@posthog/wizard 2.50.0 → 2.52.0

package/dist/bounded-fs-Cx-8nk-1.js

@@ -0,0 +1,242 @@
+import { s as logToFile } from "./debug-C3ZR1TVF.js";
+import { n as analytics } from "./analytics-BXz4SIuS.js";
+import fs from "fs";
+import path from "path";
+import fg from "fast-glob";
+//#region src/utils/bounded-fs.ts
+/**
+* Bounded filesystem primitives for scanning USER project trees. Every
+* detection-time glob, walk, and project-file read goes through here so the
+* worst case is a constant, never a function of the user's repo.
+*/
+/**
+* Errno codes that are expected while walking an arbitrary tree and mean
+* "skip this entry", not "something is broken". Scanning from a broad dir
+* (e.g. `~`) routinely hits OS-protected paths (macOS `Library/Group
+* Containers/group.com.apple.*`) that throw EPERM/EACCES per entry — capturing
+* each as an exception buried real errors under thousands of noise events.
+*/
+const BENIGN_FS_ERROR_CODES = new Set([
+	"EACCES",
+	"EPERM",
+	"ENOENT",
+	"ENOTDIR",
+	"ELOOP",
+	"ENAMETOOLONG",
+	"EMFILE",
+	"ENFILE"
+]);
+/**
+* Report a swallowed filesystem error. Traversal stays best-effort — the caller
+* still skips the failing entry. Expected errno codes (permission denied, entry
+* vanished, symlink loops…) are logged to the debug file only; anything else is
+* genuinely unexpected and gets captured to error tracking. Preserves the
+* original Error (and its `code`, e.g. EACCES / ENOENT) when available.
+*/
+function reportFsError(step, filePath, error) {
+	const code = error?.code;
+	if (code && BENIGN_FS_ERROR_CODES.has(code)) {
+		logToFile(`[bounded-fs] skipped ${step} (${code}): ${filePath}`);
+		return;
+	}
+	analytics.captureException(error instanceof Error ? error : new Error(String(error)), {
+		step,
+		path: filePath
+	});
+}
+/**
+* Directory names to skip when scanning a project tree — dependency
+* directories, build output, virtual environments, vendored trees.
+* Used verbatim by walkProjectFiles and as glob patterns by boundedGlob.
+*/
+const IGNORED_DIRS = new Set([
+	"node_modules",
+	".git",
+	".next",
+	".nuxt",
+	".svelte-kit",
+	".turbo",
+	".cache",
+	".parcel-cache",
+	"dist",
+	"build",
+	"out",
+	"coverage",
+	".coverage",
+	"venv",
+	".venv",
+	"__pycache__",
+	".pytest_cache",
+	"vendor",
+	"target",
+	".gradle",
+	".idea",
+	".vscode",
+	"site-packages",
+	"DerivedData",
+	"Pods"
+]);
+/** IGNORED_DIRS as fast-glob ignore patterns. */
+const PROJECT_IGNORE_GLOBS = [...IGNORED_DIRS].map((dir) => `**/${dir}/**`);
+const MAX_PROJECT_FILE_BYTES = 2 * 1024 * 1024;
+const GLOB_DEADLINE_MS = 8e3;
+/**
+* Streams matches, stops at `limit`, destroys the crawl at GLOB_DEADLINE_MS.
+* Returns paths relative to `cwd`, possibly truncated.
+*/
+async function boundedGlob(patterns, options) {
+	const limit = options.limit ?? 500;
+	const stream = fg.stream(patterns, {
+		cwd: options.cwd,
+		dot: options.dot ?? false,
+		onlyFiles: true,
+		deep: options.deep,
+		ignore: [...PROJECT_IGNORE_GLOBS, ...options.extraIgnore ?? []],
+		suppressErrors: true,
+		followSymbolicLinks: false
+	});
+	const matches = [];
+	return new Promise((resolve) => {
+		let settled = false;
+		const finish = () => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			resolve(matches);
+		};
+		const timer = setTimeout(() => {
+			stream.destroy();
+			finish();
+		}, GLOB_DEADLINE_MS);
+		stream.on("data", (entry) => {
+			matches.push(String(entry));
+			if (matches.length >= limit) {
+				stream.destroy();
+				finish();
+			}
+		});
+		stream.once("error", finish);
+		stream.once("end", finish);
+		stream.once("close", finish);
+	});
+}
+/**
+* Walk a project tree, invoking `onFile(name, fullPath)` for every regular
+* file — including dotfiles like `.env` (the caller decides what it cares
+* about). Skips `IGNORED_DIRS` and hidden directories, follows symlinked
+* directories with realpath-based loop protection, descends at most
+* `maxDepth` levels below `rootDir`, and stops at the per-directory and
+* whole-walk caps. Filesystem errors are reported and skipped (best-effort).
