extractErrorFields(error) : undefined,
         };
         telemetryClient.queueEvent(event);
     }
     toolCalled(toolName, durationMs, success) {
-        if (!WORKOS_TELEMETRY_ENABLED)
+        if (!this.isEnabled())
             return;
         const event = {
             type: 'agent.tool',
             sessionId: this.sessionId,
             timestamp: new Date().toISOString(),
             toolName,
+            startTimestamp: new Date(Date.now() - durationMs).toISOString(),
             durationMs,
             success,
         };
         telemetryClient.queueEvent(event);
     }
     llmRequest(model, inputTokens, outputTokens) {
-        if (!WORKOS_TELEMETRY_ENABLED)
+        if (!this.isEnabled())
             return;
         this.totalInputTokens += inputTokens;
         this.totalOutputTokens += outputTokens;
@@ -112,12 +245,64 @@ export class Analytics {
     incrementAgentIterations() {
         this.agentIterations++;
     }
+    emitCommandEvent(name, durationMs, success, options) {
+        if (!this.isEnabled())
+            return;
+        const errorFields = options?.error ? this.extractErrorFields(options.error) : undefined;
+        const event = {
+            type: 'command',
+            sessionId: this.sessionId,
+            timestamp: new Date().toISOString(),
+            attributes: {
+                'command.name': name,
+                'command.duration_ms': durationMs,
+                'command.success': success,
+                'cli.version': getVersion(),
+                ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),
+                ...(errorFields
+                    ? {
+                        'command.error_type': errorFields.type,
+                        'command.error_message': errorFields.message,
+                    }
+                    : {}),
+                ...(options?.flags?.length ? { 'command.flags': options.flags.join(',') } : {}),
+                ...(options?.reason ? { 'termination.reason': options.reason } : {}),
+                ...(options?.errorCode ? { 'error.code': options.errorCode } : {}),
+                ...(options?.apiContext?.status !== undefined ? { 'api.status': options.apiContext.status } : {}),
+                ...(options?.apiContext?.code ? { 'api.code': options.apiContext.code } : {}),
+                ...(options?.apiContext?.resource ? { 'api.resource': options.apiContext.resource } : {}),
+                ...this.getEnvFingerprint(),
+            },
+        };
+        telemetryClient.queueEvent(event);
+    }
+    captureUnhandledCrash(error, options) {
+        if (!this.isEnabled())
+            return;
+        const { type, message } = this.extractErrorFields(error);
+        const event = {
+            type: 'crash',
+            sessionId: this.sessionId,
+            timestamp: new Date().toISOString(),
+            attributes: {
+                'crash.error_type': type,
+                'crash.error_message': message,
+                'crash.stack': sanitizeStack(error.stack),
+                ...(options?.command ? { 'crash.command': options.command } : {}),
+                'cli.version': options?.version ?? getVersion(),
+                ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),
+                ...this.getEnvFingerprint(),
+            },
+        };
+        telemetryClient.queueEvent(event);
+    }
     async shutdown(status) {
-        if (!WORKOS_TELEMETRY_ENABLED)
+        if (!this.isEnabled())
             return;
         const duration = Date.now() - this.sessionStartTime.getTime();
         // Filter out null/undefined tags
         const extraAttributes = Object.fromEntries(Object.entries(this.tags).filter(([, v]) => v != null));
+        const envFingerprint = this.getEnvFingerprint();
         const event = {
             type: 'session.end',
             sessionId: this.sessionId,
@@ -128,6 +313,8 @@ export class Analytics {
                 'installer.agent.iterations': this.agentIterations,
                 'installer.agent.tokens.input': this.totalInputTokens,
                 'installer.agent.tokens.output': this.totalOutputTokens,
+                ...envFingerprint,
+                ...(this.mode ? { 'installer.mode': this.mode } : {}),
                 ...extraAttributes,
             },
         };

