workos 0.19.0 → 0.20.2

package/dist/test/setup.js

@@ -1,38 +0,0 @@
-import { vi } from 'vitest';
-/**
- * Global test setup — runs before every spec file.
- *
- * Replaces @napi-rs/keyring with an in-memory implementation so the test
- * suite can NEVER touch the real OS keychain. clearCredentials() and
- * saveCredentials() operate on the live `workos-cli` keychain entry even when
- * file-fallback storage is forced, so an un-mocked spec would wipe a
- * developer's real CLI login (this happened — that's why this exists).
- *
- * Specs that need richer keyring behaviour (e.g. simulating an unavailable
- * keychain) still declare their own vi.mock('@napi-rs/keyring', ...); a
- * per-file mock overrides this global default. The __IS_TEST_MOCK__ sentinel
- * is asserted by src/test/keyring-isolation.spec.ts so removing this setup
- * fails CI instead of silently re-arming the footgun.
- */
-vi.mock('@napi-rs/keyring', () => {
-    const store = new Map();
-    return {
-        __IS_TEST_MOCK__: true,
-        Entry: class MockEntry {
-            key;
-            constructor(service, account) {
-                this.key = `${service}:${account}`;
-            }
-            getPassword() {
-                return store.get(this.key) ?? null;
-            }
-            setPassword(password) {
-                store.set(this.key, password);
-            }
-            deletePassword() {
-                store.delete(this.key);
-            }
-        },
-    };
-});
-//# sourceMappingURL=setup.js.map

package/dist/test/setup.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/test/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,OAAO;QACL,gBAAgB,EAAE,IAAI;QACtB,KAAK,EAAE,MAAM,SAAS;YACZ,GAAG,CAAS;YAEpB,YAAY,OAAe,EAAE,OAAe;gBAC1C,IAAI,CAAC,GAAG,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;YACrC,CAAC;YAED,WAAW;gBACT,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YACrC,CAAC;YAED,WAAW,CAAC,QAAgB;gBAC1B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAChC,CAAC;YAED,cAAc;gBACZ,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;SACF;KACF,CAAC;AACJ,CAAC,CAAC,CAAC","sourcesContent":["import { vi } from 'vitest';\n\n/**\n * Global test setup — runs before every spec file.\n *\n * Replaces @napi-rs/keyring with an in-memory implementation so the test\n * suite can NEVER touch the real OS keychain. clearCredentials() and\n * saveCredentials() operate on the live `workos-cli` keychain entry even when\n * file-fallback storage is forced, so an un-mocked spec would wipe a\n * developer's real CLI login (this happened — that's why this exists).\n *\n * Specs that need richer keyring behaviour (e.g. simulating an unavailable\n * keychain) still declare their own vi.mock('@napi-rs/keyring', ...); a\n * per-file mock overrides this global default. The __IS_TEST_MOCK__ sentinel\n * is asserted by src/test/keyring-isolation.spec.ts so removing this setup\n * fails CI instead of silently re-arming the footgun.\n */\nvi.mock('@napi-rs/keyring', () => {\n  const store = new Map<string, string>();\n  return {\n    __IS_TEST_MOCK__: true,\n    Entry: class MockEntry {\n      private key: string;\n\n      constructor(service: string, account: string) {\n        this.key = `${service}:${account}`;\n      }\n\n      getPassword(): string | null {\n        return store.get(this.key) ?? null;\n      }\n\n      setPassword(password: string): void {\n        store.set(this.key, password);\n      }\n\n      deletePassword(): void {\n        store.delete(this.key);\n      }\n    },\n  };\n});\n"]}

package/dist/utils/analytics.d.ts

@@ -1,66 +0,0 @@
-import type { AuthMode, TerminationReason } from './telemetry-types.js';
-export declare class Analytics {
-    private tags;
-    private sessionId;
-    private sessionStartTime;
-    private distinctId?;
-    private mode?;
-    private authMode;
-    private totalInputTokens;
-    private totalOutputTokens;
-    private agentIterations;
-    constructor();
-    setDistinctId(distinctId: string): void;
-    setAccessToken(token: string): void;
-    setApiKeyAuth(apiKey: string): void;
-    setClaimTokenAuth(clientId: string, claimToken: string): void;
-    /**
-     * Set the auth mode explicitly for special cases. Normal CLI flows should use
-     * `configureAuthFromAvailableSources()` so transport and auth.mode stay aligned.
-     */
-    setAuthMode(mode: AuthMode): void;
-    setGatewayUrl(url: string): void;
-    private isEnabled;
-    /**
-     * Configure telemetry transport and auth.mode from all available CLI auth
-     * sources. Priority: stored JWT, unclaimed-environment claim token, active
-     * environment API key, then WORKOS_API_KEY.
-     */
-    configureAuthFromAvailableSources(): AuthMode;
-    /**
-     * Initialize telemetry for non-installer commands.
-     * Sets telemetry URL from default config and loads auth credentials.
-     */
-    initForNonInstaller(): void;
-    setTag(key: string, value: string | boolean | number | null | undefined): void;
-    capture(eventName: string, properties?: Record<string, unknown>): void;
-    captureException(error: Error, properties?: Record<string, unknown>): void;
-    getFeatureFlag(_flagKey: string): Promise<string | boolean | undefined>;
-    /** All capture methods that record error details MUST go through this. */
-    private extractErrorFields;
-    private detectCiProvider;
-    private getEnvFingerprint;
-    sessionStart(mode: 'cli' | 'tui' | 'headless', version: string): void;
-    stepCompleted(name: string, durationMs: number, success: boolean, error?: Error): void;
-    toolCalled(toolName: string, durationMs: number, success: boolean): void;
-    llmRequest(model: string, inputTokens: number, outputTokens: number): void;
-    incrementAgentIterations(): void;
-    emitCommandEvent(name: string, durationMs: number, success: boolean, options?: {
-        error?: Error;
-        flags?: string[];
-        reason?: TerminationReason;
-        errorCode?: string;
-        apiContext?: {
-            status?: number;
-            code?: string;
-            resource?: string;
-        };
-        extraAttributes?: Record<string, string | number | boolean>;
-    }): void;
-    captureUnhandledCrash(error: Error, options?: {
-        command?: string;
-        version?: string;
-    }): void;
-    shutdown(status: 'success' | 'error' | 'cancelled'): Promise<void>;
-}
-export declare const analytics: Analytics;

