workos 0.18.0 → 0.20.1

package/dist/test/setup.js

@@ -1,38 +0,0 @@
-import { vi } from 'vitest';
-/**
- * Global test setup — runs before every spec file.
- *
- * Replaces @napi-rs/keyring with an in-memory implementation so the test
- * suite can NEVER touch the real OS keychain. clearCredentials() and
- * saveCredentials() operate on the live `workos-cli` keychain entry even when
- * file-fallback storage is forced, so an un-mocked spec would wipe a
- * developer's real CLI login (this happened — that's why this exists).
- *
- * Specs that need richer keyring behaviour (e.g. simulating an unavailable
- * keychain) still declare their own vi.mock('@napi-rs/keyring', ...); a
- * per-file mock overrides this global default. The __IS_TEST_MOCK__ sentinel
- * is asserted by src/test/keyring-isolation.spec.ts so removing this setup
- * fails CI instead of silently re-arming the footgun.
- */
-vi.mock('@napi-rs/keyring', () => {
-    const store = new Map();
-    return {
-        __IS_TEST_MOCK__: true,
-        Entry: class MockEntry {
-            key;
-            constructor(service, account) {
-                this.key = `${service}:${account}`;
-            }
-            getPassword() {
-                return store.get(this.key) ?? null;
-            }
-            setPassword(password) {
-                store.set(this.key, password);
-            }
-            deletePassword() {
-                store.delete(this.key);
-            }
-        },
-    };
-});
-//# sourceMappingURL=setup.js.map

package/dist/test/setup.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/test/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,OAAO;QACL,gBAAgB,EAAE,IAAI;QACtB,KAAK,EAAE,MAAM,SAAS;YACZ,GAAG,CAAS;YAEpB,YAAY,OAAe,EAAE,OAAe;gBAC1C,IAAI,CAAC,GAAG,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;YACrC,CAAC;YAED,WAAW;gBACT,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YACrC,CAAC;YAED,WAAW,CAAC,QAAgB;gBAC1B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAChC,CAAC;YAED,cAAc;gBACZ,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;SACF;KACF,CAAC;AACJ,CAAC,CAAC,CAAC","sourcesContent":["import { vi } from 'vitest';\n\n/**\n * Global test setup — runs before every spec file.\n *\n * Replaces @napi-rs/keyring with an in-memory implementation so the test\n * suite can NEVER touch the real OS keychain. clearCredentials() and\n * saveCredentials() operate on the live `workos-cli` keychain entry even when\n * file-fallback storage is forced, so an un-mocked spec would wipe a\n * developer's real CLI login (this happened — that's why this exists).\n *\n * Specs that need richer keyring behaviour (e.g. simulating an unavailable\n * keychain) still declare their own vi.mock('@napi-rs/keyring', ...); a\n * per-file mock overrides this global default. The __IS_TEST_MOCK__ sentinel\n * is asserted by src/test/keyring-isolation.spec.ts so removing this setup\n * fails CI instead of silently re-arming the footgun.\n */\nvi.mock('@napi-rs/keyring', () => {\n  const store = new Map<string, string>();\n  return {\n    __IS_TEST_MOCK__: true,\n    Entry: class MockEntry {\n      private key: string;\n\n      constructor(service: string, account: string) {\n        this.key = `${service}:${account}`;\n      }\n\n      getPassword(): string | null {\n        return store.get(this.key) ?? null;\n      }\n\n      setPassword(password: string): void {\n        store.set(this.key, password);\n      }\n\n      deletePassword(): void {\n        store.delete(this.key);\n      }\n    },\n  };\n});\n"]}

package/dist/utils/analytics.d.ts

@@ -1,66 +0,0 @@
-import type { AuthMode, TerminationReason } from './telemetry-types.js';
-export declare class Analytics {
-    private tags;
-    private sessionId;
-    private sessionStartTime;
-    private distinctId?;
-    private mode?;
-    private authMode;
-    private totalInputTokens;
-    private totalOutputTokens;
-    private agentIterations;
-    constructor();
-    setDistinctId(distinctId: string): void;
-    setAccessToken(token: string): void;
-    setApiKeyAuth(apiKey: string): void;
-    setClaimTokenAuth(clientId: string, claimToken: string): void;
-    /**
-     * Set the auth mode explicitly for special cases. Normal CLI flows should use
-     * `configureAuthFromAvailableSources()` so transport and auth.mode stay aligned.
-     */
-    setAuthMode(mode: AuthMode): void;
-    setGatewayUrl(url: string): void;
-    private isEnabled;
-    /**
-     * Configure telemetry transport and auth.mode from all available CLI auth
-     * sources. Priority: stored JWT, unclaimed-environment claim token, active
-     * environment API key, then WORKOS_API_KEY.
-     */
-    configureAuthFromAvailableSources(): AuthMode;
-    /**
-     * Initialize telemetry for non-installer commands.
-     * Sets telemetry URL from default config and loads auth credentials.
-     */
-    initForNonInstaller(): void;
-    setTag(key: string, value: string | boolean | number | null | undefined): void;
-    capture(eventName: string, properties?: Record<string, unknown>): void;
-    captureException(error: Error, properties?: Record<string, unknown>): void;
-    getFeatureFlag(_flagKey: string): Promise<string | boolean | undefined>;
-    /** All capture methods that record error details MUST go through this. */
-    private extractErrorFields;
-    private detectCiProvider;
-    private getEnvFingerprint;
-    sessionStart(mode: 'cli' | 'tui' | 'headless', version: string): void;
-    stepCompleted(name: string, durationMs: number, success: boolean, error?: Error): void;
-    toolCalled(toolName: string, durationMs: number, success: boolean): void;
-    llmRequest(model: string, inputTokens: number, outputTokens: number): void;
-    incrementAgentIterations(): void;
-    emitCommandEvent(name: string, durationMs: number, success: boolean, options?: {
-        error?: Error;
-        flags?: string[];
-        reason?: TerminationReason;
-        errorCode?: string;
-        apiContext?: {
-            status?: number;
-            code?: string;
-            resource?: string;
-        };
-        extraAttributes?: Record<string, string | number | boolean>;
-    }): void;
-    captureUnhandledCrash(error: Error, options?: {
-        command?: string;
-        version?: string;
-    }): void;
-    shutdown(status: 'success' | 'error' | 'cancelled'): Promise<void>;
-}
-export declare const analytics: Analytics;