+*/
+function walkProjectFiles(rootDir, onFile, maxDepth = 3) {
+	const visited = /* @__PURE__ */ new Set();
+	let filesSeen = 0;
+	const stack = [{
+		dir: rootDir,
+		depth: 0
+	}];
+	while (stack.length > 0 && filesSeen < 1e5) {
+		const { dir, depth } = stack.pop();
+		let realDir;
+		try {
+			realDir = fs.realpathSync(dir);
+		} catch (error) {
+			reportFsError("walkProjectFiles.realpath", dir, error);
+			continue;
+		}
+		if (visited.has(realDir)) continue;
+		visited.add(realDir);
+		let handle;
+		try {
+			handle = fs.opendirSync(dir);
+		} catch (error) {
+			reportFsError("walkProjectFiles.opendir", dir, error);
+			continue;
+		}
+		try {
+			let entriesRead = 0;
+			let entry;
+			while ((entry = handle.readSync()) !== null) {
+				if (++entriesRead > 1e4 || filesSeen >= 1e5) {
+					logToFile(`[bounded-fs] walk capped in ${dir} (entries=${entriesRead}, files=${filesSeen})`);
+					break;
+				}
+				if (IGNORED_DIRS.has(entry.name)) continue;
+				const fullPath = path.join(dir, entry.name);
+				let isDir = entry.isDirectory();
+				let isFile = entry.isFile();
+				if (entry.isSymbolicLink()) try {
+					const st = fs.statSync(fullPath);
+					isDir = st.isDirectory();
+					isFile = st.isFile();
+				} catch (error) {
+					reportFsError("walkProjectFiles.stat", fullPath, error);
+					continue;
+				}
+				if (isDir) {
+					if (entry.name.startsWith(".")) continue;
+					if (depth < maxDepth) stack.push({
+						dir: fullPath,
+						depth: depth + 1
+					});
+				} else if (isFile) {
+					filesSeen += 1;
+					onFile(entry.name, fullPath);
+				}
+			}
+		} finally {
+			try {
+				handle.closeSync();
+			} catch {}
+		}
+	}
+}
+/**
+* Read a project file as UTF-8, or null when missing, unreadable, or over
+* `maxBytes` (stat-gated: an oversized file is never materialized).
+*/
+function readProjectFile(filePath, maxBytes = MAX_PROJECT_FILE_BYTES) {
+	try {
+		if (fs.statSync(filePath).size > maxBytes) return null;
+		return fs.readFileSync(filePath, "utf-8");
+	} catch {
+		return null;
+	}
+}
+/**
+* `readProjectFile` that also reports unexpected errors to error tracking.
+* For walk callbacks where a failing read is worth a telemetry breadcrumb.
+*/
+function safeReadFile(fullPath) {
+	try {
+		if (fs.statSync(fullPath).size > 2097152) {
+			logToFile(`[bounded-fs] skipped oversized file: ${fullPath}`);
+			return null;
+		}
+		return fs.readFileSync(fullPath, "utf-8");
+	} catch (error) {
+		reportFsError("safeReadFile", fullPath, error);
+		return null;
+	}
+}
+/**
+* The first `bytes` of a file without materializing the rest.