package/dist/utils/analytics.js

@@ -1,330 +0,0 @@
-import os from 'node:os';
-import { basename } from 'node:path';
-import { v4 as uuidv4 } from 'uuid';
-import { debug } from './debug.js';
-import { telemetryClient } from './telemetry-client.js';
-import { isTelemetryEnabled } from '../lib/preferences.js';
-import { getVersion } from '../lib/settings.js';
-import { getTelemetryUrl } from './urls.js';
-import { getCredentials, isTokenExpired } from '../lib/credentials.js';
-import { getActiveEnvironment, isUnclaimedEnvironment } from '../lib/config-store.js';
-import { getDeviceId } from '../lib/device-id.js';
-import { sanitizeMessage, sanitizeStack } from './crash-reporter.js';
-export class Analytics {
-    tags = {};
-    sessionId;
-    sessionStartTime;
-    distinctId;
-    mode;
-    authMode = 'none';
-    // Agent metrics tracking
-    totalInputTokens = 0;
-    totalOutputTokens = 0;
-    agentIterations = 0;
-    constructor() {
-        this.sessionId = uuidv4();
-        this.sessionStartTime = new Date();
-        this.tags = { $app_name: 'authkit-installer' };
-    }
-    setDistinctId(distinctId) {
-        this.distinctId = distinctId;
-    }
-    setAccessToken(token) {
-        telemetryClient.setAccessToken(token);
-    }
-    setApiKeyAuth(apiKey) {
-        telemetryClient.setApiKeyAuth(apiKey);
-    }
-    setClaimTokenAuth(clientId, claimToken) {
-        telemetryClient.setClaimTokenAuth(clientId, claimToken);
-    }
-    /**
-     * Set the auth mode explicitly for special cases. Normal CLI flows should use
-     * `configureAuthFromAvailableSources()` so transport and auth.mode stay aligned.
-     */
-    setAuthMode(mode) {
-        this.authMode = mode;
-    }
-    setGatewayUrl(url) {
-        telemetryClient.setGatewayUrl(url);
-    }
-    isEnabled() {
-        return isTelemetryEnabled();
-    }
-    /**
-     * Configure telemetry transport and auth.mode from all available CLI auth
-     * sources. Priority: stored JWT, unclaimed-environment claim token, active
-     * environment API key, then WORKOS_API_KEY.
-     */
-    configureAuthFromAvailableSources() {
-        if (!this.isEnabled())
-            return this.authMode;
-        this.authMode = 'none';
-        const creds = getCredentials();
-        // Only treat the JWT as usable auth when it is still valid. An expired
-        // access token would 401 against the telemetry guard and the event would
-        // be dropped, so fall through to claim-token / api-key auth instead.
-        if (creds?.accessToken && !isTokenExpired(creds)) {
-            telemetryClient.setAccessToken(creds.accessToken);
-            this.authMode = 'jwt';
-        }
-        // Preserve identity even when the token is expired.
-        if (creds?.userId) {
-            this.distinctId = creds.userId;
-        }
-        // Check for unclaimed environment — fall back to claim-token auth
-        // so unclaimed users' telemetry still reaches the backend.
-        try {
-            const env = getActiveEnvironment();
-            if (env && isUnclaimedEnvironment(env)) {
-                telemetryClient.setClaimTokenAuth(env.clientId, env.claimToken);
-                // Tag distinctId so unclaimed sessions are identifiable in analytics
-                this.distinctId = this.distinctId ?? `unclaimed:${env.clientId}`;
-                if (this.authMode === 'none')
-                    this.authMode = 'claim_token';
-            }
-            else if (env?.apiKey && this.authMode === 'none') {
-                telemetryClient.setApiKeyAuth(env.apiKey);
-                if (env.clientId)
-                    this.distinctId = this.distinctId ?? `env:${env.clientId}`;
-                this.authMode = 'api_key';
-            }
-        }
-        catch {
-            // Config-store failure is non-fatal for telemetry
-        }
-        // WORKOS_API_KEY covers API-key-only users. Lowest priority — JWT and
-        // claim-token auth have richer identity context when available.
-        if (this.authMode === 'none' && process.env.WORKOS_API_KEY) {
-            telemetryClient.setApiKeyAuth(process.env.WORKOS_API_KEY);
-            this.authMode = 'api_key';
-        }
-        return this.authMode;
-    }
-    /**
-     * Initialize telemetry for non-installer commands.
-     * Sets telemetry URL from default config and loads auth credentials.
-     */
-    initForNonInstaller() {
-        if (!this.isEnabled())
-            return;
-        telemetryClient.setGatewayUrl(getTelemetryUrl());
-        this.configureAuthFromAvailableSources();
-    }
-    setTag(key, value) {
-        this.tags[key] = value;
-    }
-    capture(eventName, properties) {
-        if (!this.isEnabled())
-            return;
-        debug(`[Analytics] capture: ${eventName}`, properties);
-        // Accumulate primitive values as tags for the session.end event
-        if (properties) {
-            for (const [key, value] of Object.entries(properties)) {
-                if (['string', 'number', 'boolean'].includes(typeof value)) {
-                    this.tags[key] = value;
-                }
-            }
-        }
-    }
-    captureException(error, properties = {}) {
-        if (!this.isEnabled())
-            return;
-        // Sanitize BEFORE logging — raw error.message can carry Bearer tokens /
-        // sk_ keys / JWTs on auth-failure paths, which would surface in stdout
-        // under WORKOS_DEBUG=1.
-        const { type, message } = this.extractErrorFields(error);
-        debug('[Analytics] captureException:', message, properties);
-        this.tags['error.type'] = type;
-        this.tags['error.message'] = message;
-    }
-    async getFeatureFlag(_flagKey) {
-        // Feature flags not implemented yet
-        return undefined;
-    }
-    /** All capture methods that record error details MUST go through this. */
-    extractErrorFields(error) {
-        return {
-            type: error.name,
-            message: sanitizeMessage(error.message),
-        };
-    }
-    detectCiProvider() {
-        if (process.env.GITHUB_ACTIONS)
-            return 'github-actions';
-        if (process.env.BUILDKITE)
-            return 'buildkite';
-        if (process.env.CIRCLECI)
-            return 'circleci';
-        if (process.env.GITLAB_CI)
-            return 'gitlab-ci';
-        if (process.env.JENKINS_URL)
-            return 'jenkins';
-        return undefined;
-    }
-    getEnvFingerprint() {