package/dist/utils/analytics.js

@@ -1,330 +0,0 @@
-import os from 'node:os';
-import { basename } from 'node:path';
-import { v4 as uuidv4 } from 'uuid';
-import { debug } from './debug.js';
-import { telemetryClient } from './telemetry-client.js';
-import { isTelemetryEnabled } from '../lib/preferences.js';
-import { getVersion } from '../lib/settings.js';
-import { getTelemetryUrl } from './urls.js';
-import { getCredentials, isTokenExpired } from '../lib/credentials.js';
-import { getActiveEnvironment, isUnclaimedEnvironment } from '../lib/config-store.js';
-import { getDeviceId } from '../lib/device-id.js';
-import { sanitizeMessage, sanitizeStack } from './crash-reporter.js';
-export class Analytics {
-    tags = {};
-    sessionId;
-    sessionStartTime;
-    distinctId;
-    mode;
-    authMode = 'none';
-    // Agent metrics tracking
-    totalInputTokens = 0;
-    totalOutputTokens = 0;
-    agentIterations = 0;
-    constructor() {
-        this.sessionId = uuidv4();
-        this.sessionStartTime = new Date();
-        this.tags = { $app_name: 'authkit-installer' };
-    }
-    setDistinctId(distinctId) {
-        this.distinctId = distinctId;
-    }
-    setAccessToken(token) {
-        telemetryClient.setAccessToken(token);
-    }
-    setApiKeyAuth(apiKey) {
-        telemetryClient.setApiKeyAuth(apiKey);
-    }
-    setClaimTokenAuth(clientId, claimToken) {
-        telemetryClient.setClaimTokenAuth(clientId, claimToken);
-    }
-    /**
-     * Set the auth mode explicitly for special cases. Normal CLI flows should use
-     * `configureAuthFromAvailableSources()` so transport and auth.mode stay aligned.
-     */
-    setAuthMode(mode) {
-        this.authMode = mode;
-    }
-    setGatewayUrl(url) {
-        telemetryClient.setGatewayUrl(url);
-    }
-    isEnabled() {
-        return isTelemetryEnabled();
-    }
-    /**
-     * Configure telemetry transport and auth.mode from all available CLI auth
-     * sources. Priority: stored JWT, unclaimed-environment claim token, active
-     * environment API key, then WORKOS_API_KEY.
-     */
-    configureAuthFromAvailableSources() {
-        if (!this.isEnabled())
-            return this.authMode;
-        this.authMode = 'none';
-        const creds = getCredentials();
-        // Only treat the JWT as usable auth when it is still valid. An expired
-        // access token would 401 against the telemetry guard and the event would
-        // be dropped, so fall through to claim-token / api-key auth instead.
-        if (creds?.accessToken && !isTokenExpired(creds)) {
-            telemetryClient.setAccessToken(creds.accessToken);
-            this.authMode = 'jwt';
-        }
-        // Preserve identity even when the token is expired.
-        if (creds?.userId) {
-            this.distinctId = creds.userId;
-        }
-        // Check for unclaimed environment — fall back to claim-token auth
-        // so unclaimed users' telemetry still reaches the backend.
-        try {
-            const env = getActiveEnvironment();
-            if (env && isUnclaimedEnvironment(env)) {
-                telemetryClient.setClaimTokenAuth(env.clientId, env.claimToken);
-                // Tag distinctId so unclaimed sessions are identifiable in analytics
-                this.distinctId = this.distinctId ?? `unclaimed:${env.clientId}`;
-                if (this.authMode === 'none')
-                    this.authMode = 'claim_token';
-            }
-            else if (env?.apiKey && this.authMode === 'none') {
-                telemetryClient.setApiKeyAuth(env.apiKey);
-                if (env.clientId)
-                    this.distinctId = this.distinctId ?? `env:${env.clientId}`;
-                this.authMode = 'api_key';
-            }
-        }
-        catch {
-            // Config-store failure is non-fatal for telemetry
-        }
-        // WORKOS_API_KEY covers API-key-only users. Lowest priority — JWT and
-        // claim-token auth have richer identity context when available.
-        if (this.authMode === 'none' && process.env.WORKOS_API_KEY) {
-            telemetryClient.setApiKeyAuth(process.env.WORKOS_API_KEY);
-            this.authMode = 'api_key';
-        }
-        return this.authMode;
-    }
-    /**
-     * Initialize telemetry for non-installer commands.
-     * Sets telemetry URL from default config and loads auth credentials.
-     */
-    initForNonInstaller() {
-        if (!this.isEnabled())
-            return;
-        telemetryClient.setGatewayUrl(getTelemetryUrl());
-        this.configureAuthFromAvailableSources();
-    }
-    setTag(key, value) {
-        this.tags[key] = value;
-    }
-    capture(eventName, properties) {
-        if (!this.isEnabled())
-            return;
-        debug(`[Analytics] capture: ${eventName}`, properties);
-        // Accumulate primitive values as tags for the session.end event
-        if (properties) {
-            for (const [key, value] of Object.entries(properties)) {
-                if (['string', 'number', 'boolean'].includes(typeof value)) {
-                    this.tags[key] = value;
-                }
-            }
-        }
-    }
-    captureException(error, properties = {}) {
-        if (!this.isEnabled())
-            return;
-        // Sanitize BEFORE logging — raw error.message can carry Bearer tokens /
-        // sk_ keys / JWTs on auth-failure paths, which would surface in stdout
-        // under WORKOS_DEBUG=1.
-        const { type, message } = this.extractErrorFields(error);
-        debug('[Analytics] captureException:', message, properties);
-        this.tags['error.type'] = type;
-        this.tags['error.message'] = message;
-    }
-    async getFeatureFlag(_flagKey) {
-        // Feature flags not implemented yet
-        return undefined;
-    }
-    /** All capture methods that record error details MUST go through this. */
-    extractErrorFields(error) {
-        return {
-            type: error.name,
-            message: sanitizeMessage(error.message),
-        };
-    }
-    detectCiProvider() {
-        if (process.env.GITHUB_ACTIONS)
-            return 'github-actions';
-        if (process.env.BUILDKITE)
-            return 'buildkite';
-        if (process.env.CIRCLECI)
-            return 'circleci';
-        if (process.env.GITLAB_CI)
-            return 'gitlab-ci';
-        if (process.env.JENKINS_URL)
-            return 'jenkins';
-        return undefined;
-    }