+*/
+function readFileHead(filePath, bytes) {
+	try {
+		const fd = fs.openSync(filePath, "r");
+		try {
+			const buffer = Buffer.alloc(bytes);
+			const read = fs.readSync(fd, buffer, 0, bytes, 0);
+			return buffer.toString("utf-8", 0, read);
+		} finally {
+			fs.closeSync(fd);
+		}
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { walkProjectFiles as a, safeReadFile as i, readFileHead as n, readProjectFile as r, boundedGlob as t };
+
+//# sourceMappingURL=bounded-fs-Cx-8nk-1.js.map

package/dist/bounded-fs-Cx-8nk-1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-fs-Cx-8nk-1.js","names":[],"sources":["../src/utils/bounded-fs.ts"],"sourcesContent":["/**\n * Bounded filesystem primitives for scanning USER project trees. Every\n * detection-time glob, walk, and project-file read goes through here so the\n * worst case is a constant, never a function of the user's repo.\n */\nimport path from 'path';\nimport fs from 'fs';\nimport type { Dirent } from 'fs';\nimport fg from 'fast-glob';\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport type { WizardRunOptions } from './types';\n\n/**\n * Errno codes that are expected while walking an arbitrary tree and mean\n * \"skip this entry\", not \"something is broken\". Scanning from a broad dir\n * (e.g. `~`) routinely hits OS-protected paths (macOS `Library/Group\n * Containers/group.com.apple.*`) that throw EPERM/EACCES per entry — capturing\n * each as an exception buried real errors under thousands of noise events.\n */\nconst BENIGN_FS_ERROR_CODES = new Set<string>([\n  'EACCES', // permission denied\n  'EPERM', // operation not permitted (macOS-protected dirs)\n  'ENOENT', // entry vanished mid-walk\n  'ENOTDIR', // path component isn't a directory\n  'ELOOP', // symlink loop\n  'ENAMETOOLONG', // path too long\n  'EMFILE', // too many open files (environmental, not a wizard bug)\n  'ENFILE',\n]);\n\n/**\n * Report a swallowed filesystem error. Traversal stays best-effort — the caller\n * still skips the failing entry. Expected errno codes (permission denied, entry\n * vanished, symlink loops…) are logged to the debug file only; anything else is\n * genuinely unexpected and gets captured to error tracking. Preserves the\n * original Error (and its `code`, e.g. EACCES / ENOENT) when available.\n */\nfunction reportFsError(step: string, filePath: string, error: unknown): void {\n  const code = (error as NodeJS.ErrnoException | null)?.code;\n  if (code && BENIGN_FS_ERROR_CODES.has(code)) {\n    logToFile(`[bounded-fs] skipped ${step} (${code}): ${filePath}`);\n    return;\n  }\n  analytics.captureException(\n    error instanceof Error ? error : new Error(String(error)),\n    { step, path: filePath },\n  );\n}\n\nexport function getDotGitignore({\n  installDir,\n}: Pick<WizardRunOptions, 'installDir'>) {\n  const gitignorePath = path.join(installDir, '.gitignore');\n  const gitignoreExists = fs.existsSync(gitignorePath);\n\n  if (gitignoreExists) {\n    return gitignorePath;\n  }\n\n  return undefined;\n}\n\n/**\n * Directory names to skip when scanning a project tree — dependency\n * directories, build output, virtual environments, vendored trees.\n * Used verbatim by walkProjectFiles and as glob patterns by boundedGlob.\n */\nexport const IGNORED_DIRS = new Set<string>([\n  'node_modules',\n  '.git',\n  '.next',\n  '.nuxt',\n  '.svelte-kit',\n  '.turbo',\n  '.cache',\n  '.parcel-cache',\n  'dist',\n  'build',\n  'out',\n  'coverage',\n  '.coverage',\n  'venv',\n  '.venv',\n  '__pycache__',\n  '.pytest_cache',\n  'vendor',\n  'target',\n  '.gradle',\n  '.idea',\n  '.vscode',\n  'site-packages',\n  'DerivedData',\n  'Pods',\n]);\n\n/** IGNORED_DIRS as fast-glob ignore patterns. */\nexport const PROJECT_IGNORE_GLOBS: readonly string[] = [...IGNORED_DIRS].map(\n  (dir) => `**/${dir}/**`,\n);\n\n// Files larger than this are skipped, never materialized.