package/dist/utils/analytics.js.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,OAAO,SAAS;IACZ,IAAI,GAAiE,EAAE,CAAC;IACxE,SAAS,CAAS;IAClB,gBAAgB,CAAO;IACvB,UAAU,CAAU;IAE5B,yBAAyB;IACjB,gBAAgB,GAAG,CAAC,CAAC;IACrB,iBAAiB,GAAG,CAAC,CAAC;IACtB,eAAe,GAAG,CAAC,CAAC;IAE5B;QACE,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjD,CAAC;IAED,aAAa,CAAC,UAAkB;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,CAAC,GAAW,EAAE,KAAmD;QACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,SAAiB,EAAE,UAAoC;QAC7D,IAAI,CAAC,wBAAwB;YAAE,OAAO;QAEtC,KAAK,CAAC,wBAAwB,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;QAEvD,gEAAgE;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAkC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,KAAY,EAAE,aAAsC,EAAE;QACrE,IAAI,CAAC,wBAAwB;YAAE,OAAO;QAEtC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,oCAAoC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY,CAAC,IAAgC,EAAE,OAAe;QAC5D,IAAI,CAAC,wBAAwB;YAAE,OAAO;QAEtC,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE;YAC9C,UAAU,EAAE;gBACV,mBAAmB,EAAE,OAAO;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI,CAAC,UAAU;aAClC;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,UAAkB,EAAE,OAAgB,EAAE,KAAa;QAC7E,IAAI,CAAC,wBAAwB;YAAE,OAAO;QAEtC,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI;YACJ,UAAU;YACV,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;SACxE,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,UAAkB,EAAE,OAAgB;QAC/D,IAAI,CAAC,wBAAwB;YAAE,OAAO;QAEtC,MAAM,KAAK,GAAmB;YAC5B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ;YACR,UAAU;YACV,OAAO;SACR,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,YAAoB;QACjE,IAAI,CAAC,wBAAwB;YAAE,OAAO;QAEtC,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC;QACrC,IAAI,CAAC,iBAAiB,IAAI,YAAY,CAAC;QAEvC,MAAM,KAAK,GAAkB;YAC3B,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,WAAW;YACX,YAAY;SACb,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,wBAAwB;QACtB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAyC;QACtD,IAAI,CAAC,wBAAwB;YAAE,OAAO;QAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE9D,iCAAiC;QACjC,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAGhG,CAAC;QAEF,MAAM,KAAK,GAAoB;YAC7B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,mBAAmB,EAAE,MAAM;gBAC3B,uBAAuB,EAAE,QAAQ;gBACjC,4BAA4B,EAAE,IAAI,CAAC,eAAe;gBAClD,8BAA8B,EAAE,IAAI,CAAC,gBAAgB;gBACrD,+BAA+B,EAAE,IAAI,CAAC,iBAAiB;gBACvD,GAAG,eAAe;aACnB;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC","sourcesContent":["import { v4 as uuidv4 } from 'uuid';\nimport { debug } from './debug.js';\nimport { telemetryClient } from './telemetry-client.js';\nimport type {\n  SessionStartEvent,\n  SessionEndEvent,\n  StepEvent,\n  AgentToolEvent,\n  AgentLLMEvent,\n} from './telemetry-types.js';\nimport { WORKOS_TELEMETRY_ENABLED } from '../lib/constants.js';\n\nexport class Analytics {\n  private tags: Record<string, string | boolean | number | null | undefined> = {};\n  private sessionId: string;\n  private sessionStartTime: Date;\n  private distinctId?: string;\n\n  // Agent metrics tracking\n  private totalInputTokens = 0;\n  private totalOutputTokens = 0;\n  private agentIterations = 0;\n\n  constructor() {\n    this.sessionId = uuidv4();\n    this.sessionStartTime = new Date();\n    this.tags = { $app_name: 'authkit-installer' };\n  }\n\n  setDistinctId(distinctId: string) {\n    this.distinctId = distinctId;\n  }\n\n  setAccessToken(token: string) {\n    telemetryClient.setAccessToken(token);\n  }\n\n  setGatewayUrl(url: string) {\n    telemetryClient.setGatewayUrl(url);\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    if (!WORKOS_TELEMETRY_ENABLED) return;\n\n    debug(`[Analytics] capture: ${eventName}`, properties);\n\n    // Accumulate primitive values as tags for the session.end event\n    if (properties) {\n      for (const [key, value] of Object.entries(properties)) {\n        if (['string', 'number', 'boolean'].includes(typeof value)) {\n          this.tags[key] = value as string | number | boolean;\n        }\n      }\n    }\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    if (!WORKOS_TELEMETRY_ENABLED) return;\n\n    debug('[Analytics] captureException:', error.message, properties);\n    this.tags['error.type'] = error.name;\n    this.tags['error.message'] = error.message;\n  }\n\n  async getFeatureFlag(_flagKey: string): Promise<string | boolean | undefined> {\n    // Feature flags not implemented yet\n    return undefined;\n  }\n\n  sessionStart(mode: 'cli' | 'tui' | 'headless', version: string) {\n    if (!WORKOS_TELEMETRY_ENABLED) return;\n\n    const event: SessionStartEvent = {\n      type: 'session.start',\n      sessionId: this.sessionId,\n      timestamp: this.sessionStartTime.toISOString(),\n      attributes: {\n        'installer.version': version,\n        'installer.mode': mode,\n        'workos.user_id': this.distinctId,\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  stepCompleted(name: string, durationMs: number, success: boolean, error?: Error) {\n    if (!WORKOS_TELEMETRY_ENABLED) return;\n\n    const event: StepEvent = {\n      type: 'step',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      name,\n      durationMs,\n      success,\n      error: error ? { type: error.name, message: error.message } : undefined,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  toolCalled(toolName: string, durationMs: number, success: boolean) {\n    if (!WORKOS_TELEMETRY_ENABLED) return;\n\n    const event: AgentToolEvent = {\n      type: 'agent.tool',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      toolName,\n      durationMs,\n      success,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  llmRequest(model: string, inputTokens: number, outputTokens: number) {\n    if (!WORKOS_TELEMETRY_ENABLED) return;\n\n    this.totalInputTokens += inputTokens;\n    this.totalOutputTokens += outputTokens;\n\n    const event: AgentLLMEvent = {\n      type: 'agent.llm',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      model,\n      inputTokens,\n      outputTokens,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  incrementAgentIterations() {\n    this.agentIterations++;\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (!WORKOS_TELEMETRY_ENABLED) return;\n\n    const duration = Date.now() - this.sessionStartTime.getTime();\n\n    // Filter out null/undefined tags\n    const extraAttributes = Object.fromEntries(Object.entries(this.tags).filter(([, v]) => v != null)) as Record<\n      string,\n      string | number | boolean\n    >;\n\n    const event: SessionEndEvent = {\n      type: 'session.end',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        'installer.outcome': status,\n        'installer.duration_ms': duration,\n        'installer.agent.iterations': this.agentIterations,\n        'installer.agent.tokens.input': this.totalInputTokens,\n        'installer.agent.tokens.output': this.totalOutputTokens,\n        ...extraAttributes,\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n    await telemetryClient.flush();\n  }\n}\n\nexport const analytics = new Analytics();\n"]}