-    getEnvFingerprint() {
-        let osVersion;
-        try {
-            osVersion = os.release();
-        }
-        catch {
-            osVersion = 'unknown';
-        }
-        const ciProvider = this.detectCiProvider();
-        return {
-            'device.id': getDeviceId(),
-            'auth.mode': this.authMode,
-            'env.os': process.platform,
-            'env.os_version': osVersion,
-            'env.node_version': process.version,
-            'env.shell': basename(process.env.SHELL ?? process.env.COMSPEC ?? 'unknown'),
-            'env.ci': Boolean(process.env.CI || process.env.GITHUB_ACTIONS || process.env.BUILDKITE),
-            ...(ciProvider ? { 'env.ci_provider': ciProvider } : {}),
-        };
-    }
-    sessionStart(mode, version) {
-        if (!this.isEnabled())
-            return;
-        this.mode = mode;
-        const event = {
-            type: 'session.start',
-            sessionId: this.sessionId,
-            timestamp: this.sessionStartTime.toISOString(),
-            attributes: {
-                'installer.version': version,
-                'installer.mode': mode,
-                'workos.user_id': this.distinctId,
-                ...this.getEnvFingerprint(),
-            },
-        };
-        telemetryClient.queueEvent(event);
-    }
-    stepCompleted(name, durationMs, success, error) {
-        if (!this.isEnabled())
-            return;
-        const event = {
-            type: 'step',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            name,
-            startTimestamp: new Date(Date.now() - durationMs).toISOString(),
-            durationMs,
-            success,
-            error: error ? this.extractErrorFields(error) : undefined,
-        };
-        telemetryClient.queueEvent(event);
-    }
-    toolCalled(toolName, durationMs, success) {
-        if (!this.isEnabled())
-            return;
-        const event = {
-            type: 'agent.tool',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            toolName,
-            startTimestamp: new Date(Date.now() - durationMs).toISOString(),
-            durationMs,
-            success,
-        };
-        telemetryClient.queueEvent(event);
-    }
-    llmRequest(model, inputTokens, outputTokens) {
-        if (!this.isEnabled())
-            return;
-        this.totalInputTokens += inputTokens;
-        this.totalOutputTokens += outputTokens;
-        const event = {
-            type: 'agent.llm',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            model,
-            inputTokens,
-            outputTokens,
-        };
-        telemetryClient.queueEvent(event);
-    }
-    incrementAgentIterations() {
-        this.agentIterations++;
-    }
-    emitCommandEvent(name, durationMs, success, options) {
-        if (!this.isEnabled())
-            return;
-        const errorFields = options?.error ? this.extractErrorFields(options.error) : undefined;
-        const event = {
-            type: 'command',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            attributes: {
-                // Extras first: standard fields below win on key collision, so callers
-                // can never override command.name, error fields, or the fingerprint.
-                ...options?.extraAttributes,
-                'command.name': name,
-                'command.duration_ms': durationMs,
-                'command.success': success,
-                'cli.version': getVersion(),
-                ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),
-                ...(errorFields
-                    ? {
-                        'command.error_type': errorFields.type,
-                        'command.error_message': errorFields.message,
-                    }
-                    : {}),
-                ...(options?.flags?.length ? { 'command.flags': options.flags.join(',') } : {}),
-                ...(options?.reason ? { 'termination.reason': options.reason } : {}),
-                ...(options?.errorCode ? { 'error.code': options.errorCode } : {}),
-                ...(options?.apiContext?.status !== undefined ? { 'api.status': options.apiContext.status } : {}),
-                ...(options?.apiContext?.code ? { 'api.code': options.apiContext.code } : {}),
-                ...(options?.apiContext?.resource ? { 'api.resource': options.apiContext.resource } : {}),
-                ...this.getEnvFingerprint(),
-            },
-        };
-        telemetryClient.queueEvent(event);
-    }
-    captureUnhandledCrash(error, options) {
-        if (!this.isEnabled())
-            return;
-        const { type, message } = this.extractErrorFields(error);
-        const event = {
-            type: 'crash',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            attributes: {
-                'crash.error_type': type,
-                'crash.error_message': message,
-                'crash.stack': sanitizeStack(error.stack),
-                ...(options?.command ? { 'crash.command': options.command } : {}),
-                'cli.version': options?.version ?? getVersion(),
-                ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),
-                ...this.getEnvFingerprint(),
-            },
-        };
-        telemetryClient.queueEvent(event);
-    }
-    async shutdown(status) {
-        if (!this.isEnabled())
-            return;
-        const duration = Date.now() - this.sessionStartTime.getTime();
-        // Filter out null/undefined tags
-        const extraAttributes = Object.fromEntries(Object.entries(this.tags).filter(([, v]) => v != null));
-        const envFingerprint = this.getEnvFingerprint();
-        const event = {
-            type: 'session.end',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            attributes: {
-                'installer.outcome': status,
-                'installer.duration_ms': duration,
-                'installer.agent.iterations': this.agentIterations,
-                'installer.agent.tokens.input': this.totalInputTokens,
-                'installer.agent.tokens.output': this.totalOutputTokens,
-                ...envFingerprint,
-                ...(this.mode ? { 'installer.mode': this.mode } : {}),
-                ...extraAttributes,
-            },
-        };
-        telemetryClient.queueEvent(event);
-        await telemetryClient.flush();
-    }
-}
-export const analytics = new Analytics();
-//# sourceMappingURL=analytics.js.map