\nexport const MAX_PROJECT_FILE_BYTES = 2 * 1024 * 1024;\n\n// A glob returns at most this many entries.\nexport const MAX_GLOB_MATCHES = 500;\n\n// A glob's traversal is destroyed after this long, even when abandoned.\nexport const GLOB_DEADLINE_MS = 8_000;\n\n// A directory contributes at most this many entries to a walk.\nexport const MAX_DIR_ENTRIES = 10_000;\n\n// A walk fires at most this many onFile callbacks.\nexport const MAX_WALK_FILES = 100_000;\n\nexport interface BoundedGlobOptions {\n  cwd: string;\n  /** Appended to PROJECT_IGNORE_GLOBS. */\n  extraIgnore?: readonly string[];\n  /** Stop after this many matches. Defaults to MAX_GLOB_MATCHES. */\n  limit?: number;\n  /** Match dotfiles. Traversal of dot-DIRECTORIES stays blocked by the ignore set. */\n  dot?: boolean;\n  /** fast-glob `deep` — maximum directory depth. */\n  deep?: number;\n}\n\n/**\n * Streams matches, stops at `limit`, destroys the crawl at GLOB_DEADLINE_MS.\n * Returns paths relative to `cwd`, possibly truncated.\n */\nexport async function boundedGlob(\n  patterns: string | string[],\n  options: BoundedGlobOptions,\n): Promise<string[]> {\n  const limit = options.limit ?? MAX_GLOB_MATCHES;\n  const stream = fg.stream(patterns, {\n    cwd: options.cwd,\n    dot: options.dot ?? false,\n    onlyFiles: true,\n    deep: options.deep,\n    ignore: [...PROJECT_IGNORE_GLOBS, ...(options.extraIgnore ?? [])],\n    suppressErrors: true,\n    followSymbolicLinks: false,\n  });\n\n  const matches: string[] = [];\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      resolve(matches);\n    };\n    const timer = setTimeout(() => {\n      stream.destroy();\n      finish();\n    }, GLOB_DEADLINE_MS);\n    stream.on('data', (entry: string | Buffer) => {\n      matches.push(String(entry));\n      if (matches.length >= limit) {\n        stream.destroy();\n        finish();\n      }\n    });\n    stream.once('error', finish);\n    stream.once('end', finish);\n    stream.once('close', finish);\n  });\n}\n\n/**\n * Walk a project tree, invoking `onFile(name, fullPath)` for every regular\n * file — including dotfiles like `.env` (the caller decides what it cares\n * about). Skips `IGNORED_DIRS` and hidden directories, follows symlinked\n * directories with realpath-based loop protection, descends at most\n * `maxDepth` levels below `rootDir`, and stops at the per-directory and\n * whole-walk caps. Filesystem errors are reported and skipped (best-effort).\n */\nexport function walkProjectFiles(\n  rootDir: string,\n  onFile: (name: string, fullPath: string) => void,\n  maxDepth = 3,\n): void {\n  const visited = new Set<string>();\n  let filesSeen = 0;\n  // Explicit stack — no call-stack recursion.\n  const stack: Array<{ dir: string; depth: number }> = [\n    { dir: rootDir, depth: 0 },\n  ];\n\n  while (stack.length > 0 && filesSeen < MAX_WALK_FILES) {\n    const { dir, depth } = stack.pop()!;\n\n    // realpath both resolves symlinked dirs and gives us a stable key to\n    // detect loops (symlink cycles, e.g. a -> ../a).\n    let realDir: string;\n    try {\n      realDir = fs.realpathSync(dir);\n    } catch (error) {\n      reportFsError('walkProjectFiles.realpath', dir, error);\n      continue;\n    }\n    if (visited.has(realDir)) continue;\n    visited.add(realDir);\n\n    let handle: fs.Dir;\n    try {\n      handle = fs.opendirSync(dir);\n    } catch (error) {\n      reportFsError('walkProjectFiles.opendir', dir, error);\n      continue;\n    }\n    try {\n      let entriesRead = 0;\n      let entry: Dirent | null;\n      while ((entry = handle.readSync()) !