@allstak/wizard 0.1.7 → 0.1.8

package/docs/beta/fastify.md

@@ -1,62 +0,0 @@
-# Fastify
-
-**Stability:** internal experimental. AST-safe import (ESM only) + managed-block hint.
-The wizard branches on module system: ESM entries get an AST-injected
-`import { allstakFastify }`; CJS entries get the managed-block hint only
-(the wizard does NOT inject `require()` calls, which interact badly with
-top-of-file conditional/dynamic require patterns).
-
-## What you get
-
-- `@allstak/fastify` installed.
-- `.env` populated with `ALLSTAK_API_KEY`.
-- Entry file (resolved from `package.json:scripts.start`,
-  `package.json:main`, or conventional `src/server.{ts,js,mjs}` /
-  `src/index.{ts,js,mjs}`):
-  - **ESM** (`type: module` / `.mjs` / `import` syntax in the file):
-    AST-injected import.
-  - **CJS**: import skipped, hint-only.
-  - Both: a managed-block hint demonstrating
-    `app.register(allstakFastify, { ... })`.
-
-## Run
-
-```bash
-npx @allstak/wizard@beta -i fastify
-```
-
-## Compatibility
-
-- `fastify >= 4`. Older versions refused with `E_UNSUPPORTED_VERSION`.
-
-## Wiring `app.register`
-
-```ts
-import Fastify from 'fastify';
-import { allstakFastify } from '@allstak/fastify';
-
-const app = Fastify({ logger: true });
-await app.register(allstakFastify, {
-  apiKey: process.env.ALLSTAK_API_KEY,
-});
-// … your routes
-await app.listen({ port: 3000 });
-```
-
-`doctor` reports `warn` on `plugin-registered` until a non-comment
-`app.register(allstakFastify, ...)` call is detected (line comments
-are stripped before matching so the wizard's own hint does not satisfy
-the check).
-
-## Capabilities the wizard does NOT claim
-
-- **No source-map upload wiring.** Deferred to v0.2.
-- **No CJS AST patching.** CJS users wire the `require(...)` and
-  `app.register(...)` calls per the managed-block hint.
-- **No bundler integration** (esbuild/tsup/etc.) — out of scope for v0.1.
-
-## Verify
-
-```bash
-npx @allstak/wizard@beta doctor -i fastify
-```