package/dist/utils/analytics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAaxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,OAAO,SAAS;IACZ,IAAI,GAAiE,EAAE,CAAC;IACxE,SAAS,CAAS;IAClB,gBAAgB,CAAO;IACvB,UAAU,CAAU;IACpB,IAAI,CAA8B;IAClC,QAAQ,GAAa,MAAM,CAAC;IAEpC,yBAAyB;IACjB,gBAAgB,GAAG,CAAC,CAAC;IACrB,iBAAiB,GAAG,CAAC,CAAC;IACtB,eAAe,GAAG,CAAC,CAAC;IAE5B;QACE,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjD,CAAC;IAED,aAAa,CAAC,UAAkB;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,iBAAiB,CAAC,QAAgB,EAAE,UAAkB;QACpD,eAAe,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,IAAc;QACxB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAEO,SAAS;QACf,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,iCAAiC;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAE5C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACvB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,KAAK,EAAE,WAAW,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,oDAAoD;QACpD,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;QACjC,CAAC;QAED,kEAAkE;QAClE,2DAA2D;QAC3D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChE,qEAAqE;gBACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,aAAa,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;oBAAE,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;YAC9D,CAAC;iBAAM,IAAI,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACnD,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,GAAG,CAAC,QAAQ;oBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7E,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QAED,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC3D,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,eAAe,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,GAAW,EAAE,KAAmD;QACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,SAAiB,EAAE,UAAoC;QAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,KAAK,CAAC,wBAAwB,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;QAEvD,gEAAgE;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAkC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,KAAY,EAAE,aAAsC,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,wEAAwE;QACxE,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzD,KAAK,CAAC,+BAA+B,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,oCAAoC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0EAA0E;IAClE,kBAAkB,CAAC,KAAY;QACrC,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;SACxC,CAAC;IACJ,CAAC;IAEO,gBAAgB;QACtB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,gBAAgB,CAAC;QACxD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB;QACvB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3C,OAAO;YACL,WAAW,EAAE,WAAW,EAAE;YAC1B,WAAW,EAAE,IAAI,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,SAAS;YAC3B,kBAAkB,EAAE,OAAO,CAAC,OAAO;YACnC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;YAC5E,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YACxF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAgC,EAAE,OAAe;QAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAEjB,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE;YAC9C,UAAU,EAAE;gBACV,mBAAmB,EAAE,OAAO;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI,CAAC,UAAU;gBACjC,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,UAAkB,EAAE,OAAgB,EAAE,KAAa;QAC7E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI;YACJ,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YAC/D,UAAU;YACV,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,UAAkB,EAAE,OAAgB;QAC/D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,KAAK,GAAmB;YAC5B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ;YACR,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YAC/D,UAAU;YACV,OAAO;SACR,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,YAAoB;QACjE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC;QACrC,IAAI,CAAC,iBAAiB,IAAI,YAAY,CAAC;QAEvC,MAAM,KAAK,GAAkB;YAC3B,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,WAAW;YACX,YAAY;SACb,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,wBAAwB;QACtB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,gBAAgB,CACd,IAAY,EACZ,UAAkB,EAClB,OAAgB,EAChB,OAOC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExF,MAAM,KAAK,GAAiB;YAC1B,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,uEAAuE;gBACvE,qEAAqE;gBACrE,GAAG,OAAO,EAAE,eAAe;gBAC3B,cAAc,EAAE,IAAI;gBACpB,qBAAqB,EAAE,UAAU;gBACjC,iBAAiB,EAAE,OAAO;gBAC1B,aAAa,EAAE,UAAU,EAAE;gBAC3B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,WAAW;oBACb,CAAC,CAAC;wBACE,oBAAoB,EAAE,WAAW,CAAC,IAAI;wBACtC,uBAAuB,EAAE,WAAW,CAAC,OAAO;qBAC7C;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjG,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,qBAAqB,CAAC,KAAY,EAAE,OAAgD;QAClF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAe;YACxB,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,kBAAkB,EAAE,IAAI;gBACxB,qBAAqB,EAAE,OAAO;gBAC9B,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;gBACzC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,aAAa,EAAE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAyC;QACtD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE9D,iCAAiC;QACjC,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAGhG,CAAC;QAEF,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,KAAK,GAAoB;YAC7B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,mBAAmB,EAAE,MAAM;gBAC3B,uBAAuB,EAAE,QAAQ;gBACjC,4BAA4B,EAAE,IAAI,CAAC,eAAe;gBAClD,8BAA8B,EAAE,IAAI,CAAC,gBAAgB;gBACrD,+BAA+B,EAAE,IAAI,CAAC,iBAAiB;gBACvD,GAAG,cAAc;gBACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,eAAe;aACnB;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC","sourcesContent":["import os from 'node:os';\nimport { basename } from 'node:path';\nimport { v4 as uuidv4 } from 'uuid';\nimport { debug } from './debug.js';\nimport { telemetryClient } from './telemetry-client.js';\nimport type {\n  AuthMode,\n  SessionStartEvent,\n  SessionEndEvent,\n  StepEvent,\n  AgentToolEvent,\n  AgentLLMEvent,\n  CommandEvent,\n  CrashEvent,\n  