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAaxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,OAAO,SAAS;IACZ,IAAI,GAAiE,EAAE,CAAC;IACxE,SAAS,CAAS;IAClB,gBAAgB,CAAO;IACvB,UAAU,CAAU;IACpB,IAAI,CAA8B;IAClC,QAAQ,GAAa,MAAM,CAAC;IAEpC,yBAAyB;IACjB,gBAAgB,GAAG,CAAC,CAAC;IACrB,iBAAiB,GAAG,CAAC,CAAC;IACtB,eAAe,GAAG,CAAC,CAAC;IAE5B;QACE,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjD,CAAC;IAED,aAAa,CAAC,UAAkB;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,iBAAiB,CAAC,QAAgB,EAAE,UAAkB;QACpD,eAAe,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,IAAc;QACxB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAEO,SAAS;QACf,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,iCAAiC;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAE5C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACvB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,KAAK,EAAE,WAAW,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,oDAAoD;QACpD,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;QACjC,CAAC;QAED,kEAAkE;QAClE,2DAA2D;QAC3D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChE,qEAAqE;gBACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,aAAa,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;oBAAE,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;YAC9D,CAAC;iBAAM,IAAI,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACnD,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,GAAG,CAAC,QAAQ;oBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7E,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QAED,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC3D,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,eAAe,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,GAAW,EAAE,KAAmD;QACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,SAAiB,EAAE,UAAoC;QAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,KAAK,CAAC,wBAAwB,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;QAEvD,gEAAgE;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAkC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,KAAY,EAAE,aAAsC,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,wEAAwE;QACxE,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzD,KAAK,CAAC,+BAA+B,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,oCAAoC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0EAA0E;IAClE,kBAAkB,CAAC,KAAY;QACrC,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;SACxC,CAAC;IACJ,CAAC;IAEO,gBAAgB;QACtB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,gBAAgB,CAAC;QACxD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB;QACvB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3C,OAAO;YACL,WAAW,EAAE,WAAW,EAAE;YAC1B,WAAW,EAAE,IAAI,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,SAAS;YAC3B,kBAAkB,EAAE,OAAO,CAAC,OAAO;YACnC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;YAC5E,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YACxF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAgC,EAAE,OAAe;QAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAEjB,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE;YAC9C,UAAU,EAAE;gBACV,mBAAmB,EAAE,OAAO;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI,CAAC,UAAU;gBACjC,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,UAAkB,EAAE,OAAgB,EAAE,KAAa;QAC7E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI;YACJ,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YAC/D,UAAU;YACV,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,UAAkB,EAAE,OAAgB;QAC/D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,KAAK,GAAmB;YAC5B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ;YACR,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YAC/D,UAAU;YACV,OAAO;SACR,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,YAAoB;QACjE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC;QACrC,IAAI,CAAC,iBAAiB,IAAI,YAAY,CAAC;QAEvC,MAAM,KAAK,GAAkB;YAC3B,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,WAAW;YACX,YAAY;SACb,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,wBAAwB;QACtB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,gBAAgB,CACd,IAAY,EACZ,UAAkB,EAClB,OAAgB,EAChB,OAMC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExF,MAAM,KAAK,GAAiB;YAC1B,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,cAAc,EAAE,IAAI;gBACpB,qBAAqB,EAAE,UAAU;gBACjC,iBAAiB,EAAE,OAAO;gBAC1B,aAAa,EAAE,UAAU,EAAE;gBAC3B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,WAAW;oBACb,CAAC,CAAC;wBACE,oBAAoB,EAAE,WAAW,CAAC,IAAI;wBACtC,uBAAuB,EAAE,WAAW,CAAC,OAAO;qBAC7C;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjG,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,qBAAqB,CAAC,KAAY,EAAE,OAAgD;QAClF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAe;YACxB,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,kBAAkB,EAAE,IAAI;gBACxB,qBAAqB,EAAE,OAAO;gBAC9B,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;gBACzC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,aAAa,EAAE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAyC;QACtD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE9D,iCAAiC;QACjC,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAGhG,CAAC;QAEF,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,KAAK,GAAoB;YAC7B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,mBAAmB,EAAE,MAAM;gBAC3B,uBAAuB,EAAE,QAAQ;gBACjC,4BAA4B,EAAE,IAAI,CAAC,eAAe;gBAClD,8BAA8B,EAAE,IAAI,CAAC,gBAAgB;gBACrD,+BAA+B,EAAE,IAAI,CAAC,iBAAiB;gBACvD,GAAG,cAAc;gBACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,eAAe;aACnB;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC","sourcesContent":["import