package/docs/beta/known-limitations.md

@@ -1,93 +0,0 @@
-# Known limitations
-
-This page is the **honest** list of what the wizard does and doesn't do
-today. Read it before making the wizard part of a critical onboarding
-path.
-
-## Supported integrations
-
-| Integration | Stability | Notes |
-|-------------|-----------|-------|
-| `react` (Vite or CRA) | ✅ stable | Validated end-to-end; dogfooded against `admin-web` and `web`. |
-| `next` (13/14/15, app + pages router) | ✅ stable | Disposable live-backend certification passed for App Router 15 and pages-router onboarding; Edge Runtime and Server Actions are not certified. |
-| `js` (vanilla Node) | ✅ stable | Validated end-to-end. |
-| `expo` (managed workflow, ≥50) | internal experimental | Hidden from normal public setup; requires `--experimental`. Real device/emulator runtime proof is incomplete. |
-| `nestjs` (≥9) | internal experimental | Runtime SDK fail-open is verified, but wizard auto-wiring is not Stable. Requires `--experimental`. |
-| `fastify` (≥4) | internal experimental | Runtime SDK fail-open is verified, but wizard auto-wiring is not Stable. Requires `--experimental`. |
-
-Everything else is `experimental` (refuses without `--experimental`) or
-`unsupported` (refuses always).
-
-## Explicitly NOT supported
-
-| Target | Why |
-|--------|-----|
-| **Astro** | The wizard's framework detector falls through to `js`, which writes env vars but does not wire Astro middleware. Real Astro support is on the v0.2 roadmap. Until then: do the setup manually following the SDK README. |
-| **Bare React Native** | Podfile + Gradle patching cannot be validated without iOS sim + Android emulator builds. The wizard refuses with `E_UNSUPPORTED_FRAMEWORK`. Use the Expo managed path if you can; otherwise follow the manual setup. |
-| **Expo prebuilt / bare-via-prebuild** | If `ios/` or `android/` already exist, the wizard refuses (same reason as bare RN). Run `expo prebuild --clean` later if you need native edits, but the wizard will not patch the native projects in v0.1. |
-| **NestJS / Fastify auto-registration** | Wizard injects the import + a managed-block hint. It does NOT mutate `bootstrap()` to call `useGlobalFilters` or `app.register` — entry-point shapes vary too widely (factories, hybrid apps, custom adapters) and the blast radius is too high. `doctor` reports `warn` until you wire the call yourself. |
-| **Flutter source maps** | The Flutter SDK itself does not yet ship source-map upload tooling. Wizard's Flutter integration is `experimental` and only writes env vars. |
-| **Backend SDK auto-wiring** (OTel, Spring Boot, Django, Flask, Rails, .NET, Go, PHP) | Each is `experimental`. Install + env-var writing is supported under `--experimental`; framework wiring is NOT — too many entry-point shapes to AST-patch safely without per-framework fixture validation. v0.2 roadmap. |
-
-## Auth specifics
-
-- Login uses email-OTP (no OAuth device-flow). Rate-limited; 4–8 digit
-  codes valid for ~10 minutes.
-- Two-factor (TOTP) is supported but not unit-tested end-to-end (the test
-  matrix doesn't include accounts with 2FA enabled).
-- JWT refresh has a 60-second early-refresh window; the access token TTL
-  is 15 minutes, the refresh token rotates on each `/refresh` call.
-
-## Source-maps
-
-- **Vite**: AST-injects the plugin import + managed-block hint.
-- **Next.js**: managed-block hint only (next.config shapes vary too much
-  for safe AST mutation).
-- **Webpack**: managed-block hint only.
-- **Metro / Hermes (RN)**: provider registered but inert in v0.1 — `detect()`
-  returns `false` and `wire()` is a no-op. Real validation needs device
-  builds.
-- End-to-end **upload roundtrip** (POST `/api/v1/sourcemaps/upload` →
-  symbolicate) is NOT verified by `doctor` in v0.1.x. The wizard wires the
-  plugin; the upload + dashboard symbolication are the SDK + dashboard's
-  responsibility.
-
-## Other gaps
-
-- **Windows Credential Manager** is not yet a credential store backend on
-  Windows — Windows users get the AES-256-GCM encrypted-file fallback.
-- **CRA + standalone Webpack** are detected but the wizard does not AST-mutate
-  Webpack configs.
-- **Multi-package monorepos** are detected (pnpm/turbo/nx/lerna/npm-workspaces)
-  but the wizard operates on the cwd's nearest manifest. There is no
-  "which package?" prompt yet.
-- **`allstak login`** is the only path to a user JWT in beta. There is no
-  PAT (personal access token) flow, because the backend doesn't expose one.
-
-## What's safe to use in production
-
-- React + Vite onboarding flows.
-- React + CRA onboarding flows (without source-map upload — manual wiring).
-- Vanilla Node entry-point patching.
-- Next.js with manual `next.config.js` follow-up.
-- Expo managed workflow (`app.json` plugin entry + provider hint).
-- NestJS / Fastify install + env wiring + managed-block hint, with a manual
-  `useGlobalFilters` / `app.register` call as documented in the per-framework
-  beta page.
-- All commands in their `--dry-run` form (no disk writes anywhere).
-- `restore` / snapshot inspection (read-only ops).
-
-## What to avoid
-
-- Running `--experimental` integrations in CI without manual review.
-- Deploying based on `doctor --live-probe` for Java integrations until the
-  host-config fix lands.
-- Treating Astro / bare-RN as "the wizard handles it."
-
-## Reporting an issue
-
-Re-run with `--debug` and grab the canonical `errorCode` + `subcode` from
-the output. Snapshot directory contents (under `.allstak-wizard/backups/`)
-are useful for support. Do **not** paste your full env file or
-`allstak.config.*` to a public issue — redact `apiKey` / DSN / refresh
-token values first.