TerminationReason,\n  EnvFingerprint,\n} from './telemetry-types.js';\nimport { isTelemetryEnabled } from '../lib/preferences.js';\nimport { getVersion } from '../lib/settings.js';\nimport { getTelemetryUrl } from './urls.js';\nimport { getCredentials, isTokenExpired } from '../lib/credentials.js';\nimport { getActiveEnvironment, isUnclaimedEnvironment } from '../lib/config-store.js';\nimport { getDeviceId } from '../lib/device-id.js';\nimport { sanitizeMessage, sanitizeStack } from './crash-reporter.js';\n\nexport class Analytics {\n  private tags: Record<string, string | boolean | number | null | undefined> = {};\n  private sessionId: string;\n  private sessionStartTime: Date;\n  private distinctId?: string;\n  private mode?: 'cli' | 'tui' | 'headless';\n  private authMode: AuthMode = 'none';\n\n  // Agent metrics tracking\n  private totalInputTokens = 0;\n  private totalOutputTokens = 0;\n  private agentIterations = 0;\n\n  constructor() {\n    this.sessionId = uuidv4();\n    this.sessionStartTime = new Date();\n    this.tags = { $app_name: 'authkit-installer' };\n  }\n\n  setDistinctId(distinctId: string) {\n    this.distinctId = distinctId;\n  }\n\n  setAccessToken(token: string) {\n    telemetryClient.setAccessToken(token);\n  }\n\n  setApiKeyAuth(apiKey: string) {\n    telemetryClient.setApiKeyAuth(apiKey);\n  }\n\n  setClaimTokenAuth(clientId: string, claimToken: string) {\n    telemetryClient.setClaimTokenAuth(clientId, claimToken);\n  }\n\n  /**\n   * Set the auth mode explicitly for special cases. Normal CLI flows should use\n   * `configureAuthFromAvailableSources()` so transport and auth.mode stay aligned.\n   */\n  setAuthMode(mode: AuthMode) {\n    this.authMode = mode;\n  }\n\n  setGatewayUrl(url: string) {\n    telemetryClient.setGatewayUrl(url);\n  }\n\n  private isEnabled(): boolean {\n    return isTelemetryEnabled();\n  }\n\n  /**\n   * Configure telemetry transport and auth.mode from all available CLI auth\n   * sources. Priority: stored JWT, unclaimed-environment claim token, active\n   * environment API key, then WORKOS_API_KEY.\n   */\n  configureAuthFromAvailableSources(): AuthMode {\n    if (!this.isEnabled()) return this.authMode;\n\n    this.authMode = 'none';\n    const creds = getCredentials();\n    // Only treat the JWT as usable auth when it is still valid. An expired\n    // access token would 401 against the telemetry guard and the event would\n    // be dropped, so fall through to claim-token / api-key auth instead.\n    if (creds?.accessToken && !isTokenExpired(creds)) {\n      telemetryClient.setAccessToken(creds.accessToken);\n      this.authMode = 'jwt';\n    }\n    // Preserve identity even when the token is expired.\n    if (creds?.userId) {\n      this.distinctId = creds.userId;\n    }\n\n    // Check for unclaimed environment — fall back to claim-token auth\n    // so unclaimed users' telemetry still reaches the backend.\n    try {\n      const env = getActiveEnvironment();\n      if (env && isUnclaimedEnvironment(env)) {\n        telemetryClient.setClaimTokenAuth(env.clientId, env.claimToken);\n        // Tag distinctId so unclaimed sessions are identifiable in analytics\n        this.distinctId = this.distinctId ?? `unclaimed:${env.clientId}`;\n        if (this.authMode === 'none') this.authMode = 'claim_token';\n      } else if (env?.apiKey && this.authMode === 'none') {\n        telemetryClient.setApiKeyAuth(env.apiKey);\n        if (env.clientId) this.distinctId = this.distinctId ?? `env:${env.clientId}`;\n        this.authMode = 'api_key';\n      }\n    } catch {\n      // Config-store failure is non-fatal for telemetry\n    }\n\n    // WORKOS_API_KEY covers API-key-only users. Lowest priority — JWT and\n    // claim-token auth have richer identity context when available.\n    if (this.authMode === 'none' && process.env.WORKOS_API_KEY) {\n      telemetryClient.setApiKeyAuth(process.env.WORKOS_API_KEY);\n      this.authMode = 'api_key';\n    }\n\n    return this.authMode;\n  }\n\n  /**\n   * Initialize telemetry for non-installer commands.\n   * Sets telemetry URL from default config and loads auth credentials.\n   */\n  initForNonInstaller(): void {\n    if (!this.isEnabled()) return;\n\n    telemetryClient.setGatewayUrl(getTelemetryUrl());\n    this.configureAuthFromAvailableSources();\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    if (!this.isEnabled()) return;\n\n    debug(`[Analytics] capture: ${eventName}`, properties);\n\n    // Accumulate primitive values as tags for the session.end event\n    if (properties) {\n      for (const [key, value] of Object.entries(properties)) {\n        if (['string', 'number', 'boolean'].includes(typeof value)) {\n          this.tags[key] = value as string | number | boolean;\n        }\n      }\n    }\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    if (!this.isEnabled()) return;\n\n    // Sanitize BEFORE logging — raw error.message can carry Bearer tokens /\n    // sk_ keys / JWTs on auth-failure paths, which would surface in stdout\n    // under WORKOS_DEBUG=1.\n    const { type, message } = this.extractErrorFields(error);\n    debug('[Analytics] captureException:', message, properties);\n    this.tags['error.type'] = type;\n    this.tags['error.message'] = message;\n  }\n\n  async getFeatureFlag(_flagKey: string): Promise<string | boolean | undefined> {\n    // Feature flags not implemented yet\n    return undefined;\n  }\n\n  /** All capture methods that record error details MUST go through this. */\n  private extractErrorFields(error: Error): { type: string; message: string } {\n    return {\n      type: error.name,\n      message: sanitizeMessage(error.message),\n    };\n  }\n\n  private detectCiProvider(): string | undefined {\n    if (process.env.GITHUB_ACTIONS) return 'github-actions';\n    if (process.env.BUILDKITE) return 'buildkite';\n    if (process.env.CIRCLECI) return 'circleci';\n    if (process.env.GITLAB_CI) return 'gitlab-ci';\n    if (process.env.JENKINS_URL) return 'jenkins';\n    return undefined;\n  }\n\n  private getEnvFingerprint(): EnvFingerprint {\n    let osVersion: string;\n    try {\n      osVersion = os.release();\n    } catch {\n      osVersion = 'unknown';\n    }\n\n    const ciProvider = this.detectCiProvider();\n\n    return {\n      'device.id': getDeviceId(),\n      'auth.mode': this.authMode,\n      'env.os': process.platform,\n      'env.os_version': osVersion,\n      'env.node_version': process.version,\n      'env.shell': basename(process.env.SHELL ?? process.env.COMSPEC ?? 