os from 'node:os';\nimport { basename } from 'node:path';\nimport { v4 as uuidv4 } from 'uuid';\nimport { debug } from './debug.js';\nimport { telemetryClient } from './telemetry-client.js';\nimport type {\n  AuthMode,\n  SessionStartEvent,\n  SessionEndEvent,\n  StepEvent,\n  AgentToolEvent,\n  AgentLLMEvent,\n  CommandEvent,\n  CrashEvent,\n  TerminationReason,\n  EnvFingerprint,\n} from './telemetry-types.js';\nimport { isTelemetryEnabled } from '../lib/preferences.js';\nimport { getTelemetryUrl, getVersion } from '../lib/settings.js';\nimport { getCredentials, isTokenExpired } from '../lib/credentials.js';\nimport { getActiveEnvironment, isUnclaimedEnvironment } from '../lib/config-store.js';\nimport { getDeviceId } from '../lib/device-id.js';\nimport { sanitizeMessage, sanitizeStack } from './crash-reporter.js';\n\nexport class Analytics {\n  private tags: Record<string, string | boolean | number | null | undefined> = {};\n  private sessionId: string;\n  private sessionStartTime: Date;\n  private distinctId?: string;\n  private mode?: 'cli' | 'tui' | 'headless';\n  private authMode: AuthMode = 'none';\n\n  // Agent metrics tracking\n  private totalInputTokens = 0;\n  private totalOutputTokens = 0;\n  private agentIterations = 0;\n\n  constructor() {\n    this.sessionId = uuidv4();\n    this.sessionStartTime = new Date();\n    this.tags = { $app_name: 'authkit-installer' };\n  }\n\n  setDistinctId(distinctId: string) {\n    this.distinctId = distinctId;\n  }\n\n  setAccessToken(token: string) {\n    telemetryClient.setAccessToken(token);\n  }\n\n  setApiKeyAuth(apiKey: string) {\n    telemetryClient.setApiKeyAuth(apiKey);\n  }\n\n  setClaimTokenAuth(clientId: string, claimToken: string) {\n    telemetryClient.setClaimTokenAuth(clientId, claimToken);\n  }\n\n  /**\n   * Set the auth mode explicitly for special cases. Normal CLI flows should use\n   * `configureAuthFromAvailableSources()` so transport and auth.mode stay aligned.\n   */\n  setAuthMode(mode: AuthMode) {\n    this.authMode = mode;\n  }\n\n  setGatewayUrl(url: string) {\n    telemetryClient.setGatewayUrl(url);\n  }\n\n  private isEnabled(): boolean {\n    return isTelemetryEnabled();\n  }\n\n  /**\n   * Configure telemetry transport and auth.mode from all available CLI auth\n   * sources. Priority: stored JWT, unclaimed-environment claim token, active\n   * environment API key, then WORKOS_API_KEY.\n   */\n  configureAuthFromAvailableSources(): AuthMode {\n    if (!this.isEnabled()) return this.authMode;\n\n    this.authMode = 'none';\n    const creds = getCredentials();\n    // Only treat the JWT as usable auth when it is still valid. An expired\n    // access token would 401 against the telemetry guard and the event would\n    // be dropped, so fall through to claim-token / api-key auth instead.\n    if (creds?.accessToken && !isTokenExpired(creds)) {\n      telemetryClient.setAccessToken(creds.accessToken);\n      this.authMode = 'jwt';\n    }\n    // Preserve identity even when the token is expired.\n    if (creds?.userId) {\n      this.distinctId = creds.userId;\n    }\n\n    // Check for unclaimed environment — fall back to claim-token auth\n    // so unclaimed users' telemetry still reaches the backend.\n    try {\n      const env = getActiveEnvironment();\n      if (env && isUnclaimedEnvironment(env)) {\n        telemetryClient.setClaimTokenAuth(env.clientId, env.claimToken);\n        // Tag distinctId so unclaimed sessions are identifiable in analytics\n        this.distinctId = this.distinctId ?? `unclaimed:${env.clientId}`;\n        if (this.authMode === 'none') this.authMode = 'claim_token';\n      } else if (env?.apiKey && this.authMode === 'none') {\n        telemetryClient.setApiKeyAuth(env.apiKey);\n        if (env.clientId) this.distinctId = this.distinctId ?? `env:${env.clientId}`;\n        this.authMode = 'api_key';\n      }\n    } catch {\n      // Config-store failure is non-fatal for telemetry\n    }\n\n    // WORKOS_API_KEY covers API-key-only users. Lowest priority — JWT and\n    // claim-token auth have richer identity context when available.\n    if (this.authMode === 'none' && process.env.WORKOS_API_KEY) {\n      telemetryClient.setApiKeyAuth(process.env.WORKOS_API_KEY);\n      this.authMode = 'api_key';\n    }\n\n    return this.authMode;\n  }\n\n  /**\n   * Initialize telemetry for non-installer commands.\n   * Sets telemetry URL from default config and loads auth credentials.\n   */\n  initForNonInstaller(): void {\n    if (!this.isEnabled()) return;\n\n    telemetryClient.setGatewayUrl(getTelemetryUrl());\n    this.configureAuthFromAvailableSources();\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    if (!this.isEnabled()) return;\n\n    debug(`[Analytics] capture: ${eventName}`, properties);\n\n    // Accumulate primitive values as tags for the session.end event\n    if (properties) {\n      for (const [key, value] of Object.entries(properties)) {\n        if (['string', 'number', 'boolean'].includes(typeof value)) {\n          this.tags[key] = value as string | number | boolean;\n        }\n      }\n    }\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    if (!this.isEnabled()) return;\n\n    // Sanitize BEFORE logging — raw error.message can carry Bearer tokens /\n    // sk_ keys / JWTs on auth-failure paths, which would surface in stdout\n    // under WORKOS_DEBUG=1.