@allstak/wizard 0.1.6 → 0.1.8

package/docs/beta/next.md

@@ -1,76 +0,0 @@
-# Next.js
-
-**Stability:** stable. Runtime fail-open behavior and disposable live-backend
-certification have passed for supported Next.js paths. Edge Runtime and Server
-Actions are not certified.
-
-## What you get
-
-- `@allstak/next` + `@allstak/js` installed.
-- `.env.local` populated with **both** `ALLSTAK_API_KEY` and `ALLSTAK_DSN`
-  (`ALLSTAK_DSN` is still written during the env-var transition).
-- `instrumentation.ts` created at the project root if missing, otherwise a
-  managed-block hint appended to the existing one. The wizard does NOT
-  modify the body of an existing `register()` function.
-- `next.config.{js,mjs,ts}` gains a managed-block hint reminding you to
-  wrap with `withAllStak` and enable `productionBrowserSourceMaps: true`.
-
-## Run
-
-```bash
-npx @allstak/wizard@beta -i next
-```
-
-## Compatibility
-
-- `next >= 13`. Both app router and pages router supported.
-- Older Next versions refused with `E_UNSUPPORTED_VERSION`.
-
-## Wiring `register()`
-
-Wizard creates this if `instrumentation.ts` did not exist:
-
-```ts
-import { initAllStakNext } from '@allstak/next';
-
-export function register() {
-  initAllStakNext({
-    dsn: process.env.ALLSTAK_DSN,
-    endpoint: process.env.ALLSTAK_HOST ?? 'https://api.allstak.sa',
-    release: process.env.ALLSTAK_RELEASE,
-    environment: process.env.ALLSTAK_ENVIRONMENT ?? 'production',
-  });
-}
-```
-
-If you already have `register()`, copy the body of `initAllStakNext({ ... })`
-into it.
-
-## Source maps
-
-Wrap `next.config.*` with `withAllStak`:
-
-```js
-const { withAllStak } = require('@allstak/js/next');
-module.exports = withAllStak({
-  ...nextConfig,
-  productionBrowserSourceMaps: true,
-});
-```
-
-The wizard does NOT auto-mutate `next.config.*` for you — Next configs use
-many factory shapes (`module.exports = (phase, { defaultConfig }) => …`) and
-auto-mutation has too high a blast-radius. Follow the managed-block hint.
-
-## Known limitations
-
-- Live `doctor --live-probe` works for Next-emitted events only when your
-  Next app runs in a place the wizard can reach. (No magic — the SDK posts
-  to `/ingest/v1/errors` and the wizard polls `/api/v1/errors`.)
-- Edge Runtime and Server Actions are not certified.
-
-## Verify
-
-```bash
-npx @allstak/wizard@beta doctor -i next
-```

package/docs/beta/node.md

@@ -1,60 +0,0 @@
-# Vanilla Node.js (`@allstak/js`)
-
-**Stability:** `stable`. Validated against fixture and dogfooded.
-
-## What you get
-
-- `@allstak/js` SDK installed.
-- `.env` populated with the standard `ALLSTAK_*` vars.
-- AST-injected `import { AllStak } from '@allstak/js'` in your entry file.
-- Managed-block call to `AllStak.init({...})` appended to the entry.
-
-## Run
-
-```bash
-npx @allstak/wizard@beta -i js
-```
-
-## Entry detection
-
-The wizard looks at `package.json:scripts.start` for a `node X.js` pattern,
-then falls back to:
-
-- `src/index.ts` / `src/index.js`
-- `index.ts` / `index.js`
-- `app.ts` / `app.js`
-- `server.ts` / `server.js`
-
-If none match, the wizard skips entry patching and reports
-`config-only run` — env vars are still written; you need to call
-`AllStak.init(...)` manually.
-
-## What the patched entry looks like
-
-After `init`, the bottom of your entry file gains:
-
-```js
-// >>> allstak-wizard:v1 (do not edit) >>>
-AllStak.init({
-  apiKey: process.env.ALLSTAK_API_KEY,
-  host: process.env.ALLSTAK_HOST ?? 'https://api.allstak.sa',
-  environment: process.env.ALLSTAK_ENVIRONMENT ?? 'production',
-  release: process.env.ALLSTAK_RELEASE,
-});
-// <<< allstak-wizard:v1 <<<
-```
-
-Re-running the wizard replaces this block in place. `uninstall` removes it.
-
-## Compatibility
-
-- Node 18+ required by the wizard itself.
-- The `@allstak/js` SDK supports Node 16+.
-- Works with TypeScript entries via `tsx`/`bun`/`deno run` toolchains.
-
-## What this integration does NOT do
-
-- No bundler-level source-map wiring — Node is interpreted, not bundled.
-- No express/fastify/hono middleware registration — those are framework-
-  specific and live in their own integrations (`fastify` is `experimental`
-  for now; nest/express integrations are deferred).