-        let osVersion;
-        try {
-            osVersion = os.release();
-        }
-        catch {
-            osVersion = 'unknown';
-        }
-        const ciProvider = this.detectCiProvider();
-        return {
-            'device.id': getDeviceId(),
-            'auth.mode': this.authMode,
-            'env.os': process.platform,
-            'env.os_version': osVersion,
-            'env.node_version': process.version,
-            'env.shell': basename(process.env.SHELL ?? process.env.COMSPEC ?? 'unknown'),
-            'env.ci': Boolean(process.env.CI || process.env.GITHUB_ACTIONS || process.env.BUILDKITE),
-            ...(ciProvider ? { 'env.ci_provider': ciProvider } : {}),
-        };
-    }
-    sessionStart(mode, version) {
-        if (!this.isEnabled())
-            return;
-        this.mode = mode;
-        const event = {
-            type: 'session.start',
-            sessionId: this.sessionId,
-            timestamp: this.sessionStartTime.toISOString(),
-            attributes: {
-                'installer.version': version,
-                'installer.mode': mode,
-                'workos.user_id': this.distinctId,
-                ...this.getEnvFingerprint(),
-            },
-        };
-        telemetryClient.queueEvent(event);
-    }
-    stepCompleted(name, durationMs, success, error) {
-        if (!this.isEnabled())
-            return;
-        const event = {
-            type: 'step',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            name,
-            startTimestamp: new Date(Date.now() - durationMs).toISOString(),
-            durationMs,
-            success,
-            error: error ? this.extractErrorFields(error) : undefined,
-        };
-        telemetryClient.queueEvent(event);
-    }
-    toolCalled(toolName, durationMs, success) {
-        if (!this.isEnabled())
-            return;
-        const event = {
-            type: 'agent.tool',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            toolName,
-            startTimestamp: new Date(Date.now() - durationMs).toISOString(),
-            durationMs,
-            success,
-        };
-        telemetryClient.queueEvent(event);
-    }
-    llmRequest(model, inputTokens, outputTokens) {
-        if (!this.isEnabled())
-            return;
-        this.totalInputTokens += inputTokens;
-        this.totalOutputTokens += outputTokens;
-        const event = {
-            type: 'agent.llm',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            model,
-            inputTokens,
-            outputTokens,
-        };
-        telemetryClient.queueEvent(event);
-    }
-    incrementAgentIterations() {
-        this.agentIterations++;
-    }
-    emitCommandEvent(name, durationMs, success, options) {
-        if (!this.isEnabled())
-            return;
-        const errorFields = options?.error ? this.extractErrorFields(options.error) : undefined;
-        const event = {
-            type: 'command',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            attributes: {
-                // Extras first: standard fields below win on key collision, so callers
-                // can never override command.name, error fields, or the fingerprint.
-                ...options?.extraAttributes,
-                'command.name': name,
-                'command.duration_ms': durationMs,
-                'command.success': success,
-                'cli.version': getVersion(),
-                ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),
-                ...(errorFields
-                    ? {
-                        'command.error_type': errorFields.type,
-                        'command.error_message': errorFields.message,
-                    }
-                    : {}),
-                ...(options?.flags?.length ? { 'command.flags': options.flags.join(',') } : {}),
-                ...(options?.reason ? { 'termination.reason': options.reason } : {}),
-                ...(options?.errorCode ? { 'error.code': options.errorCode } : {}),
-                ...(options?.apiContext?.status !== undefined ? { 'api.status': options.apiContext.status } : {}),
-                ...(options?.apiContext?.code ? { 'api.code': options.apiContext.code } : {}),
-                ...(options?.apiContext?.resource ? { 'api.resource': options.apiContext.resource } : {}),
-                ...this.getEnvFingerprint(),
-            },
-        };
-        telemetryClient.queueEvent(event);
-    }
-    captureUnhandledCrash(error, options) {
-        if (!this.isEnabled())
-            return;
-        const { type, message } = this.extractErrorFields(error);
-        const event = {
-            type: 'crash',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            attributes: {
-                'crash.error_type': type,
-                'crash.error_message': message,
-                'crash.stack': sanitizeStack(error.stack),
-                ...(options?.command ? { 'crash.command': options.command } : {}),
-                'cli.version': options?.version ?? getVersion(),
-                ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),
-                ...this.getEnvFingerprint(),
-            },
-        };
-        telemetryClient.queueEvent(event);
-    }
-    async shutdown(status) {
-        if (!this.isEnabled())
-            return;
-        const duration = Date.now() - this.sessionStartTime.getTime();
-        // Filter out null/undefined tags
-        const extraAttributes = Object.fromEntries(Object.entries(this.tags).filter(([, v]) => v != null));
-        const envFingerprint = this.getEnvFingerprint();
-        const event = {
-            type: 'session.end',
-            sessionId: this.sessionId,
-            timestamp: new Date().toISOString(),
-            attributes: {
-                'installer.outcome': status,
-                'installer.duration_ms': duration,
-                'installer.agent.iterations': this.agentIterations,
-                'installer.agent.tokens.input': this.totalInputTokens,
-                'installer.agent.tokens.output': this.totalOutputTokens,
-                ...envFingerprint,
-                ...(this.mode ? { 'installer.mode': this.mode } : {}),
-                ...extraAttributes,
-            },
-        };
-        telemetryClient.queueEvent(event);
-        await telemetryClient.flush();
-    }
-}
-export const analytics = new Analytics();
-//# sourceMappingURL=analytics.js.map