\n    const { type, message } = this.extractErrorFields(error);\n    debug('[Analytics] captureException:', message, properties);\n    this.tags['error.type'] = type;\n    this.tags['error.message'] = message;\n  }\n\n  async getFeatureFlag(_flagKey: string): Promise<string | boolean | undefined> {\n    // Feature flags not implemented yet\n    return undefined;\n  }\n\n  /** All capture methods that record error details MUST go through this. */\n  private extractErrorFields(error: Error): { type: string; message: string } {\n    return {\n      type: error.name,\n      message: sanitizeMessage(error.message),\n    };\n  }\n\n  private detectCiProvider(): string | undefined {\n    if (process.env.GITHUB_ACTIONS) return 'github-actions';\n    if (process.env.BUILDKITE) return 'buildkite';\n    if (process.env.CIRCLECI) return 'circleci';\n    if (process.env.GITLAB_CI) return 'gitlab-ci';\n    if (process.env.JENKINS_URL) return 'jenkins';\n    return undefined;\n  }\n\n  private getEnvFingerprint(): EnvFingerprint {\n    let osVersion: string;\n    try {\n      osVersion = os.release();\n    } catch {\n      osVersion = 'unknown';\n    }\n\n    const ciProvider = this.detectCiProvider();\n\n    return {\n      'device.id': getDeviceId(),\n      'auth.mode': this.authMode,\n      'env.os': process.platform,\n      'env.os_version': osVersion,\n      'env.node_version': process.version,\n      'env.shell': basename(process.env.SHELL ?? process.env.COMSPEC ?? 'unknown'),\n      'env.ci': Boolean(process.env.CI || process.env.GITHUB_ACTIONS || process.env.BUILDKITE),\n      ...(ciProvider ? { 'env.ci_provider': ciProvider } : {}),\n    };\n  }\n\n  sessionStart(mode: 'cli' | 'tui' | 'headless', version: string) {\n    if (!this.isEnabled()) return;\n\n    this.mode = mode;\n\n    const event: SessionStartEvent = {\n      type: 'session.start',\n      sessionId: this.sessionId,\n      timestamp: this.sessionStartTime.toISOString(),\n      attributes: {\n        'installer.version': version,\n        'installer.mode': mode,\n        'workos.user_id': this.distinctId,\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  stepCompleted(name: string, durationMs: number, success: boolean, error?: Error) {\n    if (!this.isEnabled()) return;\n\n    const event: StepEvent = {\n      type: 'step',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      name,\n      startTimestamp: new Date(Date.now() - durationMs).toISOString(),\n      durationMs,\n      success,\n      error: error ? this.extractErrorFields(error) : undefined,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  toolCalled(toolName: string, durationMs: number, success: boolean) {\n    if (!this.isEnabled()) return;\n\n    const event: AgentToolEvent = {\n      type: 'agent.tool',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      toolName,\n      startTimestamp: new Date(Date.now() - durationMs).toISOString(),\n      durationMs,\n      success,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  llmRequest(model: string, inputTokens: number, outputTokens: number) {\n    if (!this.isEnabled()) return;\n\n    this.totalInputTokens += inputTokens;\n    this.totalOutputTokens += outputTokens;\n\n    const event: AgentLLMEvent = {\n      type: 'agent.llm',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      model,\n      inputTokens,\n      outputTokens,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  incrementAgentIterations() {\n    this.agentIterations++;\n  }\n\n  emitCommandEvent(\n    name: string,\n    durationMs: number,\n    success: boolean,\n    options?: {\n      error?: Error;\n      flags?: string[];\n      reason?: TerminationReason;\n      errorCode?: string;\n      apiContext?: { status?: number; code?: string; resource?: string };\n    },\n  ) {\n    if (!this.isEnabled()) return;\n\n    const errorFields = options?.error ? this.extractErrorFields(options.error) : undefined;\n\n    const event: CommandEvent = {\n      type: 'command',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        'command.name': name,\n        'command.duration_ms': durationMs,\n        'command.success': success,\n        'cli.version': getVersion(),\n        ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),\n        ...(errorFields\n          ? {\n              'command.error_type': errorFields.type,\n              'command.error_message': errorFields.message,\n            }\n          : {}),\n        ...(options?.flags?.length ? { 'command.flags': options.flags.join(',') } : {}),\n        ...(options?.reason ? { 'termination.reason': options.reason } : {}),\n        ...(options?.errorCode ? { 'error.code': options.errorCode } : {}),\n        ...(options?.apiContext?.status !== undefined ? { 'api.status': options.apiContext.status } : {}),\n        ...(options?.apiContext?.code ? { 'api.code': options.apiContext.code } : {}),\n        ...(options?.apiContext?.resource ? { 'api.resource': options.apiContext.resource } : {}),\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  captureUnhandledCrash(error: Error, options?: { command?: string; version?: string }) {\n    if (!this.isEnabled()) return;\n\n    const { type, message } = this.extractErrorFields(error);\n\n    const event: CrashEvent = {\n      type: 'crash',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        'crash.error_type': type,\n        'crash.error_message': message,\n        'crash.stack': sanitizeStack(error.stack),\n        ...(options?.command ? { 'crash.command': options.command } : {}),\n        'cli.version': options?.version ?? getVersion(),\n        ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (!this.isEnabled()) return;\n\n    const duration = Date.now() - this.sessionStartTime.getTime();\n\n    // Filter out null/undefined tags\n    const extraAttributes = Object.fromEntries(Object.entries(this.tags).filter(([, v]) => v != null)) as Record<\n      string,\n      string | number | boolean\n    >;\n\n    const envFingerprint = this.getEnvFingerprint();\n\n    const event: SessionEndEvent = {\n      type: 'session.end',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        'installer.outcome': status,\n        'installer.duration_ms': duration,\n        'installer.agent.iterations': this.agentIterations,\n        'installer.agent.tokens.input': this.totalInputTokens,\n        'installer.agent.tokens.output': this.totalOutputTokens,\n        ...envFingerprint,\n        ...(this.mode ? { 'installer.mode': this.mode } : {}),\n        ...extraAttributes,\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n    await telemetryClient.flush();\n  }\n}\n\nexport const analytics = new Analytics();\n"]}