package/docs/beta/privacy.md

@@ -1,99 +0,0 @@
-# Privacy & telemetry
-
-The wizard ships a minimal anonymous-usage telemetry channel. This page
-documents **exactly** what is sent and how to disable it.
-
-## What we send
-
-| Field | Example | Why |
-|-------|---------|-----|
-| `schemaVersion` | `1` | Stable version of this payload shape. |
-| `installId` | `b9c4...` | Anonymous v4 UUID stored at `~/.config/allstak/install-id`. Coalesces events for the same install. Rotate by deleting the file. |
-| `wizardVersion` | `0.1.3` | The wizard's own version. |
-| `command` | `init`, `doctor`, `restore-apply`, … | Which wizard command ran. |
-| `integration` | `react`, `next`, `js`, `null` | Selected integration (`null` for commands that don't have one — `login`, `restore-list`, etc.). |
-| `stability` | `stable`, `beta`, `experimental`, `unsupported`, `null` | Stability level of the active integration. |
-| `os.family` | `darwin`, `linux`, `win32` | Node's `process.platform`. |
-| `os.majorRelease` | `23`, `5`, `10` | Major version of the OS kernel. |
-| `os.arch` | `x64`, `arm64` | Process architecture. |
-| `node.major` | `20`, `22` | Major Node version. |
-| `packageManager` | `npm`, `pnpm`, `yarn`, `yarn-berry`, `bun`, `null` | Detected package manager. |
-| `outcome` | `success`, `failure`, `cancelled`, `noop` | Final state. |
-| `stage` | `auth`, `patch`, `restore`, … | Stage at termination. |
-| `errorCode` | `E_PATCH_FAILED`, `null` | Canonical error code; never message text. |
-| `rollbackTriggered` | `true`/`false` | Did an in-process rollback fire? |
-| `durationMs` | `4231` | Wall-clock duration. |
-
-That's the entire payload. There are no opaque "metadata" or "extras"
-fields.
-
-## What we NEVER send
-
-The TypeScript type in `src/telemetry/payload.ts` is the contract. The
-wizard CANNOT send any of the following — there is no field for them:
-
-- API keys, DSNs, OAuth tokens, refresh tokens.
-- Org names, project names, project ids, org ids.
-- File paths (absolute or relative).
-- `process.env` values.
-- Source code from your repo.
-- Error message text or stack frames.
-- Email addresses, IP addresses, hostnames.
-
-The error code `E_PATCH_FAILED` reaches us; the patcher's stack trace and
-the file path it failed on do not.
-
-## How to disable
-
-Three independent ways, any one of them is sufficient:
-
-```bash
-# Per-run flag:
-npx @allstak/wizard@beta --no-telemetry ...
-
-# Process env:
-ALLSTAK_WIZARD_TELEMETRY=0 npx @allstak/wizard@beta ...
-
-# Globally for your shell:
-export ALLSTAK_WIZARD_TELEMETRY=0
-```
-
-Disabling does NOT disable the wizard's local audit trail (snapshots in
-`.allstak-wizard/backups/`). Those are local-only and never sent anywhere.
-
-## How to inspect what would be sent
-
-```bash
-npx @allstak/wizard@beta --telemetry-debug -i react --dry-run
-```
-
-`--telemetry-debug` prints the would-be payload to stderr instead of
-sending it, regardless of the gate state.
-
-## Where the data goes
-
-- **Default provider** is `noop` — the wizard does NOT phone home in beta.
-  `noopTelemetry` is selected unless an operator (or you) explicitly wires
-  in `httpTelemetry({ endpoint })`. This is a deliberate beta-period
-  posture: build the abstraction, don't quietly start collecting.
-- When configured: HTTPS POST of the JSON payload with a 1.5s timeout,
-  failures swallowed.
-
-## Credentials
-
-`allstak login` stores your JWT pair in your OS keychain (macOS / libsecret)
-or an AES-256-GCM encrypted file fallback. Never sent to telemetry. See
-`src/credentials/` for the implementation.
-
-## Anonymous install id
-
-Stored at `~/.config/allstak/install-id` (or the platform equivalent).
-Generated lazily on first telemetry-emitting run. Delete the file to
-rotate. Telemetry-disabled runs do NOT generate or read it.
-
-## Audit
-
-The complete payload type is at `src/telemetry/payload.ts`. The unit-test
-suite asserts that the runtime payload contains EXACTLY the documented
-fields (no more, no fewer) — adding a field requires updating both the
-type and this doc, and the test fails until you do.