== null) {\n        if (++entriesRead > MAX_DIR_ENTRIES || filesSeen >= MAX_WALK_FILES) {\n          logToFile(\n            `[bounded-fs] walk capped in ${dir} (entries=${entriesRead}, files=${filesSeen})`,\n          );\n          break;\n        }\n        if (IGNORED_DIRS.has(entry.name)) continue;\n\n        const fullPath = path.join(dir, entry.name);\n\n        // Symlinks report isDirectory()/isFile() as false under withFileTypes,\n        // so resolve the target before deciding how to handle the entry.\n        let isDir = entry.isDirectory();\n        let isFile = entry.isFile();\n        if (entry.isSymbolicLink()) {\n          try {\n            const st = fs.statSync(fullPath);\n            isDir = st.isDirectory();\n            isFile = st.isFile();\n          } catch (error) {\n            reportFsError('walkProjectFiles.stat', fullPath, error);\n            continue;\n          }\n        }\n\n        if (isDir) {\n          if (entry.name.startsWith('.')) continue; // skip hidden directories\n          if (depth < maxDepth) stack.push({ dir: fullPath, depth: depth + 1 });\n        } else if (isFile) {\n          filesSeen += 1;\n          onFile(entry.name, fullPath);\n        }\n      }\n    } finally {\n      try {\n        handle.closeSync();\n      } catch {\n        /* already closed */\n      }\n    }\n  }\n}\n\n/**\n * Read a project file as UTF-8, or null when missing, unreadable, or over\n * `maxBytes` (stat-gated: an oversized file is never materialized).\n */\nexport function readProjectFile(\n  filePath: string,\n  maxBytes = MAX_PROJECT_FILE_BYTES,\n): string | null {\n  try {\n    if (fs.statSync(filePath).size > maxBytes) return null;\n    return fs.readFileSync(filePath, 'utf-8');\n  } catch {\n    return null;\n  }\n}\n\n/**\n * `readProjectFile` that also reports unexpected errors to error tracking.\n * For walk callbacks where a failing read is worth a telemetry breadcrumb.\n */\nexport function safeReadFile(fullPath: string): string | null {\n  try {\n    if (fs.statSync(fullPath).size > MAX_PROJECT_FILE_BYTES) {\n      logToFile(`[bounded-fs] skipped oversized file: ${fullPath}`);\n      return null;\n    }\n    return fs.readFileSync(fullPath, 'utf-8');\n  } catch (error) {\n    reportFsError('safeReadFile', fullPath, error);\n    return null;\n  }\n}\n\n/**\n * The first `bytes` of a file without materializing the rest.\n */\nexport function readFileHead(filePath: string, bytes: number): string | null {\n  try {\n    const fd = fs.openSync(filePath, 'r');\n    try {\n      const buffer = Buffer.alloc(bytes);\n      const read = fs.readSync(fd, buffer, 0, bytes, 0);\n      return buffer.toString('utf-8', 0, read);\n    } finally {\n      fs.closeSync(fd);\n    }\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,MAAM,wBAAwB,IAAI,IAAY;CAC5C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;;;;AASF,SAAS,cAAc,MAAc,UAAkB,OAAsB;CAC3E,MAAM,OAAQ,OAAwC;AACtD,KAAI,QAAQ,sBAAsB,IAAI,KAAK,EAAE;AAC3C,YAAU,wBAAwB,KAAK,IAAI,KAAK,KAAK,WAAW;AAChE;;AAEF,WAAU,iBACR,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD;EAAE;EAAM,MAAM;EAAU,CACzB;;;;;;;AAqBH,MAAa,eAAe,IAAI,IAAY;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;AAGF,MAAa,uBAA0C,CAAC,GAAG,aAAa,CAAC,KACtE,QAAQ,MAAM,IAAI,KACpB;AAGD,MAAa,yBAAyB,IAAI,OAAO;AAMjD,MAAa,mBAAmB;;;;;AAwBhC,eAAsB,YACpB,UACA,SACmB;CACnB,MAAM,QAAQ,QAAQ,SAAA;CACtB,MAAM,SAAS,GAAG,OAAO,UAAU;EACjC,KAAK,QAAQ;EACb,KAAK,QAAQ,OAAO;EACpB,WAAW;EACX,MAAM,QAAQ;EACd,QAAQ,CAAC,GAAG,sBAAsB,GAAI,QAAQ,eAAe,EAAE,CAAE;EACjE,gBAAgB;EAChB,qBAAqB;EACtB,CAAC;CAEF,MAAM,UAAoB,EAAE;AAC5B,QAAO,IAAI,SAAS,YAAY;EAC9B,IAAI,UAAU;EACd,MAAM,eAAqB;AACzB,OAAI,QAAS;AACb,aAAU;AACV,gBAAa,MAAM;AACnB,WAAQ,QAAQ;;EAElB,MAAM,QAAQ,iBAAiB;AAC7B,UAAO,SAAS;AAChB,WAAQ;KACP,iBAAiB