'unknown'),\n      'env.ci': Boolean(process.env.CI || process.env.GITHUB_ACTIONS || process.env.BUILDKITE),\n      ...(ciProvider ? { 'env.ci_provider': ciProvider } : {}),\n    };\n  }\n\n  sessionStart(mode: 'cli' | 'tui' | 'headless', version: string) {\n    if (!this.isEnabled()) return;\n\n    this.mode = mode;\n\n    const event: SessionStartEvent = {\n      type: 'session.start',\n      sessionId: this.sessionId,\n      timestamp: this.sessionStartTime.toISOString(),\n      attributes: {\n        'installer.version': version,\n        'installer.mode': mode,\n        'workos.user_id': this.distinctId,\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  stepCompleted(name: string, durationMs: number, success: boolean, error?: Error) {\n    if (!this.isEnabled()) return;\n\n    const event: StepEvent = {\n      type: 'step',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      name,\n      startTimestamp: new Date(Date.now() - durationMs).toISOString(),\n      durationMs,\n      success,\n      error: error ? this.extractErrorFields(error) : undefined,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  toolCalled(toolName: string, durationMs: number, success: boolean) {\n    if (!this.isEnabled()) return;\n\n    const event: AgentToolEvent = {\n      type: 'agent.tool',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      toolName,\n      startTimestamp: new Date(Date.now() - durationMs).toISOString(),\n      durationMs,\n      success,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  llmRequest(model: string, inputTokens: number, outputTokens: number) {\n    if (!this.isEnabled()) return;\n\n    this.totalInputTokens += inputTokens;\n    this.totalOutputTokens += outputTokens;\n\n    const event: AgentLLMEvent = {\n      type: 'agent.llm',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      model,\n      inputTokens,\n      outputTokens,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  incrementAgentIterations() {\n    this.agentIterations++;\n  }\n\n  emitCommandEvent(\n    name: string,\n    durationMs: number,\n    success: boolean,\n    options?: {\n      error?: Error;\n      flags?: string[];\n      reason?: TerminationReason;\n      errorCode?: string;\n      apiContext?: { status?: number; code?: string; resource?: string };\n      extraAttributes?: Record<string, string | number | boolean>;\n    },\n  ) {\n    if (!this.isEnabled()) return;\n\n    const errorFields = options?.error ? this.extractErrorFields(options.error) : undefined;\n\n    const event: CommandEvent = {\n      type: 'command',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        // Extras first: standard fields below win on key collision, so callers\n        // can never override command.name, error fields, or the fingerprint.\n        ...options?.extraAttributes,\n        'command.name': name,\n        'command.duration_ms': durationMs,\n        'command.success': success,\n        'cli.version': getVersion(),\n        ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),\n        ...(errorFields\n          ? {\n              'command.error_type': errorFields.type,\n              'command.error_message': errorFields.message,\n            }\n          : {}),\n        ...(options?.flags?.length ? { 'command.flags': options.flags.join(',') } : {}),\n        ...(options?.reason ? { 'termination.reason': options.reason } : {}),\n        ...(options?.errorCode ? { 'error.code': options.errorCode } : {}),\n        ...(options?.apiContext?.status !== undefined ? { 'api.status': options.apiContext.status } : {}),\n        ...(options?.apiContext?.code ? { 'api.code': options.apiContext.code } : {}),\n        ...(options?.apiContext?.resource ? { 'api.resource': options.apiContext.resource } : {}),\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  captureUnhandledCrash(error: Error, options?: { command?: string; version?: string }) {\n    if (!this.isEnabled()) return;\n\n    const { type, message } = this.extractErrorFields(error);\n\n    const event: CrashEvent = {\n      type: 'crash',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        'crash.error_type': type,\n        'crash.error_message': message,\n        'crash.stack': sanitizeStack(error.stack),\n        ...(options?.command ? { 'crash.command': options.command } : {}),\n        'cli.version': options?.version ?? getVersion(),\n        ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (!this.isEnabled()) return;\n\n    const duration = Date.now() - this.sessionStartTime.getTime();\n\n    // Filter out null/undefined tags\n    const extraAttributes = Object.fromEntries(Object.entries(this.tags).filter(([, v]) => v != null)) as Record<\n      string,\n      string | number | boolean\n    >;\n\n    const envFingerprint = this.getEnvFingerprint();\n\n    const event: SessionEndEvent = {\n      type: 'session.end',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        'installer.outcome': status,\n        'installer.duration_ms': duration,\n        'installer.agent.iterations': this.agentIterations,\n        'installer.agent.tokens.input': this.totalInputTokens,\n        'installer.agent.tokens.output': this.totalOutputTokens,\n        ...envFingerprint,\n        ...(this.mode ? { 'installer.mode': this.mode } : {}),\n        ...extraAttributes,\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n    await telemetryClient.flush();\n  }\n}\n\nexport const analytics = new Analytics();\n"]}