package/docs/beta/quickstart.md

@@ -1,89 +0,0 @@
-# Quickstart — `@allstak/wizard@beta`
-
-> Status: **public beta**. The wizard is honest about what works and what
-> doesn't — see [known limitations](./known-limitations.md) for the gaps you
-> need to know about before adopting.
-
-## Install + run in one command
-
-```bash
-# React (Vite or CRA)
-npx @allstak/wizard@beta -i react
-
-# Next.js (app or pages router; 13+)
-npx @allstak/wizard@beta -i next
-
-# Vanilla Node
-npx @allstak/wizard@beta -i js
-```
-
-The wizard auto-detects your framework if you omit `-i`.
-
-## Five-minute first run
-
-```bash
-# 1. Authenticate against AllStak (email OTP).
-npx @allstak/wizard@beta login
-
-# 2. List your orgs and projects.
-npx @allstak/wizard@beta orgs list
-npx @allstak/wizard@beta projects list
-
-# 3. Create a project + mint an API key in one go.
-npx @allstak/wizard@beta projects create \
-  --name "My App" --slug my-app \
-  --with-api-key
-
-# 4. Run the wizard against your project.
-cd /path/to/my/app
-npx @allstak/wizard@beta            # auto-detect
-# or:
-npx @allstak/wizard@beta -i next
-
-# 5. Verify the setup with a real test event.
-npx @allstak/wizard@beta doctor --live-probe \
-  --api-key ask_live_... \
-  --project-id <project-uuid>
-```
-
-## What the wizard does (in order)
-
-1. Detects your framework + package manager.
-2. Loads `allstak.config.*` if present.
-3. Verifies framework version compatibility.
-4. **Asks for confirmation** before any disk write (skip with `-y`).
-5. Installs the right `@allstak/*` package via your package manager.
-6. Writes env vars to `.env.local` / `.env` — never overwrites your values.
-7. Patches your entry file (AST-injects the import; appends a managed-block
-   hint).
-8. Wires the source-map plugin into `vite.config.*` / `next.config.*`.
-9. Snapshots every touched file to `.allstak-wizard/backups/<id>/`.
-10. Runs a doctor pass and reports the result.
-
-## Always reversible
-
-```bash
-# Roll back the latest snapshot.
-npx @allstak/wizard@beta restore apply latest
-
-# Or fully uninstall.
-npx @allstak/wizard@beta uninstall -i react
-```
-
-## Dry-run before committing
-
-```bash
-npx @allstak/wizard@beta -i react --dry-run --json | jq '.diff'
-```
-
-The dry-run never touches disk.
-
-## Next reads
-
-- [`react.md`](./react.md), [`next.md`](./next.md), [`node.md`](./node.md) — per-integration guides.
-- [`config.md`](./config.md) — `allstak.config.ts` precedence + migrations.
-- [`doctor.md`](./doctor.md) — diagnosing a setup.
-- [`restore.md`](./restore.md) — restoring snapshots.
-- [`privacy.md`](./privacy.md) — telemetry contract.
-- [`troubleshooting.md`](./troubleshooting.md) — common errors and fixes.
-- [`known-limitations.md`](./known-limitations.md) — what's NOT supported in beta.