package/docs/beta/nestjs.md

@@ -1,69 +0,0 @@
-# NestJS
-
-**Stability:** internal experimental. AST-safe import + managed-block hint. The wizard
-does NOT auto-mutate `bootstrap()` to call `app.useGlobalFilters(...)` —
-Nest entry shapes vary too much (factory functions, custom adapters,
-hybrid microservice apps) and registration mid-bootstrap has high blast
-radius. The wizard places the import and a hint; you wire the call.
-
-## What you get
-
-- `@allstak/nestjs` installed.
-- `.env` populated with `ALLSTAK_API_KEY`.
-- `src/main.ts` (or the entry pointed to by `package.json:scripts.start`)
-  gets:
-  - An AST-injected
-    `import { AllStakNestExceptionFilter, AllStakNestInterceptor } from '@allstak/nestjs'`.
-  - A managed-block hint demonstrating the registration call inside
-    a `//`-comment block. `doctor` strips line comments before
-    matching the live registration, so the hint itself does not
-    produce a false-positive `pass`.
-
-## Run
-
-```bash
-npx @allstak/wizard@beta -i nestjs
-```
-
-## Compatibility
-
-- `@nestjs/core >= 9`. Older versions refused with `E_UNSUPPORTED_VERSION`.
-
-## Wiring `useGlobalFilters` / `useGlobalInterceptors`
-
-Inside your `bootstrap()` after `NestFactory.create(...)`:
-
-```ts
-import { NestFactory } from '@nestjs/core';
-import {
-  AllStakNestExceptionFilter,
-  AllStakNestInterceptor,
-} from '@allstak/nestjs';
-import { AppModule } from './app.module';
-
-async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
-  app.useGlobalFilters(new AllStakNestExceptionFilter());
-  app.useGlobalInterceptors(new AllStakNestInterceptor());
-  await app.listen(3000);
-}
-bootstrap();
-```
-
-`doctor` reports `warn` on `filter-registered` until at least one of
-`useGlobalFilters(...AllStakNestExceptionFilter` or
-`useGlobalInterceptors(...AllStakNestInterceptor` is detected in
-non-comment source.
-
-## Capabilities the wizard does NOT claim
-
-- **No source-map upload wiring.** Deferred to v0.2.
-- **No registration-call auto-injection.** See the rationale above.
-- **No microservice / hybrid-app wiring.** The hint targets the standard
-  HTTP bootstrap; for hybrid apps register filters per-microservice.
-
-## Verify
-
-```bash
-npx @allstak/wizard@beta doctor -i nestjs
-```

package/docs/beta/next.md

@@ -1,76 +0,0 @@
-# Next.js
-
-**Stability:** stable. Runtime fail-open behavior and disposable live-backend
-certification have passed for supported Next.js paths. Edge Runtime and Server
-Actions are not certified.
-
-## What you get
-
-- `@allstak/next` + `@allstak/js` installed.
-- `.env.local` populated with **both** `ALLSTAK_API_KEY` and `ALLSTAK_DSN`
-  (`ALLSTAK_DSN` is still written during the env-var transition).
-- `instrumentation.ts` created at the project root if missing, otherwise a
-  managed-block hint appended to the existing one. The wizard does NOT
-  modify the body of an existing `register()` function.
-- `next.config.{js,mjs,ts}` gains a managed-block hint reminding you to
-  wrap with `withAllStak` and enable `productionBrowserSourceMaps: true`.
-
-## Run
-
-```bash
-npx @allstak/wizard@beta -i next
-```
-
-## Compatibility
-
-- `next >= 13`. Both app router and pages router supported.
-- Older Next versions refused with `E_UNSUPPORTED_VERSION`.
-
-## Wiring `register()`
-
-Wizard creates this if `instrumentation.ts` did not exist:
-
-```ts
-import { initAllStakNext } from '@allstak/next';
-
-export function register() {
-  initAllStakNext({
-    dsn: process.env.ALLSTAK_DSN,
-    endpoint: process.env.ALLSTAK_HOST ?? 'https://api.allstak.sa',
-    release: process.env.ALLSTAK_RELEASE,
-    environment: process.env.ALLSTAK_ENVIRONMENT ?? 'production',
-  });
-}
-```
-
-If you already have `register()`, copy the body of `initAllStakNext({ ... })`
-into it.
-
-## Source maps
-
-Wrap `next.config.*` with `withAllStak`:
-
-```js
-const { withAllStak } = require('@allstak/js/next');
-module.exports = withAllStak({
-  ...nextConfig,
-  productionBrowserSourceMaps: true,
-});
-```
-
-The wizard does NOT auto-mutate `next.config.*` for you — Next configs use
-many factory shapes (`module.exports = (phase, { defaultConfig }) => …`) and
-auto-mutation has too high a blast-radius. Follow the managed-block hint.
-
-## Known limitations
-
-- Live `doctor --live-probe` works for Next-emitted events only when your
-  Next app runs in a place the wizard can reach. (No magic — the SDK posts
-  to `/ingest/v1/errors` and the wizard polls `/api/v1/errors`.)
-- Edge Runtime and Server Actions are not certified.
-
-## Verify
-
-```bash
-npx @allstak/wizard@beta doctor -i next
-```