;AACpB,SAAO,GAAG,SAAS,UAA2B;AAC5C,WAAQ,KAAK,OAAO,MAAM,CAAC;AAC3B,OAAI,QAAQ,UAAU,OAAO;AAC3B,WAAO,SAAS;AAChB,YAAQ;;IAEV;AACF,SAAO,KAAK,SAAS,OAAO;AAC5B,SAAO,KAAK,OAAO,OAAO;AAC1B,SAAO,KAAK,SAAS,OAAO;GAC5B;;;;;;;;;;AAWJ,SAAgB,iBACd,SACA,QACA,WAAW,GACL;CACN,MAAM,0BAAU,IAAI,KAAa;CACjC,IAAI,YAAY;CAEhB,MAAM,QAA+C,CACnD;EAAE,KAAK;EAAS,OAAO;EAAG,CAC3B;AAED,QAAO,MAAM,SAAS,KAAK,YAAA,KAA4B;EACrD,MAAM,EAAE,KAAK,UAAU,MAAM,KAAK;EAIlC,IAAI;AACJ,MAAI;AACF,aAAU,GAAG,aAAa,IAAI;WACvB,OAAO;AACd,iBAAc,6BAA6B,KAAK,MAAM;AACtD;;AAEF,MAAI,QAAQ,IAAI,QAAQ,CAAE;AAC1B,UAAQ,IAAI,QAAQ;EAEpB,IAAI;AACJ,MAAI;AACF,YAAS,GAAG,YAAY,IAAI;WACrB,OAAO;AACd,iBAAc,4BAA4B,KAAK,MAAM;AACrD;;AAEF,MAAI;GACF,IAAI,cAAc;GAClB,IAAI;AACJ,WAAQ,QAAQ,OAAO,UAAU,MAAM,MAAM;AAC3C,QAAI,EAAE,cAAA,OAAiC,aAAA,KAA6B;AAClE,eACE,+BAA+B,IAAI,YAAY,YAAY,UAAU,UAAU,GAChF;AACD;;AAEF,QAAI,aAAa,IAAI,MAAM,KAAK,CAAE;IAElC,MAAM,WAAW,KAAK,KAAK,KAAK,MAAM,KAAK;IAI3C,IAAI,QAAQ,MAAM,aAAa;IAC/B,IAAI,SAAS,MAAM,QAAQ;AAC3B,QAAI,MAAM,gBAAgB,CACxB,KAAI;KACF,MAAM,KAAK,GAAG,SAAS,SAAS;AAChC,aAAQ,GAAG,aAAa;AACxB,cAAS,GAAG,QAAQ;aACb,OAAO;AACd,mBAAc,yBAAyB,UAAU,MAAM;AACvD;;AAIJ,QAAI,OAAO;AACT,SAAI,MAAM,KAAK,WAAW,IAAI,CAAE;AAChC,SAAI,QAAQ,SAAU,OAAM,KAAK;MAAE,KAAK;MAAU,OAAO,QAAQ;MAAG,CAAC;eAC5D,QAAQ;AACjB,kBAAa;AACb,YAAO,MAAM,MAAM,SAAS;;;YAGxB;AACR,OAAI;AACF,WAAO,WAAW;WACZ;;;;;;;;AAWd,SAAgB,gBACd,UACA,WAAW,wBACI;AACf,KAAI;AACF,MAAI,GAAG,SAAS,SAAS,CAAC,OAAO,SAAU,QAAO;AAClD,SAAO,GAAG,aAAa,UAAU,QAAQ;SACnC;AACN,SAAO;;;;;;;AAQX,SAAgB,aAAa,UAAiC;AAC5D,KAAI;AACF,MAAI,GAAG,SAAS,SAAS,CAAC,OAAA,SAA+B;AACvD,aAAU,wCAAwC,WAAW;AAC7D,UAAO;;AAET,SAAO,GAAG,aAAa,UAAU,QAAQ;UAClC,OAAO;AACd,gBAAc,gBAAgB,UAAU,MAAM;AAC9C,SAAO;;;;;;AAOX,SAAgB,aAAa,UAAkB,OAA8B;AAC3E,KAAI;EACF,MAAM,KAAK,GAAG,SAAS,UAAU,IAAI;AACrC,MAAI;GACF,MAAM,SAAS,OAAO,MAAM,MAAM;GAClC,MAAM,OAAO,GAAG,SAAS,IAAI,QAAQ,GAAG,OAAO,EAAE;AACjD,UAAO,OAAO,SAAS,SAAS,GAAG,KAAK;YAChC;AACR,MAAG,UAAU,GAAG;;SAEZ;AACN,SAAO"}

package/dist/{ci-install-BYThh_Gl.js → ci-install-D1Mum8Ah.js}

@@ -1,6 +1,6 @@
-import { f as getUI, m as LoggingUI, p as setUI } from "./debug-dX5JKcxf.js";
-import { t as provisionNewAccount } from "./provisioning-CJQwMFVo.js";
-import { r as posthogIntegrationConfig } from "./posthog-integration-Dk1hbtRQ.js";
+import { f as getUI, m as LoggingUI, p as setUI } from "./debug-C3ZR1TVF.js";
+import { t as provisionNewAccount } from "./provisioning-T4jtJqBa.js";
+import { r as posthogIntegrationConfig } from "./posthog-integration-pnxhTbxw.js";
 import { c as runWizardCI, s as runWizardHeadless } from "./bin.js";
 //#region src/commands/basic-integration/ci-install.ts
 /**
@@ -110,4 +110,4 @@ async function provisionForSignup(options) {
 //#endregion
 export { runCIInstall, runHeadlessInstall };
 
-//# sourceMappingURL=ci-install-BYThh_Gl.js.map
+//# sourceMappingURL=ci-install-D1Mum8Ah.js.map

package/dist/{ci-install-BYThh_Gl.js.map → ci-install-D1Mum8Ah.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ci-install-BYThh_Gl.js","names":[],"sources":["../src/commands/basic-integration/ci-install.ts"],"sourcesContent":["import type { Arguments } from 'yargs';\nimport { getUI, setUI } from '@ui';\nimport { LoggingUI } from '@ui/logging-ui';\nimport { runWizardCI, runWizardHeadless } from '@lib/runners';\nimport type { NonInteractiveMode } from '@lib/runners';\nimport { provisionNewAccount } from '@utils/provisioning';\nimport { posthogIntegrationConfig } from '@lib/programs/posthog-integration/index';\n\ntype Options = Arguments & {\n  region?: string;\n  baseUrl?: string;\n  installDir?: string;\n  apiKey?: string;\n  signup?: boolean;\n  email?: string;\n  name?: string;\n  projectId?: string;\n};\n\n/**\n * CI-mode install entry point (`--ci`, dev/test builds). Thin shell over the\n * shared non-interactive install — see `runNonInteractiveInstall`.