package/docs/beta/react.md

@@ -1,91 +0,0 @@
-# React (Vite or CRA)
-
-**Stability:** `stable`. Validated end-to-end against fixture and dogfooded
-against AllStak `admin-web` and `web` packages.
-
-## What you get
-
-- `@allstak/react` SDK installed via your package manager.
-- `.env.local` (Vite) or `.env` (CRA) populated with `ALLSTAK_API_KEY`,
-  `ALLSTAK_HOST`, `ALLSTAK_ENVIRONMENT`, and (if configured) `ALLSTAK_RELEASE`.
-- `AllStakProvider` import added to your entry file via AST mutation.
-- Root render tree wrapped with a guarded `AllStakRoot` component when the
-  wizard recognizes a standard `createRoot(...).render(...)` entry.
-- For Vite projects: `@allstak/react/vite` source-map helper is added to `vite.config.*`.
-
-## Run
-
-```bash
-# Auto-detect:
-npx @allstak/wizard@beta
-
-# Explicit:
-npx @allstak/wizard@beta -i react
-
-# Non-interactive (CI):
-npx @allstak/wizard@beta -i react -y --api-key $ALLSTAK_API_KEY \
-  --org $ORG --project $PROJECT --release $GIT_SHA
-```
-
-## Compatibility
-
-- `react >= 16.8`. Older React versions are refused with `E_UNSUPPORTED_VERSION`.
-- Works with Vite 4+ and Create React App. Webpack-only setups get a
-  managed-block hint instead of AST mutation (Webpack configs vary too much
-  for safe AST patching in v0.1).
-
-## Wiring the provider
-
-For standard Vite/CRA entry files, the wizard rewrites the root render tree:
-
-```tsx
-import type { ReactNode } from 'react';
-import { AllStakProvider } from '@allstak/react';
-
-function AllStakRoot({ children }: { children: ReactNode }) {
-  const apiKey = import.meta.env.VITE_ALLSTAK_API_KEY;
-  if (!apiKey) return <>{children}</>;
-  return (
-    <AllStakProvider apiKey={apiKey} environment="production">
-      {children}
-    </AllStakProvider>
-  );
-}
-
-ReactDOM.createRoot(document.getElementById('root')!).render(
-  <AllStakRoot>
-    <App />
-  </AllStakRoot>,
-);
-```
-
-If the wizard cannot safely identify the render call, it leaves a manual-review
-hint instead of risking a broken app.
-
-## Verify
-
-```bash
-npx @allstak/wizard@beta doctor -i react
-```
-
-For an end-to-end ingestion check:
-
-```bash
-npx @allstak/wizard@beta doctor -i react --live-probe \
-  --api-key ask_live_... \
-  --project-id <project-uuid>
-```
-
-## Idempotent
-
-Re-running `init` is idempotent. The wizard detects existing
-`AllStakProvider`/`AllStakRoot` setup and does not double-wrap the tree.
-
-## Uninstall
-
-```bash
-npx @allstak/wizard@beta uninstall -i react
-```
-
-Removes the `@allstak/react` dependency, strips the AST import,
-deletes the managed env block, and unwires the Vite plugin.

package/docs/beta/reliability.md

@@ -1,33 +0,0 @@
-# SDK Reliability and Fail-Open Behavior
-
-AllStak SDKs must be fail-open. A customer application must keep running when
-AllStak ingest is slow, down, rate-limited, under maintenance, or unreachable.
-
-Default runtime guarantees for wizard-generated integrations:
-
-- SDK initialization should not block app startup.
-- Runtime telemetry delivery is best-effort and should not throw into customer code.
-- Browser and mobile telemetry uses short timeouts, bounded memory queues, and drops telemetry before it can harm app performance.
-- Server middleware should never wait on AllStak before returning the customer response.
-- HTTP instrumentation must preserve the original request behavior. If telemetry capture fails, the customer request still succeeds or fails only because of the customer system.
-- AllStak ingest endpoints are ignored by instrumentation to prevent recursive telemetry loops.
-- Source-map upload and setup-doctor failures affect CI only when the developer explicitly configures a fail-on-error build mode.
-
-Operational behavior during AllStak incidents:
-
-- DNS/TLS/connectivity failures are swallowed internally.
-- 5xx and 503 maintenance responses back off and eventually drop telemetry.
-- 429 responses should back off and avoid retry storms.
-- Queue overflow drops telemetry rather than growing memory without bounds.
-- Debug logging is opt-in. Normal applications should not see noisy AllStak transport errors.
-
-Current public status:
-
-- Stable runtime SDKs with fail-open certification: JavaScript, React, Next.js runtime, Java/Spring, Python, and Go.
-- Runtime SDKs with useful work but incomplete Stable proof are internal experimental only and must not appear as normal public supported SDKs.
-- React Native/Expo remains internal experimental until real SDK-generated mobile request continuity, emulator/device runtime proof, and mobile session timeline proof are complete.
-- Laravel/PHP is hidden from public Stable status. Plain PHP cannot provide the same async worker guarantees without framework/deferred queue fixtures, and Laravel middleware fixtures are not yet certified.
-- Flutter is hidden from public Stable status until HTTP wrapper, native crash, lifecycle hook, and app-runtime fail-open fixtures pass.
-- Non-JS OpenTelemetry bridges were not found in this SDK workspace. They must not be advertised as supported.
-
-When in doubt, the wizard and docs must prefer data loss over application risk.