package/docs/beta/node.md

@@ -1,60 +0,0 @@
-# Vanilla Node.js (`@allstak/js`)
-
-**Stability:** `stable`. Validated against fixture and dogfooded.
-
-## What you get
-
-- `@allstak/js` SDK installed.
-- `.env` populated with the standard `ALLSTAK_*` vars.
-- AST-injected `import { AllStak } from '@allstak/js'` in your entry file.
-- Managed-block call to `AllStak.init({...})` appended to the entry.
-
-## Run
-
-```bash
-npx @allstak/wizard@beta -i js
-```
-
-## Entry detection
-
-The wizard looks at `package.json:scripts.start` for a `node X.js` pattern,
-then falls back to:
-
-- `src/index.ts` / `src/index.js`
-- `index.ts` / `index.js`
-- `app.ts` / `app.js`
-- `server.ts` / `server.js`
-
-If none match, the wizard skips entry patching and reports
-`config-only run` — env vars are still written; you need to call
-`AllStak.init(...)` manually.
-
-## What the patched entry looks like
-
-After `init`, the bottom of your entry file gains:
-
-```js
-// >>> allstak-wizard:v1 (do not edit) >>>
-AllStak.init({
-  apiKey: process.env.ALLSTAK_API_KEY,
-  host: process.env.ALLSTAK_HOST ?? 'https://api.allstak.sa',
-  environment: process.env.ALLSTAK_ENVIRONMENT ?? 'production',
-  release: process.env.ALLSTAK_RELEASE,
-});
-// <<< allstak-wizard:v1 <<<
-```
-
-Re-running the wizard replaces this block in place. `uninstall` removes it.
-
-## Compatibility
-
-- Node 18+ required by the wizard itself.
-- The `@allstak/js` SDK supports Node 16+.
-- Works with TypeScript entries via `tsx`/`bun`/`deno run` toolchains.
-
-## What this integration does NOT do
-
-- No bundler-level source-map wiring — Node is interpreted, not bundled.
-- No express/fastify/hono middleware registration — those are framework-
-  specific and live in their own integrations (`fastify` is `experimental`
-  for now; nest/express integrations are deferred).