package/dist/utils/box.d.ts

@@ -1,5 +1,33 @@
 import type chalk from 'chalk';
 /**
- * Render a one-line bordered box to stderr.
+ * Word-wrap a string to a maximum visible width, preserving ANSI color.
+ *
+ * chalk emits self-closing color spans (e.g. `\x1b[36m…\x1b[39m`), so each
+ * colored fragment is atomic: we tokenize the input into whole colored spans
+ * and plain words, then greedily pack tokens into lines measured by their
+ * VISIBLE width. Because every token carries its own open+close codes, color
+ * never bleeds across a line break onto the border or padding.
+ *
+ * A single token wider than `maxWidth` (rare — only a very narrow terminal vs.
+ * a long unbroken word) overflows its own line rather than being split mid-span.
+ * Such an overflow can push the rendered box border past the terminal width;
+ * acceptable at standard widths. Note that a colored command produced by
+ * `formatWorkOSCommand` can be long (e.g. `npx workos@latest telemetry opt-out`)
+ * and stays a single unbreakable token by design.
+ *
+ * Limitation: a colored span is grouped atomically only when it is a single SGR
+ * layer (one open code + one close code, as `chalk.cyan('…')` emits). Stacked
+ * styles such as bold+color (`\x1b[1m\x1b[36m…\x1b[39m\x1b[22m`) or two adjacent
+ * spans with no separating space are not guaranteed to stay on one line and may
+ * leave a reset code mid-line. All current callers use single-color spans only.
+ */
+export declare function wrapAnsiAware(input: string, maxWidth: number): string[];
+/**
+ * Render a bordered box to stderr, wrapping to the terminal width.
+ *
+ * When the content fits on one line it renders exactly as a single-line box
+ * (the historical behavior). When it would overflow the terminal, the content
+ * is word-wrapped (ANSI-aware) and the box grows to multiple lines so the
+ * border never breaks on a narrow terminal.
  */
 export declare function renderStderrBox(inner: string, color: typeof chalk.yellow | typeof chalk.green): void;

package/dist/utils/box.js

@@ -1,13 +1,101 @@
 import { stripAnsii } from './string.js';
+/** Visible (printable) width of a string, ignoring ANSI escape sequences. */
+function visibleWidth(str) {
+    return stripAnsii(str).length;
+}
+/** Terminal width for stderr output, falling back to stdout then 80 columns. */
+function terminalWidth() {
+    return process.stderr.columns || process.stdout.columns || 80;
+}
+/**
+ * Word-wrap a string to a maximum visible width, preserving ANSI color.
+ *
+ * chalk emits self-closing color spans (e.g. `\x1b[36m…\x1b[39m`), so each
+ * colored fragment is atomic: we tokenize the input into whole colored spans
+ * and plain words, then greedily pack tokens into lines measured by their
+ * VISIBLE width. Because every token carries its own open+close codes, color
+ * never bleeds across a line break onto the border or padding.
+ *
+ * A single token wider than `maxWidth` (rare — only a very narrow terminal vs.
+ * a long unbroken word) overflows its own line rather than being split mid-span.
+ * Such an overflow can push the rendered box border past the terminal width;
+ * acceptable at standard widths. Note that a colored command produced by
+ * `formatWorkOSCommand` can be long (e.g. `npx workos@latest telemetry opt-out`)
+ * and stays a single unbreakable token by design.
+ *
+ * Limitation: a colored span is grouped atomically only when it is a single SGR
+ * layer (one open code + one close code, as `chalk.cyan('…')` emits). Stacked
+ * styles such as bold+color (`\x1b[1m\x1b[36m…\x1b[39m\x1b[22m`) or two adjacent
+ * spans with no separating space are not guaranteed to stay on one line and may
+ * leave a reset code mid-line. All current callers use single-color spans only.
+ */
+export function wrapAnsiAware(input, maxWidth) {
+    // A token is either: a full SGR-wrapped span (open code, content that may
+    // contain spaces, close code), a run of non-space/non-escape characters
+    // (a plain word), or a lone escape. Whitespace between tokens is dropped and
+    // re-inserted as single separating spaces.
+    const tokenRe = /\x1b\[[0-9;]*m[^\x1b]*?\x1b\[[0-9;]*m|[^\s\x1b]+|\x1b\[[0-9;]*m/g;
+    const tokens = input.match(tokenRe) ?? [];
+    const lines = [];
+    let line = '';
+    let lineWidth = 0;
+    for (const token of tokens) {
+        const tokenWidth = visibleWidth(token);
+        if (lineWidth === 0) {
+            line = token;
+            lineWidth = tokenWidth;
+        }
+        else if (lineWidth + 1 + tokenWidth <= maxWidth) {
+            line += ` ${token}`;
+            lineWidth += 1 + tokenWidth;
+        }
+        else {
+            lines.push(line);
+            line = token;
+            lineWidth = tokenWidth;
+        }
+    }
+    if (line)
+        lines.push(line);
+    return lines.length > 0 ? lines : [''];
+}
 /**
- * Render a one-line bordered box to stderr.
+ * Render a bordered box to stderr, wrapping to the terminal width.
+ *
+ * When the content fits on one line it renders exactly as a single-line box
+ * (the historical behavior). When it would overflow the terminal, the content
+ * is word-wrapped (ANSI-aware) and the box grows to multiple lines so the
+ * border never breaks on a narrow terminal.
  */
 export function renderStderrBox(inner, color) {
-    const plainLen = stripAnsii(inner).length;
-    const border = '─'.repeat(plainLen);
+    const cols = terminalWidth();
+    const plainLen = visibleWidth(inner);
+    // Fast path: content (including its own padding spaces) fits within the
+    // terminal. Render the single-line box byte-for-byte as before.
+    if (plainLen <= cols - 4) {
+        const border = '─'.repeat(plainLen);
+        console.error('');
+        console.error(color(`  ┌${border}┐`));
+        console.error(color('  │') + inner + color('│'));
+        console.error(color(`  └${border}┘`));
+        console.error('');
+        return;
+    }
+    // Wrap path: trim the caller's outer padding, wrap to the available width,
+    // then re-pad each line to a uniform inner width with one space of padding
+    // on each side. Layout per line: "  │ " + text + " │" = text + 6 columns.
+    const content = inner.replace(/^[ \t]+/, '').replace(/[ \t]+$/, '');
+    const maxTextWidth = Math.max(1, cols - 6);
+    const wrapped = wrapAnsiAware(content, maxTextWidth);
+    // Snug the box to the longest wrapped line rather than the full terminal.
+    const textWidth = Math.max(...wrapped.map(visibleWidth));
+    const border = '─'.repeat(textWidth + 2);
     console.error('');
     console.error(color(`  ┌${border}┐`));
-    console.error(color('  │') + inner + color('│'));
+    for (const ln of wrapped) {
+        const pad = ' '.repeat(Math.max(0, textWidth - visibleWidth(ln)));
+        console.error(`${color('  │')} ${ln}${pad} ${color('│')}`);
+    }
     console.error(color(`  └${border}┘`));
     console.error('');
 }