package/dist/utils/analytics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAaxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,OAAO,SAAS;IACZ,IAAI,GAAiE,EAAE,CAAC;IACxE,SAAS,CAAS;IAClB,gBAAgB,CAAO;IACvB,UAAU,CAAU;IACpB,IAAI,CAA8B;IAClC,QAAQ,GAAa,MAAM,CAAC;IAEpC,yBAAyB;IACjB,gBAAgB,GAAG,CAAC,CAAC;IACrB,iBAAiB,GAAG,CAAC,CAAC;IACtB,eAAe,GAAG,CAAC,CAAC;IAE5B;QACE,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjD,CAAC;IAED,aAAa,CAAC,UAAkB;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,iBAAiB,CAAC,QAAgB,EAAE,UAAkB;QACpD,eAAe,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,IAAc;QACxB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAEO,SAAS;QACf,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,iCAAiC;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAE5C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACvB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,KAAK,EAAE,WAAW,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,oDAAoD;QACpD,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;QACjC,CAAC;QAED,kEAAkE;QAClE,2DAA2D;QAC3D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChE,qEAAqE;gBACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,aAAa,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;oBAAE,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;YAC9D,CAAC;iBAAM,IAAI,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACnD,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,GAAG,CAAC,QAAQ;oBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7E,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QAED,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC3D,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,eAAe,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,GAAW,EAAE,KAAmD;QACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,SAAiB,EAAE,UAAoC;QAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,KAAK,CAAC,wBAAwB,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;QAEvD,gEAAgE;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAkC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,KAAY,EAAE,aAAsC,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,wEAAwE;QACxE,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzD,KAAK,CAAC,+BAA+B,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,oCAAoC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0EAA0E;IAClE,kBAAkB,CAAC,KAAY;QACrC,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;SACxC,CAAC;IACJ,CAAC;IAEO,gBAAgB;QACtB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,gBAAgB,CAAC;QACxD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB;QACvB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3C,OAAO;YACL,WAAW,EAAE,WAAW,EAAE;YAC1B,WAAW,EAAE,IAAI,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,SAAS;YAC3B,kBAAkB,EAAE,OAAO,CAAC,OAAO;YACnC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;YAC5E,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YACxF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAgC,EAAE,OAAe;QAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAEjB,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE;YAC9C,UAAU,EAAE;gBACV,mBAAmB,EAAE,OAAO;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI,CAAC,UAAU;gBACjC,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,UAAkB,EAAE,OAAgB,EAAE,KAAa;QAC7E,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI;YACJ,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YAC/D,UAAU;YACV,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,UAAkB,EAAE,OAAgB;QAC/D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,KAAK,GAAmB;YAC5B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ;YACR,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YAC/D,UAAU;YACV,OAAO;SACR,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,YAAoB;QACjE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC;QACrC,IAAI,CAAC,iBAAiB,IAAI,YAAY,CAAC;QAEvC,MAAM,KAAK,GAAkB;YAC3B,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,WAAW;YACX,YAAY;SACb,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,wBAAwB;QACtB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,gBAAgB,CACd,IAAY,EACZ,UAAkB,EAClB,OAAgB,EAChB,OAOC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExF,MAAM,KAAK,GAAiB;YAC1B,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,uEAAuE;gBACvE,qEAAqE;gBACrE,GAAG,OAAO,EAAE,eAAe;gBAC3B,cAAc,EAAE,IAAI;gBACpB,qBAAqB,EAAE,UAAU;gBACjC,iBAAiB,EAAE,OAAO;gBAC1B,aAAa,EAAE,UAAU,EAAE;gBAC3B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,WAAW;oBACb,CAAC,CAAC;wBACE,oBAAoB,EAAE,WAAW,CAAC,IAAI;wBACtC,uBAAuB,EAAE,WAAW,CAAC,OAAO;qBAC7C;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjG,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,qBAAqB,CAAC,KAAY,EAAE,OAAgD;QAClF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAe;YACxB,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,kBAAkB,EAAE,IAAI;gBACxB,qBAAqB,EAAE,OAAO;gBAC9B,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;gBACzC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,aAAa,EAAE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,IAAI,CAAC,iBAAiB,EAAE;aAC5B;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAyC;QACtD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE9D,iCAAiC;QACjC,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAGhG,CAAC;QAEF,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,KAAK,GAAoB;YAC7B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE;gBACV,mBAAmB,EAAE,MAAM;gBAC3B,uBAAuB,EAAE,QAAQ;gBACjC,4BAA4B,EAAE,IAAI,CAAC,eAAe;gBAClD,8BAA8B,EAAE,IAAI,CAAC,gBAAgB;gBACrD,+BAA+B,EAAE,IAAI,CAAC,iBAAiB;gBACvD,GAAG,cAAc;gBACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,eAAe;aACnB;SACF,CAAC;QAEF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC","sourcesContent":["import os from 'node:os';\nimport { basename } from 'node:path';\nimport { v4 as uuidv4 } from 'uuid';\nimport { debug } from './debug.js';\nimport { telemetryClient } from './telemetry-client.js';\nimport type {\n  AuthMode,\n  SessionStartEvent,\n  SessionEndEvent,\n  StepEvent,\n  AgentToolEvent,\n  AgentLLMEvent,\n  CommandEvent,\n  