package/docs/beta/privacy.md

@@ -1,99 +0,0 @@
-# Privacy & telemetry
-
-The wizard ships a minimal anonymous-usage telemetry channel. This page
-documents **exactly** what is sent and how to disable it.
-
-## What we send
-
-| Field | Example | Why |
-|-------|---------|-----|
-| `schemaVersion` | `1` | Stable version of this payload shape. |
-| `installId` | `b9c4...` | Anonymous v4 UUID stored at `~/.config/allstak/install-id`. Coalesces events for the same install. Rotate by deleting the file. |
-| `wizardVersion` | `0.1.3` | The wizard's own version. |
-| `command` | `init`, `doctor`, `restore-apply`, … | Which wizard command ran. |
-| `integration` | `react`, `next`, `js`, `null` | Selected integration (`null` for commands that don't have one — `login`, `restore-list`, etc.). |
-| `stability` | `stable`, `beta`, `experimental`, `unsupported`, `null` | Stability level of the active integration. |
-| `os.family` | `darwin`, `linux`, `win32` | Node's `process.platform`. |
-| `os.majorRelease` | `23`, `5`, `10` | Major version of the OS kernel. |
-| `os.arch` | `x64`, `arm64` | Process architecture. |
-| `node.major` | `20`, `22` | Major Node version. |
-| `packageManager` | `npm`, `pnpm`, `yarn`, `yarn-berry`, `bun`, `null` | Detected package manager. |
-| `outcome` | `success`, `failure`, `cancelled`, `noop` | Final state. |
-| `stage` | `auth`, `patch`, `restore`, … | Stage at termination. |
-| `errorCode` | `E_PATCH_FAILED`, `null` | Canonical error code; never message text. |
-| `rollbackTriggered` | `true`/`false` | Did an in-process rollback fire? |
-| `durationMs` | `4231` | Wall-clock duration. |
-
-That's the entire payload. There are no opaque "metadata" or "extras"
-fields.
-
-## What we NEVER send
-
-The TypeScript type in `src/telemetry/payload.ts` is the contract. The
-wizard CANNOT send any of the following — there is no field for them:
-
-- API keys, DSNs, OAuth tokens, refresh tokens.
-- Org names, project names, project ids, org ids.
-- File paths (absolute or relative).
-- `process.env` values.
-- Source code from your repo.
-- Error message text or stack frames.
-- Email addresses, IP addresses, hostnames.
-
-The error code `E_PATCH_FAILED` reaches us; the patcher's stack trace and
-the file path it failed on do not.
-
-## How to disable
-
-Three independent ways, any one of them is sufficient:
-
-```bash
-# Per-run flag:
-npx @allstak/wizard@beta --no-telemetry ...
-
-# Process env:
-ALLSTAK_WIZARD_TELEMETRY=0 npx @allstak/wizard@beta ...
-
-# Globally for your shell:
-export ALLSTAK_WIZARD_TELEMETRY=0
-```
-
-Disabling does NOT disable the wizard's local audit trail (snapshots in
-`.allstak-wizard/backups/`). Those are local-only and never sent anywhere.
-
-## How to inspect what would be sent
-
-```bash
-npx @allstak/wizard@beta --telemetry-debug -i react --dry-run
-```
-
-`--telemetry-debug` prints the would-be payload to stderr instead of
-sending it, regardless of the gate state.
-
-## Where the data goes
-
-- **Default provider** is `noop` — the wizard does NOT phone home in beta.
-  `noopTelemetry` is selected unless an operator (or you) explicitly wires
-  in `httpTelemetry({ endpoint })`. This is a deliberate beta-period
-  posture: build the abstraction, don't quietly start collecting.
-- When configured: HTTPS POST of the JSON payload with a 1.5s timeout,
-  failures swallowed.
-
-## Credentials
-
-`allstak login` stores your JWT pair in your OS keychain (macOS / libsecret)
-or an AES-256-GCM encrypted file fallback. Never sent to telemetry. See
-`src/credentials/` for the implementation.
-
-## Anonymous install id
-
-Stored at `~/.config/allstak/install-id` (or the platform equivalent).
-Generated lazily on first telemetry-emitting run. Delete the file to
-rotate. Telemetry-disabled runs do NOT generate or read it.
-
-## Audit
-
-The complete payload type is at `src/telemetry/payload.ts`. The unit-test
-suite asserts that the runtime payload contains EXACTLY the documented
-fields (no more, no fewer) — adding a field requires updating both the
-type and this doc, and the test fails until you do.