package/dist/utils/box.js.map

@@ -1 +1 @@
-{"version":3,"file":"box.js","sourceRoot":"","sources":["../../src/utils/box.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAA+C;IAC5F,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC","sourcesContent":["import type chalk from 'chalk';\nimport { stripAnsii } from './string.js';\n\n/**\n * Render a one-line bordered box to stderr.\n */\nexport function renderStderrBox(inner: string, color: typeof chalk.yellow | typeof chalk.green): void {\n  const plainLen = stripAnsii(inner).length;\n  const border = '─'.repeat(plainLen);\n  console.error('');\n  console.error(color(`  ┌${border}┐`));\n  console.error(color('  │') + inner + color('│'));\n  console.error(color(`  └${border}┘`));\n  console.error('');\n}\n"]}
+{"version":3,"file":"box.js","sourceRoot":"","sources":["../../src/utils/box.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,QAAgB;IAC3D,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,2CAA2C;IAC3C,MAAM,OAAO,GAAG,kEAAkE,CAAC;IACnF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAE1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,GAAG,KAAK,CAAC;YACb,SAAS,GAAG,UAAU,CAAC;QACzB,CAAC;aAAM,IAAI,SAAS,GAAG,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC;YAClD,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YACpB,SAAS,IAAI,CAAC,GAAG,UAAU,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,GAAG,KAAK,CAAC;YACb,SAAS,GAAG,UAAU,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAA+C;IAC5F,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAErC,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,QAAQ,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAErD,0EAA0E;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAEzC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC","sourcesContent":["import type chalk from 'chalk';\nimport { stripAnsii } from './string.js';\n\n/** Visible (printable) width of a string, ignoring ANSI escape sequences. */\nfunction visibleWidth(str: string): number {\n  return stripAnsii(str).length;\n}\n\n/** Terminal width for stderr output, falling back to stdout then 80 columns. */\nfunction terminalWidth(): number {\n  return process.stderr.columns || process.stdout.columns || 80;\n}\n\n/**\n * Word-wrap a string to a maximum visible width, preserving ANSI color.\n *\n * chalk emits self-closing color spans (e.g. `\\x1b[36m…\\x1b[39m`), so each\n * colored fragment is atomic: we tokenize the input into whole colored spans\n * and plain words, then greedily pack tokens into lines measured by their\n * VISIBLE width. Because every token carries its own open+close codes, color\n * never bleeds across a line break onto the border or padding.\n *\n * A single token wider than `maxWidth` (rare — only a very narrow terminal vs.\n * a long unbroken word) overflows its own line rather than being split mid-span.\n * Such an overflow can push the rendered box border past the terminal width;\n * acceptable at standard widths. Note that a colored command produced by\n * `formatWorkOSCommand` can be long (e.g. `npx workos@latest telemetry opt-out`)\n * and stays a single unbreakable token by design.\n *\n * Limitation: a colored span is grouped atomically only when it is a single SGR\n * layer (one open code + one close code, as `chalk.cyan('…')` emits). Stacked\n * styles such as bold+color (`\\x1b[1m\\x1b[36m…\\x1b[39m\\x1b[22m`) or two adjacent\n * spans with no separating space are not guaranteed to stay on one line and may\n * leave a reset code mid-line. All current callers use single-color spans only.\n */\nexport function wrapAnsiAware(input: string, maxWidth: number): string[] {\n  // A token is either: a full SGR-wrapped span (open code, content that may\n  // contain spaces, close code), a run of non-space/non-escape characters\n  // (a plain word), or a lone escape. Whitespace between tokens is dropped and\n  // re-inserted as single separating spaces.\n  const tokenRe = /\\x1b\\[[0-9;]*m[^\\x1b]*?\\x1b\\[[0-9;]*m|[^\\s\\x1b]+|\\x1b\\[[0-9;]*m/g;\n  const tokens = input.match(tokenRe) ?? [];\n\n  const lines: string[] = [];\n  let line = '';\n  let lineWidth = 0;\n\n  for (const token of tokens) {\n    const tokenWidth = visibleWidth(token);\n    if (lineWidth === 0) {\n      line = token;\n      lineWidth = tokenWidth;\n    } else if (lineWidth + 1 + tokenWidth <= maxWidth) {\n      line += ` ${token}`;\n      lineWidth += 1 + tokenWidth;\n    } else {\n      lines.push(line);\n      line = token;\n      lineWidth = tokenWidth;\n    }\n  }\n  if (line) lines.push(line);\n  return lines.length > 0 ? lines : [''];\n}\n\n/**\n * Render a bordered box to stderr, wrapping to the terminal width.\n *\n * When the content fits on one line it renders exactly as a single-line box\n * (the historical behavior). When it would overflow the terminal, the content\n * is word-wrapped (ANSI-aware) and the box grows to multiple lines so the\n * border never breaks on a narrow terminal.\n */\nexport function renderStderrBox(inner: string, color: typeof chalk.yellow | typeof chalk.green): void {\n  const cols = terminalWidth();\n  const plainLen = visibleWidth(inner);\n\n  // Fast path: content (including its own padding spaces) fits within the\n  // terminal. Render the single-line box byte-for-byte as before.\n  if (plainLen <= cols - 4) {\n    const border = '─'.repeat(plainLen);\n    console.error('');\n    console.error(color(`  ┌${border}┐`));\n    console.error(color('  │') + inner + color('│'));\n    console.error(color(`  └${border}┘`));\n    console.error('');\n    return;\n  }\n\n  // Wrap path: trim the caller's outer padding, wrap to the available width,\n  // then re-pad each line to a uniform inner width with one space of padding\n  // on each side. Layout per line: \"  │ \" + text + \" │\" = text + 6 columns.\n  const content = inner.replace(/^[ \\t]+/, '').replace(/[ \\t]+$/, '');\n  const maxTextWidth = Math.max(1, cols - 6);\n  const wrapped = wrapAnsiAware(content, maxTextWidth);\n\n  // Snug the box to the longest wrapped line rather than the full terminal.\n  const textWidth = Math.max(...wrapped.map(visibleWidth));\n  const border = '─'.repeat(textWidth + 2);\n\n  console.error('');\n  console.error(color(`  ┌${border}┐`));\n  for (const ln of wrapped) {\n    const pad = ' '.repeat(Math.max(0, textWidth - visibleWidth(ln)));\n    console.error(`${color('  │')} ${ln}${pad} ${color('│')}`);\n  }\n  console.error(color(`  └${border}┘`));\n  console.error('');\n}\n"]}