CrashEvent,\n  TerminationReason,\n  EnvFingerprint,\n} from './telemetry-types.js';\nimport { isTelemetryEnabled } from '../lib/preferences.js';\nimport { getVersion } from '../lib/settings.js';\nimport { getTelemetryUrl } from './urls.js';\nimport { getCredentials, isTokenExpired } from '../lib/credentials.js';\nimport { getActiveEnvironment, isUnclaimedEnvironment } from '../lib/config-store.js';\nimport { getDeviceId } from '../lib/device-id.js';\nimport { sanitizeMessage, sanitizeStack } from './crash-reporter.js';\n\nexport class Analytics {\n  private tags: Record<string, string | boolean | number | null | undefined> = {};\n  private sessionId: string;\n  private sessionStartTime: Date;\n  private distinctId?: string;\n  private mode?: 'cli' | 'tui' | 'headless';\n  private authMode: AuthMode = 'none';\n\n  // Agent metrics tracking\n  private totalInputTokens = 0;\n  private totalOutputTokens = 0;\n  private agentIterations = 0;\n\n  constructor() {\n    this.sessionId = uuidv4();\n    this.sessionStartTime = new Date();\n    this.tags = { $app_name: 'authkit-installer' };\n  }\n\n  setDistinctId(distinctId: string) {\n    this.distinctId = distinctId;\n  }\n\n  setAccessToken(token: string) {\n    telemetryClient.setAccessToken(token);\n  }\n\n  setApiKeyAuth(apiKey: string) {\n    telemetryClient.setApiKeyAuth(apiKey);\n  }\n\n  setClaimTokenAuth(clientId: string, claimToken: string) {\n    telemetryClient.setClaimTokenAuth(clientId, claimToken);\n  }\n\n  /**\n   * Set the auth mode explicitly for special cases. Normal CLI flows should use\n   * `configureAuthFromAvailableSources()` so transport and auth.mode stay aligned.\n   */\n  setAuthMode(mode: AuthMode) {\n    this.authMode = mode;\n  }\n\n  setGatewayUrl(url: string) {\n    telemetryClient.setGatewayUrl(url);\n  }\n\n  private isEnabled(): boolean {\n    return isTelemetryEnabled();\n  }\n\n  /**\n   * Configure telemetry transport and auth.mode from all available CLI auth\n   * sources. Priority: stored JWT, unclaimed-environment claim token, active\n   * environment API key, then WORKOS_API_KEY.\n   */\n  configureAuthFromAvailableSources(): AuthMode {\n    if (!this.isEnabled()) return this.authMode;\n\n    this.authMode = 'none';\n    const creds = getCredentials();\n    // Only treat the JWT as usable auth when it is still valid. An expired\n    // access token would 401 against the telemetry guard and the event would\n    // be dropped, so fall through to claim-token / api-key auth instead.\n    if (creds?.accessToken && !isTokenExpired(creds)) {\n      telemetryClient.setAccessToken(creds.accessToken);\n      this.authMode = 'jwt';\n    }\n    // Preserve identity even when the token is expired.\n    if (creds?.userId) {\n      this.distinctId = creds.userId;\n    }\n\n    // Check for unclaimed environment — fall back to claim-token auth\n    // so unclaimed users' telemetry still reaches the backend.\n    try {\n      const env = getActiveEnvironment();\n      if (env && isUnclaimedEnvironment(env)) {\n        telemetryClient.setClaimTokenAuth(env.clientId, env.claimToken);\n        // Tag distinctId so unclaimed sessions are identifiable in analytics\n        this.distinctId = this.distinctId ?? `unclaimed:${env.clientId}`;\n        if (this.authMode === 'none') this.authMode = 'claim_token';\n      } else if (env?.apiKey && this.authMode === 'none') {\n        telemetryClient.setApiKeyAuth(env.apiKey);\n        if (env.clientId) this.distinctId = this.distinctId ?? `env:${env.clientId}`;\n        this.authMode = 'api_key';\n      }\n    } catch {\n      // Config-store failure is non-fatal for telemetry\n    }\n\n    // WORKOS_API_KEY covers API-key-only users. Lowest priority — JWT and\n    // claim-token auth have richer identity context when available.\n    if (this.authMode === 'none' && process.env.WORKOS_API_KEY) {\n      telemetryClient.setApiKeyAuth(process.env.WORKOS_API_KEY);\n      this.authMode = 'api_key';\n    }\n\n    return this.authMode;\n  }\n\n  /**\n   * Initialize telemetry for non-installer commands.\n   * Sets telemetry URL from default config and loads auth credentials.\n   */\n  initForNonInstaller(): void {\n    if (!this.isEnabled()) return;\n\n    telemetryClient.setGatewayUrl(getTelemetryUrl());\n    this.configureAuthFromAvailableSources();\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    if (!this.isEnabled()) return;\n\n    debug(`[Analytics] capture: ${eventName}`, properties);\n\n    // Accumulate primitive values as tags for the session.end event\n    if (properties) {\n      for (const [key, value] of Object.entries(properties)) {\n        if (['string', 'number', 'boolean'].includes(typeof value)) {\n          this.tags[key] = value as string | number | boolean;\n        }\n      }\n    }\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    if (!this.isEnabled()) return;\n\n    // Sanitize BEFORE logging — raw error.message can carry Bearer tokens /\n    // sk_ keys / JWTs on auth-failure paths, which would surface in stdout\n    // under WORKOS_DEBUG=1.\n    const { type, message } = this.extractErrorFields(error);\n    debug('[Analytics] captureException:', message, properties);\n    this.tags['error.type'] = type;\n    this.tags['error.message'] = message;\n  }\n\n  async getFeatureFlag(_flagKey: string): Promise<string | boolean | undefined> {\n    // Feature flags not implemented yet\n    return undefined;\n  }\n\n  /** All capture methods that record error details MUST go through this. */\n  private extractErrorFields(error: Error): { type: string; message: string } {\n    return {\n      type: error.name,\n      message: sanitizeMessage(error.message),\n    };\n  }\n\n  private detectCiProvider(): string | undefined {\n    if (process.env.GITHUB_ACTIONS) return 'github-actions';\n    if (process.env.BUILDKITE) return 'buildkite';\n    if (process.env.CIRCLECI) return 'circleci';\n    if (process.env.GITLAB_CI) return 'gitlab-ci';\n    if (process.env.JENKINS_URL) return 'jenkins';\n    return undefined;\n  }\n\n  private getEnvFingerprint(): EnvFingerprint {\n    let osVersion: string;\n    try {\n      osVersion = os.release();\n    } catch {\n      osVersion = 'unknown';\n    }\n\n    const ciProvider = this.detectCiProvider();\n\n    return {\n      'device.id': getDeviceId(),\n      'auth.mode': this.authMode,\n      'env.os': process.platform,\n      'env.os_version': osVersion,\n      'env.node_version': process.version,\n      'env.shell': basename(process.env.SHELL ?? process.env.COMSPEC ?? 