package/docs/beta/quickstart.md

@@ -1,89 +0,0 @@
-# Quickstart — `@allstak/wizard@beta`
-
-> Status: **public beta**. The wizard is honest about what works and what
-> doesn't — see [known limitations](./known-limitations.md) for the gaps you
-> need to know about before adopting.
-
-## Install + run in one command
-
-```bash
-# React (Vite or CRA)
-npx @allstak/wizard@beta -i react
-
-# Next.js (app or pages router; 13+)
-npx @allstak/wizard@beta -i next
-
-# Vanilla Node
-npx @allstak/wizard@beta -i js
-```
-
-The wizard auto-detects your framework if you omit `-i`.
-
-## Five-minute first run
-
-```bash
-# 1. Authenticate against AllStak (email OTP).
-npx @allstak/wizard@beta login
-
-# 2. List your orgs and projects.
-npx @allstak/wizard@beta orgs list
-npx @allstak/wizard@beta projects list
-
-# 3. Create a project + mint an API key in one go.
-npx @allstak/wizard@beta projects create \
-  --name "My App" --slug my-app \
-  --with-api-key
-
-# 4. Run the wizard against your project.
-cd /path/to/my/app
-npx @allstak/wizard@beta            # auto-detect
-# or:
-npx @allstak/wizard@beta -i next
-
-# 5. Verify the setup with a real test event.
-npx @allstak/wizard@beta doctor --live-probe \
-  --api-key ask_live_... \
-  --project-id <project-uuid>
-```
-
-## What the wizard does (in order)
-
-1. Detects your framework + package manager.
-2. Loads `allstak.config.*` if present.
-3. Verifies framework version compatibility.
-4. **Asks for confirmation** before any disk write (skip with `-y`).
-5. Installs the right `@allstak/*` package via your package manager.
-6. Writes env vars to `.env.local` / `.env` — never overwrites your values.
-7. Patches your entry file (AST-injects the import; appends a managed-block
-   hint).
-8. Wires the source-map plugin into `vite.config.*` / `next.config.*`.
-9. Snapshots every touched file to `.allstak-wizard/backups/<id>/`.
-10. Runs a doctor pass and reports the result.
-
-## Always reversible
-
-```bash
-# Roll back the latest snapshot.
-npx @allstak/wizard@beta restore apply latest
-
-# Or fully uninstall.
-npx @allstak/wizard@beta uninstall -i react
-```
-
-## Dry-run before committing
-
-```bash
-npx @allstak/wizard@beta -i react --dry-run --json | jq '.diff'
-```
-
-The dry-run never touches disk.
-
-## Next reads
-
-- [`react.md`](./react.md), [`next.md`](./next.md), [`node.md`](./node.md) — per-integration guides.
-- [`config.md`](./config.md) — `allstak.config.ts` precedence + migrations.
-- [`doctor.md`](./doctor.md) — diagnosing a setup.
-- [`restore.md`](./restore.md) — restoring snapshots.
-- [`privacy.md`](./privacy.md) — telemetry contract.
-- [`troubleshooting.md`](./troubleshooting.md) — common errors and fixes.
-- [`known-limitations.md`](./known-limitations.md) — what's NOT supported in beta.