\n */\nexport function runCIInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'ci');\n}\n\n/**\n * Headless install entry point (the experimental published-build run path; see\n * @lib/headless-mode). Thin shell over the shared non-interactive install.\n * Today it behaves exactly like `runCIInstall`; it is a separate function so\n * headless can diverge later (auth, prompts, …) without touching the CI path.\n */\nexport function runHeadlessInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'headless');\n}\n\n/**\n * Non-interactive install shared by CI and headless. Validates signup flags,\n * optionally provisions an account, then installs. `mode` only changes\n * user-facing labels, which api-key prefixes are accepted, and which runner is\n * invoked — the install itself is identical (see runNonInteractive).\n */\nfunction runNonInteractiveInstall(\n  argv: Arguments,\n  mode: NonInteractiveMode,\n): void {\n  const options = { ...argv } as Options;\n  const headless = mode === 'headless';\n  const label = headless ? 'Headless' : 'CI';\n  const runWizard = headless ? runWizardHeadless : runWizardCI;\n\n  // Base validation (region/install-dir/api-key) is owned by the runner.\n  // This layer only adds the signup branch on top.\n  if (!options.apiKey && !options.signup) {\n    const keyHint = headless\n      ? 'personal API key phx_xxx or pha_ OAuth access token'\n      : 'personal API key phx_xxx';\n    return failCI(\n      `${label} mode requires --api-key (${keyHint}). ` +\n        'To create a new account instead, use --signup --email you@example.com.',\n    );\n  }\n  if (!options.apiKey && options.signup && !options.email) {\n    return failCI(\n      `${label} --signup requires --email to create a new account.`,\n    );\n  }\n  warnOnUnexpectedKeyPrefix(options.apiKey, headless);\n\n  void (async () => {\n    if (!options.apiKey && options.signup) {\n      // Fail before the irreversible provisioning step rather than after it.\n      if (!options.installDir) {\n        return failCI(\n          `${label} mode requires --install-dir (directory to install in)`,\n        );\n      }\n      const provisioned = await provisionForSignup(options);\n      options.apiKey = provisioned.personalApiKey;\n      if (options.projectId == null) options.projectId = provisioned.projectId;\n    }\n    runWizard(posthogIntegrationConfig, options);\n  })().catch(() => {\n    process.exit(1);\n  });\n}\n\nfunction failCI(message: string): void {\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  getUI().log.error(message);\n  process.exit(1);\n}\n\n/**\n * Decide whether to warn about an unexpected `--api-key` prefix, and with what\n * message. Returns `null` when the key is acceptable for the mode.\n *\n * This is the one behavioral fork between `--ci` and headless mode: the LLM\n * Gateway accepts a personal API key (`phx_`) in either mode, but in headless\n * a `pha_` OAuth access token is *also* first-class — PostHog mints one under\n * the wizard's own OAuth application for cloud runs and passes it as the\n * api-key. Outside headless that token is unexpected and still warns.\n *\n * Extracted as a pure predicate so the fork can be unit-tested without a UI.\n */\nexport function keyPrefixWarning(\n  apiKey: string | undefined,\n  headless: boolean,\n): string | null {\n  if (!apiKey || apiKey.startsWith('phx_')) return null;\n  if (headless && apiKey.startsWith('pha_')) return null;\n  const prefix = apiKey.slice(0, 4);\n  const hint =\n    prefix === 'pha_'\n      ? ' (pha_ is an OAuth access token — CI mode expects a personal API key)'\n      : prefix === 'phc_'\n      ? ' (phc_ is a project/client key — expected a personal API key)'\n      : '';\n  return `--api-key does not start with \"phx_\"${hint}. Continuing anyway, but the LLM Gateway may reject it with a 401.