'unknown'),\n      'env.ci': Boolean(process.env.CI || process.env.GITHUB_ACTIONS || process.env.BUILDKITE),\n      ...(ciProvider ? { 'env.ci_provider': ciProvider } : {}),\n    };\n  }\n\n  sessionStart(mode: 'cli' | 'tui' | 'headless', version: string) {\n    if (!this.isEnabled()) return;\n\n    this.mode = mode;\n\n    const event: SessionStartEvent = {\n      type: 'session.start',\n      sessionId: this.sessionId,\n      timestamp: this.sessionStartTime.toISOString(),\n      attributes: {\n        'installer.version': version,\n        'installer.mode': mode,\n        'workos.user_id': this.distinctId,\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  stepCompleted(name: string, durationMs: number, success: boolean, error?: Error) {\n    if (!this.isEnabled()) return;\n\n    const event: StepEvent = {\n      type: 'step',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      name,\n      startTimestamp: new Date(Date.now() - durationMs).toISOString(),\n      durationMs,\n      success,\n      error: error ? this.extractErrorFields(error) : undefined,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  toolCalled(toolName: string, durationMs: number, success: boolean) {\n    if (!this.isEnabled()) return;\n\n    const event: AgentToolEvent = {\n      type: 'agent.tool',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      toolName,\n      startTimestamp: new Date(Date.now() - durationMs).toISOString(),\n      durationMs,\n      success,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  llmRequest(model: string, inputTokens: number, outputTokens: number) {\n    if (!this.isEnabled()) return;\n\n    this.totalInputTokens += inputTokens;\n    this.totalOutputTokens += outputTokens;\n\n    const event: AgentLLMEvent = {\n      type: 'agent.llm',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      model,\n      inputTokens,\n      outputTokens,\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  incrementAgentIterations() {\n    this.agentIterations++;\n  }\n\n  emitCommandEvent(\n    name: string,\n    durationMs: number,\n    success: boolean,\n    options?: {\n      error?: Error;\n      flags?: string[];\n      reason?: TerminationReason;\n      errorCode?: string;\n      apiContext?: { status?: number; code?: string; resource?: string };\n      extraAttributes?: Record<string, string | number | boolean>;\n    },\n  ) {\n    if (!this.isEnabled()) return;\n\n    const errorFields = options?.error ? this.extractErrorFields(options.error) : undefined;\n\n    const event: CommandEvent = {\n      type: 'command',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        // Extras first: standard fields below win on key collision, so callers\n        // can never override command.name, error fields, or the fingerprint.\n        ...options?.extraAttributes,\n        'command.name': name,\n        'command.duration_ms': durationMs,\n        'command.success': success,\n        'cli.version': getVersion(),\n        ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),\n        ...(errorFields\n          ? {\n              'command.error_type': errorFields.type,\n              'command.error_message': errorFields.message,\n            }\n          : {}),\n        ...(options?.flags?.length ? { 'command.flags': options.flags.join(',') } : {}),\n        ...(options?.reason ? { 'termination.reason': options.reason } : {}),\n        ...(options?.errorCode ? { 'error.code': options.errorCode } : {}),\n        ...(options?.apiContext?.status !== undefined ? { 'api.status': options.apiContext.status } : {}),\n        ...(options?.apiContext?.code ? { 'api.code': options.apiContext.code } : {}),\n        ...(options?.apiContext?.resource ? { 'api.resource': options.apiContext.resource } : {}),\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  captureUnhandledCrash(error: Error, options?: { command?: string; version?: string }) {\n    if (!this.isEnabled()) return;\n\n    const { type, message } = this.extractErrorFields(error);\n\n    const event: CrashEvent = {\n      type: 'crash',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        'crash.error_type': type,\n        'crash.error_message': message,\n        'crash.stack': sanitizeStack(error.stack),\n        ...(options?.command ? { 'crash.command': options.command } : {}),\n        'cli.version': options?.version ?? getVersion(),\n        ...(this.distinctId ? { 'workos.user_id': this.distinctId } : {}),\n        ...this.getEnvFingerprint(),\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (!this.isEnabled()) return;\n\n    const duration = Date.now() - this.sessionStartTime.getTime();\n\n    // Filter out null/undefined tags\n    const extraAttributes = Object.fromEntries(Object.entries(this.tags).filter(([, v]) => v != null)) as Record<\n      string,\n      string | number | boolean\n    >;\n\n    const envFingerprint = this.getEnvFingerprint();\n\n    const event: SessionEndEvent = {\n      type: 'session.end',\n      sessionId: this.sessionId,\n      timestamp: new Date().toISOString(),\n      attributes: {\n        'installer.outcome': status,\n        'installer.duration_ms': duration,\n        'installer.agent.iterations': this.agentIterations,\n        'installer.agent.tokens.input': this.totalInputTokens,\n        'installer.agent.tokens.output': this.totalOutputTokens,\n        ...envFingerprint,\n        ...(this.mode ? { 'installer.mode': this.mode } : {}),\n        ...extraAttributes,\n      },\n    };\n\n    telemetryClient.queueEvent(event);\n    await telemetryClient.flush();\n  }\n}\n\nexport const analytics = new Analytics();\n"]}