package/docs/beta/restore.md

@@ -1,84 +0,0 @@
-# `allstak restore`
-
-Every wizard mutation is captured in a persistent snapshot under
-`.allstak-wizard/backups/<timestamp>--<integration>--<random>/`. The
-`restore` family lets you inspect and roll back those snapshots.
-
-## Subcommands
-
-```bash
-npx @allstak/wizard@beta restore list
-npx @allstak/wizard@beta restore show <id|latest>
-npx @allstak/wizard@beta restore diff <id|latest>
-npx @allstak/wizard@beta restore apply <id|latest> [--files=a,b,c] [--dry-run]
-```
-
-`<id>` is the trailing slug of a backup directory. `latest` always
-resolves to the most recent snapshot.
-
-## What's in a snapshot
-
-```
-.allstak-wizard/backups/2026-05-07T..--react--abc123/
-  manifest.json                    schemaVersion, integration, files[], dryRun, label
-  files/
-    src/main.tsx                   pre-image bytes (UTF-8)
-    .env.local                     pre-image bytes
-    .env.local.allstak-deleted     marker (file did not exist before)
-```
-
-Manifests and pre-images are plain text — they're safe to inspect with `cat`.
-
-## Common workflows
-
-### "I made a mess, give me my files back"
-
-```bash
-npx @allstak/wizard@beta restore apply latest
-```
-
-Confirms before writing. Pass `-y` to skip confirmation.
-
-### "What did the wizard change vs my current state?"
-
-```bash
-npx @allstak/wizard@beta restore diff latest
-```
-
-Each file shows one of: `identical`, `modified`, `created-since`, or
-`deleted-since`.
-
-### "Restore one file from a specific run"
-
-```bash
-npx @allstak/wizard@beta restore apply 2026-05-07T..--react--abc123 \
-  --files=src/main.tsx,.env.local
-```
-
-### "What WOULD restore do?"
-
-```bash
-npx @allstak/wizard@beta restore apply latest --dry-run
-```
-
-## Retention
-
-`init` prunes old snapshots after a successful run. The default keeps the
-10 most recent — override with `--snapshot-keep <n>` (0 disables pruning).
-`repair` and `uninstall` also write snapshots but do NOT prune.
-
-## Transactional
-
-Restoring is itself a transaction — partial failure rolls back to the
-pre-restore state. If a file in the snapshot is missing on disk, the
-restore reports `skipped` for that file and continues.
-
-## Limitations
-
-- Restoring across wizard major versions is supported but a `manifest.json`
-  with a `schemaVersion` higher than the running wizard's is refused.
-- Snapshots live in your repo by default. Add
-  `.allstak-wizard/` to `.gitignore` to keep them out of git (the wizard
-  does not auto-edit your `.gitignore`).
-- Snapshots are NOT encrypted. Don't store them in a public artifact bucket
-  — they contain the original contents of files the wizard touched.