package/dist/utils/cli-exit.d.ts

@@ -0,0 +1,15 @@
+import type { TerminationReason } from './telemetry-types.js';
+export interface CliExitContext {
+    reason: TerminationReason;
+    errorCode?: string;
+    apiContext?: {
+        status?: number;
+        code?: string;
+        resource?: string;
+    };
+}
+export declare class CliExit extends Error {
+    readonly exitCode: number;
+    readonly context?: CliExitContext | undefined;
+    constructor(exitCode: number, context?: CliExitContext | undefined);
+}

package/dist/utils/cli-exit.js

@@ -0,0 +1,11 @@
+export class CliExit extends Error {
+    exitCode;
+    context;
+    constructor(exitCode, context) {
+        super(`CLI exit: code ${exitCode}`);
+        this.exitCode = exitCode;
+        this.context = context;
+        this.name = 'CliExit';
+    }
+}
+//# sourceMappingURL=cli-exit.js.map

package/dist/utils/cli-exit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-exit.js","sourceRoot":"","sources":["../../src/utils/cli-exit.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,OAAQ,SAAQ,KAAK;IAErB;IACA;IAFX,YACW,QAAgB,EAChB,OAAwB;QAEjC,KAAK,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QAH3B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,YAAO,GAAP,OAAO,CAAiB;QAGjC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;CACF","sourcesContent":["import type { TerminationReason } from './telemetry-types.js';\n\nexport interface CliExitContext {\n  reason: TerminationReason;\n  errorCode?: string;\n  apiContext?: { status?: number; code?: string; resource?: string };\n}\n\nexport class CliExit extends Error {\n  constructor(\n    readonly exitCode: number,\n    readonly context?: CliExitContext,\n  ) {\n    super(`CLI exit: code ${exitCode}`);\n    this.name = 'CliExit';\n  }\n}\n"]}

package/dist/utils/cli-symbols.d.ts

@@ -2,7 +2,7 @@ export declare const symbols: {
     readonly success: "✓" | "+";
     readonly error: "✗" | "x";
     readonly warning: "!";
-    readonly info: "i" | "ℹ";
+    readonly info: "ℹ" | "i";
     readonly arrow: "→" | "->";
     readonly bullet: "*" | "•";
     readonly progressFilled: "#" | "▓";

package/dist/utils/command-telemetry.d.ts

@@ -0,0 +1,17 @@
+export declare const SKIP_TELEMETRY_COMMANDS: Set<string>;
+export declare function resolveCanonicalName(parts: string[]): string;
+/**
+ * Resolve the command name from raw argv for paths where yargs validation
+ * fails before middleware runs (e.g. a missing required argument).
+ *
+ * Returns the first token that resolves to a KNOWN top-level command. Tokens
+ * are matched against the command registry rather than trusting position, so
+ * an option value preceding the command (e.g. `--api-key sk_live_… org` or
+ * `--mode ci org`) can never be recorded as the command name — that would leak
+ * secrets/values into telemetry and explode cardinality. Anything that isn't a
+ * known command (typos, stray values, `--help`) returns 'root', which is
+ * skipped. Only the top-level command is recorded; later positionals can be
+ * user values (org names, emails, IDs), so they are never included.
+ */
+export declare function resolveCommandNameFromRawArgs(rawArgs: string[]): string;
+export declare function extractUserFlags(rawArgs: string[]): string[];