package/dist/utils/bash.d.ts

@@ -1,2 +0,0 @@
-export declare function executeSync(command: string): string;
-export declare function execute(command: string): Promise<string>;

package/dist/utils/bash.js

@@ -1,17 +0,0 @@
-import * as child_process from 'child_process';
-export function executeSync(command) {
-    const output = child_process.execSync(command);
-    return output.toString();
-}
-export function execute(command) {
-    return new Promise((resolve, reject) => {
-        child_process.exec(command, (error, stdout, _) => {
-            if (error) {
-                reject(error);
-                return;
-            }
-            resolve(stdout);
-        });
-    });
-}
-//# sourceMappingURL=bash.js.map

package/dist/utils/bash.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bash.js","sourceRoot":"","sources":["../../src/utils/bash.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,eAAe,CAAC;AAE/C,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;YAC/C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import * as child_process from 'child_process';\n\nexport function executeSync(command: string): string {\n  const output = child_process.execSync(command);\n  return output.toString();\n}\n\nexport function execute(command: string): Promise<string> {\n  return new Promise((resolve, reject) => {\n    child_process.exec(command, (error, stdout, _) => {\n      if (error) {\n        reject(error);\n        return;\n      }\n\n      resolve(stdout);\n    });\n  });\n}\n"]}