package/docs/beta/troubleshooting.md

@@ -1,133 +0,0 @@
-# Troubleshooting
-
-Common failure modes mapped to canonical error codes (see [errors.md](../errors.md)).
-
-## "I just ran `allstak login` and got `E_AUTH_FAILED`"
-
-- The OTP code expires after ~10 minutes. Run `login` again to request a new one.
-- Codes are 4–8 digits. If you typed an extra space, the wizard rejects with
-  the same code.
-- If you see `OTP_RATE_LIMITED` in the subcode, wait a minute and retry.
-
-## "`E_AUTH_REQUIRED` from `orgs list` but I am logged in"
-
-You were logged in to a different host. The wizard scopes credentials by
-host. Check `allstak whoami --verify` and rerun with the matching `--host`,
-or re-run `login --host <url>`.
-
-## "`E_AUTH_EXPIRED` after a long break"
-
-The refresh token was probably revoked (server-side logout, password reset,
-or it just expired). Run `allstak logout && allstak login`.
-
-## "`E_NETWORK_FAILED` everywhere"
-
-- Verify the configured host with `allstak whoami` (it prints the host).
-- Pass `--debug` and re-run; the underlying message includes the URL.
-- For self-hosted: confirm DNS + TLS are working from the wizard's host.
-
-## "`E_UNSUPPORTED_FRAMEWORK` even though I'm using React"
-
-- `package.json` may not declare `react` directly. The wizard reads
-  `dependencies` + `devDependencies`.
-- For monorepos, run the wizard from the **package directory**, not the
-  root.
-- Pass `-i react` explicitly if detection is ambiguous.
-
-## "`E_UNSUPPORTED_VERSION` but my React/Next is current"
-
-The compat engine reads the version range from `package.json`. If you have
-`"react": "*"` it cannot infer a minimum and reports too-old. Pin a real
-version range in `package.json`.
-
-## "`E_PACKAGE_MANAGER_CONFLICT`"
-
-Two lockfiles in the project root (e.g. both `pnpm-lock.yaml` and
-`package-lock.json`). The wizard refuses to guess. Delete the stale one.
-
-## "`E_PATCH_FAILED` mid-run"
-
-The transaction layer ALREADY rolled back your files. Re-run with
-`--debug` to see which patcher threw. Common causes:
-
-- A pre-existing syntax error in the file we tried to patch — fix the
-  syntax first, re-run the wizard.
-- File permissions denied on the entry file or `.env.local`.
-
-If rollback itself failed (`E_PATCH_ROLLBACK_FAILED`):
-
-```bash
-allstak restore list
-allstak restore apply <id>
-```
-
-## "`E_RESTORE_FAILED: No snapshot matches "<id>""
-
-`allstak restore list` shows what's available. Use the trailing slug
-(e.g. `2026-05-07T..--react--abc123`) or just `latest`.
-
-## "`E_INGEST_VERIFY_FAILED` on `--live-probe`"
-
-- The probe uses `--api-key` (project-scoped). If the key was issued for
-  a different project than `--project-id`, verification will never see the
-  event. Check both match.
-- The probe waits 60s by default. Increase via
-  `--live-probe-timeout 120000` if your backend is slow.
-- Open the dashboard URL printed in the probe output and look for the
-  fingerprint manually. The event id is in the JSON output even when
-  polling times out.
-
-## "`E_CONFIG_INVALID` after editing `allstak.config.ts`"
-
-```bash
-allstak config validate
-```
-
-prints the exact path-to-blame (e.g. `selfHosted.apiHost — expected
-absolute URL, got "api.acme"`). Fix and rerun.
-
-## "`E_CONFIG_MIGRATION_FAILED`"
-
-The migration runner refuses on:
-
-- A `schemaVersion` higher than the wizard supports (subcode
-  `E_CONFIG_FUTURE_VERSION`) — upgrade `@allstak/wizard`.
-- A migration that didn't bump the version correctly (subcode
-  `E_MIGRATION_NO_BUMP`) — file an issue, this is a wizard bug.
-
-## "`E_USER_CANCELLED` in CI"
-
-You forgot `-y`. The wizard refuses to apply changes without it in
-non-interactive mode.
-
-## "Wizard hung at the login OTP prompt in CI"
-
-CI has no TTY, so `@clack/prompts` rejects. Pass `--email` AND `--code` (or
-use a long-lived API key with `--api-key` instead of logging in).
-
-## "Telemetry warning showed up in my CI logs"
-
-Telemetry is on by default. To silence:
-
-```bash
-ALLSTAK_WIZARD_TELEMETRY=0
-# or
-allstak --no-telemetry ...
-```
-
-## "I see `// >>> allstak-wizard:v1` in my git diff"
-
-That's the wizard's idempotency marker. It's intentional — re-runs replace
-the block in place; `uninstall` removes it. Commit it; do not hand-edit
-inside the markers (your edits will be overwritten on the next run).
-
-## Last resort: nuke everything
-
-```bash
-allstak uninstall -i react -y    # remove SDK + patches
-allstak logout                   # clear credentials
-rm -rf .allstak-wizard/          # drop persistent snapshots
-```
-
-The local credential store on macOS may keep the keychain entry until you
-explicitly clear it: `security delete-generic-password -s allstak-wizard`.