package/dist/utils/bash.d.ts

@@ -1,2 +0,0 @@
-export declare function executeSync(command: string): string;
-export declare function execute(command: string): Promise<string>;

package/dist/utils/bash.js

@@ -1,17 +0,0 @@
-import * as child_process from 'child_process';
-export function executeSync(command) {
-    const output = child_process.execSync(command);
-    return output.toString();
-}
-export function execute(command) {
-    return new Promise((resolve, reject) => {
-        child_process.exec(command, (error, stdout, _) => {
-            if (error) {
-                reject(error);
-                return;
-            }
-            resolve(stdout);
-        });
-    });
-}
-//# sourceMappingURL=bash.js.map

package/dist/utils/bash.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bash.js","sourceRoot":"","sources":["../../src/utils/bash.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,eAAe,CAAC;AAE/C,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;YAC/C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import * as child_process from 'child_process';\n\nexport function executeSync(command: string): string {\n  const output = child_process.execSync(command);\n  return output.toString();\n}\n\nexport function execute(command: string): Promise<string> {\n  return new Promise((resolve, reject) => {\n    child_process.exec(command, (error, stdout, _) => {\n      if (error) {\n        reject(error);\n        return;\n      }\n\n      resolve(stdout);\n    });\n  });\n}\n"]}

package/dist/utils/box.d.ts

@@ -1,33 +0,0 @@
-import type chalk from 'chalk';
-/**
- * Word-wrap a string to a maximum visible width, preserving ANSI color.
- *
- * chalk emits self-closing color spans (e.g. `\x1b[36m…\x1b[39m`), so each
- * colored fragment is atomic: we tokenize the input into whole colored spans
- * and plain words, then greedily pack tokens into lines measured by their
- * VISIBLE width. Because every token carries its own open+close codes, color
- * never bleeds across a line break onto the border or padding.
- *
- * A single token wider than `maxWidth` (rare — only a very narrow terminal vs.
- * a long unbroken word) overflows its own line rather than being split mid-span.
- * Such an overflow can push the rendered box border past the terminal width;
- * acceptable at standard widths. Note that a colored command produced by
- * `formatWorkOSCommand` can be long (e.g. `npx workos@latest telemetry opt-out`)
- * and stays a single unbreakable token by design.
- *
- * Limitation: a colored span is grouped atomically only when it is a single SGR
- * layer (one open code + one close code, as `chalk.cyan('…')` emits). Stacked
- * styles such as bold+color (`\x1b[1m\x1b[36m…\x1b[39m\x1b[22m`) or two adjacent
- * spans with no separating space are not guaranteed to stay on one line and may
- * leave a reset code mid-line. All current callers use single-color spans only.
- */
-export declare function wrapAnsiAware(input: string, maxWidth: number): string[];
-/**
- * Render a bordered box to stderr, wrapping to the terminal width.
- *
- * When the content fits on one line it renders exactly as a single-line box
- * (the historical behavior). When it would overflow the terminal, the content
- * is word-wrapped (ANSI-aware) and the box grows to multiple lines so the
- * border never breaks on a narrow terminal.
- */
-export declare function renderStderrBox(inner: string, color: typeof chalk.yellow | typeof chalk.green): void;