package/dist/utils/box.d.ts

@@ -1,9 +0,0 @@
-/**
- * Flat, gutterless notice to stderr — the de-boxed startup/notice output.
- *
- * Callers pass already-styled lines; this indents them two spaces and frames
- * them with a single blank line above and below so the notice reads as its own
- * beat without a border. This is the only notice primitive: the CLI no longer
- * draws bordered boxes for startup notices (telemetry, unclaimed env, provision).
- */
-export declare function renderStderrNotice(...lines: string[]): void;

package/dist/utils/box.js

@@ -1,15 +0,0 @@
-/**
- * Flat, gutterless notice to stderr — the de-boxed startup/notice output.
- *
- * Callers pass already-styled lines; this indents them two spaces and frames
- * them with a single blank line above and below so the notice reads as its own
- * beat without a border. This is the only notice primitive: the CLI no longer
- * draws bordered boxes for startup notices (telemetry, unclaimed env, provision).
- */
-export function renderStderrNotice(...lines) {
-    console.error('');
-    for (const ln of lines)
-        console.error(`  ${ln}`);
-    console.error('');
-}
-//# sourceMappingURL=box.js.map

package/dist/utils/box.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"box.js","sourceRoot":"","sources":["../../src/utils/box.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAG,KAAe;IACnD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC","sourcesContent":["/**\n * Flat, gutterless notice to stderr — the de-boxed startup/notice output.\n *\n * Callers pass already-styled lines; this indents them two spaces and frames\n * them with a single blank line above and below so the notice reads as its own\n * beat without a border. This is the only notice primitive: the CLI no longer\n * draws bordered boxes for startup notices (telemetry, unclaimed env, provision).\n */\nexport function renderStderrNotice(...lines: string[]): void {\n  console.error('');\n  for (const ln of lines) console.error(`  ${ln}`);\n  console.error('');\n}\n"]}

package/dist/utils/cli-exit.d.ts

@@ -1,15 +0,0 @@
-import type { TerminationReason } from './telemetry-types.js';
-export interface CliExitContext {
-    reason: TerminationReason;
-    errorCode?: string;
-    apiContext?: {
-        status?: number;
-        code?: string;
-        resource?: string;
-    };
-}
-export declare class CliExit extends Error {
-    readonly exitCode: number;
-    readonly context?: CliExitContext | undefined;
-    constructor(exitCode: number, context?: CliExitContext | undefined);
-}

package/dist/utils/cli-exit.js

@@ -1,11 +0,0 @@
-export class CliExit extends Error {
-    exitCode;
-    context;
-    constructor(exitCode, context) {
-        super(`CLI exit: code ${exitCode}`);
-        this.exitCode = exitCode;
-        this.context = context;
-        this.name = 'CliExit';
-    }
-}
-//# sourceMappingURL=cli-exit.js.map

package/dist/utils/cli-exit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-exit.js","sourceRoot":"","sources":["../../src/utils/cli-exit.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,OAAQ,SAAQ,KAAK;IAErB;IACA;IAFX,YACW,QAAgB,EAChB,OAAwB;QAEjC,KAAK,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QAH3B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,YAAO,GAAP,OAAO,CAAiB;QAGjC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;CACF","sourcesContent":["import type { TerminationReason } from './telemetry-types.js';\n\nexport interface CliExitContext {\n  reason: TerminationReason;\n  errorCode?: string;\n  apiContext?: { status?: number; code?: string; resource?: string };\n}\n\nexport class CliExit extends Error {\n  constructor(\n    readonly exitCode: number,\n    readonly context?: CliExitContext,\n  ) {\n    super(`CLI exit: code ${exitCode}`);\n    this.name = 'CliExit';\n  }\n}\n"]}

package/dist/utils/cli-symbols.d.ts

@@ -1,44 +0,0 @@
-export declare const symbols: {
-    readonly success: "✓" | "+";
-    readonly error: "✗" | "x";
-    readonly warning: "!";
-    readonly info: "ℹ" | "i";
-    readonly arrow: "→" | "->";
-    readonly bullet: "•" | "*";
-    readonly progressFilled: "▓" | "#";
-    readonly progressEmpty: "-" | "░";
-};
-/**
- * WorkOS brand palette (hex). Single source shared by the `ui` facade and the
- * install summary box so the flat CLI output and the summary render identical
- * brand colors. chalk auto-disables color when `chalk.level === 0` (JSON mode).
- */
-export declare const palette: {
-    readonly accent: import("chalk").ChalkInstance;
-    readonly green: import("chalk").ChalkInstance;
-    readonly red: import("chalk").ChalkInstance;
-    readonly yellow: import("chalk").ChalkInstance;
-    readonly cyan: import("chalk").ChalkInstance;
-};
-/**
- * Pre-styled output functions for consistent CLI formatting.
- * Uses chalk for coloring with appropriate symbols.
- */
-export declare const styled: {
-    /** Green checkmark with message */
-    readonly success: (text: string) => string;
-    /** Red X with message */
-    readonly error: (text: string) => string;
-    /** Yellow warning with message */
-    readonly warning: (text: string) => string;
-    /** Dim info text */
-    readonly info: (text: string) => string;
-    /** Cyan arrow for actions */
-    readonly action: (text: string) => string;
-    /** Label with value, label is dimmed */
-    readonly label: (label: string, value: string) => string;
-    /** Phase indicator with visual progress bar */
-    readonly phase: (num: number, total: number, name: string) => string;
-    /** Bullet point for lists */
-    readonly bullet: (text: string) => string;
-};