package/docs/beta/react.md

@@ -1,91 +0,0 @@
-# React (Vite or CRA)
-
-**Stability:** `stable`. Validated end-to-end against fixture and dogfooded
-against AllStak `admin-web` and `web` packages.
-
-## What you get
-
-- `@allstak/react` SDK installed via your package manager.
-- `.env.local` (Vite) or `.env` (CRA) populated with `ALLSTAK_API_KEY`,
-  `ALLSTAK_HOST`, `ALLSTAK_ENVIRONMENT`, and (if configured) `ALLSTAK_RELEASE`.
-- `AllStakProvider` import added to your entry file via AST mutation.
-- Root render tree wrapped with a guarded `AllStakRoot` component when the
-  wizard recognizes a standard `createRoot(...).render(...)` entry.
-- For Vite projects: `@allstak/react/vite` source-map helper is added to `vite.config.*`.
-
-## Run
-
-```bash
-# Auto-detect:
-npx @allstak/wizard@beta
-
-# Explicit:
-npx @allstak/wizard@beta -i react
-
-# Non-interactive (CI):
-npx @allstak/wizard@beta -i react -y --api-key $ALLSTAK_API_KEY \
-  --org $ORG --project $PROJECT --release $GIT_SHA
-```
-
-## Compatibility
-
-- `react >= 16.8`. Older React versions are refused with `E_UNSUPPORTED_VERSION`.
-- Works with Vite 4+ and Create React App. Webpack-only setups get a
-  managed-block hint instead of AST mutation (Webpack configs vary too much
-  for safe AST patching in v0.1).
-
-## Wiring the provider
-
-For standard Vite/CRA entry files, the wizard rewrites the root render tree:
-
-```tsx
-import type { ReactNode } from 'react';
-import { AllStakProvider } from '@allstak/react';
-
-function AllStakRoot({ children }: { children: ReactNode }) {
-  const apiKey = import.meta.env.VITE_ALLSTAK_API_KEY;
-  if (!apiKey) return <>{children}</>;
-  return (
-    <AllStakProvider apiKey={apiKey} environment="production">
-      {children}
-    </AllStakProvider>
-  );
-}
-
-ReactDOM.createRoot(document.getElementById('root')!).render(
-  <AllStakRoot>
-    <App />
-  </AllStakRoot>,
-);
-```
-
-If the wizard cannot safely identify the render call, it leaves a manual-review
-hint instead of risking a broken app.
-
-## Verify
-
-```bash
-npx @allstak/wizard@beta doctor -i react
-```
-
-For an end-to-end ingestion check:
-
-```bash
-npx @allstak/wizard@beta doctor -i react --live-probe \
-  --api-key ask_live_... \
-  --project-id <project-uuid>
-```
-
-## Idempotent
-
-Re-running `init` is idempotent. The wizard detects existing
-`AllStakProvider`/`AllStakRoot` setup and does not double-wrap the tree.
-
-## Uninstall
-
-```bash
-npx @allstak/wizard@beta uninstall -i react
-```
-
-Removes the `@allstak/react` dependency, strips the AST import,
-deletes the managed env block, and unwires the Vite plugin.

package/docs/beta/reliability.md

@@ -1,33 +0,0 @@
-# SDK Reliability and Fail-Open Behavior
-
-AllStak SDKs must be fail-open. A customer application must keep running when
-AllStak ingest is slow, down, rate-limited, under maintenance, or unreachable.
-
-Default runtime guarantees for wizard-generated integrations:
-
-- SDK initialization should not block app startup.
-- Runtime telemetry delivery is best-effort and should not throw into customer code.
-- Browser and mobile telemetry uses short timeouts, bounded memory queues, and drops telemetry before it can harm app performance.
-- Server middleware should never wait on AllStak before returning the customer response.
-- HTTP instrumentation must preserve the original request behavior. If telemetry capture fails, the customer request still succeeds or fails only because of the customer system.
-- AllStak ingest endpoints are ignored by instrumentation to prevent recursive telemetry loops.
-- Source-map upload and setup-doctor failures affect CI only when the developer explicitly configures a fail-on-error build mode.
-
-Operational behavior during AllStak incidents:
-
-- DNS/TLS/connectivity failures are swallowed internally.
-- 5xx and 503 maintenance responses back off and eventually drop telemetry.
-- 429 responses should back off and avoid retry storms.
-- Queue overflow drops telemetry rather than growing memory without bounds.
-- Debug logging is opt-in. Normal applications should not see noisy AllStak transport errors.
-
-Current public status:
-
-- Stable runtime SDKs with fail-open certification: JavaScript, React, Next.js runtime, Java/Spring, Python, and Go.
-- Runtime SDKs with useful work but incomplete Stable proof are internal experimental only and must not appear as normal public supported SDKs.
-- React Native/Expo remains internal experimental until real SDK-generated mobile request continuity, emulator/device runtime proof, and mobile session timeline proof are complete.
-- Laravel/PHP is hidden from public Stable status. Plain PHP cannot provide the same async worker guarantees without framework/deferred queue fixtures, and Laravel middleware fixtures are not yet certified.
-- Flutter is hidden from public Stable status until HTTP wrapper, native crash, lifecycle hook, and app-runtime fail-open fixtures pass.
-- Non-JS OpenTelemetry bridges were not found in this SDK workspace. They must not be advertised as supported.
-
-When in doubt, the wizard and docs must prefer data loss over application risk.