package/dist/utils/box.js

@@ -1,102 +0,0 @@
-import { stripAnsii } from './string.js';
-/** Visible (printable) width of a string, ignoring ANSI escape sequences. */
-function visibleWidth(str) {
-    return stripAnsii(str).length;
-}
-/** Terminal width for stderr output, falling back to stdout then 80 columns. */
-function terminalWidth() {
-    return process.stderr.columns || process.stdout.columns || 80;
-}
-/**
- * Word-wrap a string to a maximum visible width, preserving ANSI color.
- *
- * chalk emits self-closing color spans (e.g. `\x1b[36m…\x1b[39m`), so each
- * colored fragment is atomic: we tokenize the input into whole colored spans
- * and plain words, then greedily pack tokens into lines measured by their
- * VISIBLE width. Because every token carries its own open+close codes, color
- * never bleeds across a line break onto the border or padding.
- *
- * A single token wider than `maxWidth` (rare — only a very narrow terminal vs.
- * a long unbroken word) overflows its own line rather than being split mid-span.
- * Such an overflow can push the rendered box border past the terminal width;
- * acceptable at standard widths. Note that a colored command produced by
- * `formatWorkOSCommand` can be long (e.g. `npx workos@latest telemetry opt-out`)
- * and stays a single unbreakable token by design.
- *
- * Limitation: a colored span is grouped atomically only when it is a single SGR
- * layer (one open code + one close code, as `chalk.cyan('…')` emits). Stacked
- * styles such as bold+color (`\x1b[1m\x1b[36m…\x1b[39m\x1b[22m`) or two adjacent
- * spans with no separating space are not guaranteed to stay on one line and may
- * leave a reset code mid-line. All current callers use single-color spans only.
- */
-export function wrapAnsiAware(input, maxWidth) {
-    // A token is either: a full SGR-wrapped span (open code, content that may
-    // contain spaces, close code), a run of non-space/non-escape characters
-    // (a plain word), or a lone escape. Whitespace between tokens is dropped and
-    // re-inserted as single separating spaces.
-    const tokenRe = /\x1b\[[0-9;]*m[^\x1b]*?\x1b\[[0-9;]*m|[^\s\x1b]+|\x1b\[[0-9;]*m/g;
-    const tokens = input.match(tokenRe) ?? [];
-    const lines = [];
-    let line = '';
-    let lineWidth = 0;
-    for (const token of tokens) {
-        const tokenWidth = visibleWidth(token);
-        if (lineWidth === 0) {
-            line = token;
-            lineWidth = tokenWidth;
-        }
-        else if (lineWidth + 1 + tokenWidth <= maxWidth) {
-            line += ` ${token}`;
-            lineWidth += 1 + tokenWidth;
-        }
-        else {
-            lines.push(line);
-            line = token;
-            lineWidth = tokenWidth;
-        }
-    }
-    if (line)
-        lines.push(line);
-    return lines.length > 0 ? lines : [''];
-}
-/**
- * Render a bordered box to stderr, wrapping to the terminal width.
- *
- * When the content fits on one line it renders exactly as a single-line box
- * (the historical behavior). When it would overflow the terminal, the content
- * is word-wrapped (ANSI-aware) and the box grows to multiple lines so the
- * border never breaks on a narrow terminal.
- */
-export function renderStderrBox(inner, color) {
-    const cols = terminalWidth();
-    const plainLen = visibleWidth(inner);
-    // Fast path: content (including its own padding spaces) fits within the
-    // terminal. Render the single-line box byte-for-byte as before.
-    if (plainLen <= cols - 4) {
-        const border = '─'.repeat(plainLen);
-        console.error('');
-        console.error(color(`  ┌${border}┐`));
-        console.error(color('  │') + inner + color('│'));
-        console.error(color(`  └${border}┘`));
-        console.error('');
-        return;
-    }
-    // Wrap path: trim the caller's outer padding, wrap to the available width,
-    // then re-pad each line to a uniform inner width with one space of padding
-    // on each side. Layout per line: "  │ " + text + " │" = text + 6 columns.
-    const content = inner.replace(/^[ \t]+/, '').replace(/[ \t]+$/, '');
-    const maxTextWidth = Math.max(1, cols - 6);
-    const wrapped = wrapAnsiAware(content, maxTextWidth);
-    // Snug the box to the longest wrapped line rather than the full terminal.
-    const textWidth = Math.max(...wrapped.map(visibleWidth));
-    const border = '─'.repeat(textWidth + 2);
-    console.error('');
-    console.error(color(`  ┌${border}┐`));
-    for (const ln of wrapped) {
-        const pad = ' '.repeat(Math.max(0, textWidth - visibleWidth(ln)));
-        console.error(`${color('  │')} ${ln}${pad} ${color('│')}`);
-    }
-    console.error(color(`  └${border}┘`));
-    console.error('');
-}
-//# sourceMappingURL=box.js.map