`;\n}\n\nfunction warnOnUnexpectedKeyPrefix(\n  apiKey: string | undefined,\n  headless: boolean,\n): void {\n  const message = keyPrefixWarning(apiKey, headless);\n  if (!message) return;\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  getUI().log.warn(message);\n}\n\n/**\n * Provision a new account and return its credentials. Throws on any failure\n * (after logging a user-facing message); the caller's `.catch` turns that\n * into a non-zero exit. The return type carries no failure sentinel.\n */\nasync function provisionForSignup(\n  options: Options,\n): Promise<{ personalApiKey: string; projectId: string }> {\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  const signupRegion = ((options.region as string) || 'us').toUpperCase() as\n    | 'US'\n    | 'EU';\n  getUI().log.info(\n    `Provisioning new PostHog account for ${String(\n      options.email,\n    )} in ${signupRegion}...`,\n  );\n\n  let result;\n  try {\n    result = await provisionNewAccount(\n      options.email as string,\n      options.name ?? '',\n      signupRegion,\n      { baseUrl: options.baseUrl },\n    );\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    getUI().log.error(`Provisioning failed: ${msg}`);\n    throw error;\n  }\n\n  if (!result.personalApiKey) {\n    getUI().log.error(\n      'Provisioning succeeded but no personal API key was returned — cannot continue install.',\n    );\n    throw new Error('provisioning returned no personal API key');\n  }\n\n  getUI().log.success('Account ready.');\n  getUI().log.info(`  Project API Key:  ${result.projectApiKey}`);\n  getUI().log.info(`  Personal API Key: ${result.personalApiKey}`);\n  getUI().log.info(`  Host:             ${result.host}`);\n  return {\n    personalApiKey: result.personalApiKey,\n    projectId: result.projectId,\n  };\n}\n"],"mappings":";;;;;;;;;AAuBA,SAAgB,aAAa,MAAuB;AAClD,0BAAyB,MAAM,KAAK;;;;;;;;AAStC,SAAgB,mBAAmB,MAAuB;AACxD,0BAAyB,MAAM,WAAW;;;;;;;;AAS5C,SAAS,yBACP,MACA,MACM;CACN,MAAM,UAAU,EAAE,GAAG,MAAM;CAC3B,MAAM,WAAW,SAAS;CAC1B,MAAM,QAAQ,WAAW,aAAa;CACtC,MAAM,YAAY,WAAW,oBAAoB;AAIjD,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,OAI9B,QAAO,OACL,GAAG,MAAM,4BAJK,WACZ,wDACA,2BAE2C,2EAE9C;AAEH,KAAI,CAAC,QAAQ,UAAU,QAAQ,UAAU,CAAC,QAAQ,MAChD,QAAO,OACL,GAAG,MAAM,qDACV;AAEH,2BAA0B,QAAQ,QAAQ,SAAS;AAEnD,EAAM,YAAY;AAChB,MAAI,CAAC,QAAQ,UAAU,QAAQ,QAAQ;AAErC,OAAI,CAAC,QAAQ,WACX,QAAO,OACL,GAAG,MAAM,wDACV;GAEH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,WAAQ,SAAS,YAAY;AAC7B,OAAI,QAAQ,aAAa,KAAM,SAAQ,YAAY,YAAY;;AAEjE,YAAU,0BAA0B,QAAQ;KAC1C,CAAC,YAAY;AACf,UAAQ,KAAK,EAAE;GACf;;AAGJ,SAAS,OAAO,SAAuB;AACrC,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;AAC/B,QAAO,CAAC,IAAI,MAAM,QAAQ;AAC1B,SAAQ,KAAK,EAAE;;;;;;;;;;;;;;AAejB,SAAgB,iBACd,QACA,UACe;AACf,KAAI,CAAC,UAAU,OAAO,WAAW,OAAO,CAAE,QAAO;AACjD,KAAI,YAAY,OAAO,WAAW,OAAO,CAAE,QAAO;CAClD,MAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AAOjC,QAAO,uCALL,WAAW,SACP,0EACA,WAAW,SACX,kEACA,GAC6C;;AAGrD,SAAS,0BACP,QACA,UACM;CACN,MAAM,UAAU,iBAAiB,QAAQ,SAAS;AAClD,KAAI,CAAC,QAAS;AACd,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;AAC/B,QAAO,CAAC,IAAI,KAAK,QAAQ;;;;;;;AAQ3B,eAAe,mBACb,SACwD;AACxD,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;CAC/B,MAAM,gBAAiB,QAAQ,UAAqB,MAAM,aAAa;AAGvE,QAAO,CAAC,IAAI,KACV,wCAAwC,OACtC,QAAQ,MACT,CAAC,MAAM,aAAa,KACtB;CAED,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,oBACb,QAAQ,OACR,QAAQ,QAAQ,IAChB,cACA,EAAE,SAAS,QAAQ,SAAS,CAC7B;UACM,OAAO;EACd,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAClE,SAAO,CAAC,IAAI,MAAM,wBAAwB,MAAM;AAChD,QAAM;;AAGR,KAAI,CAAC,OAAO,gBAAgB;AAC1B,SAAO,CAAC,IAAI,MACV,yFACD;AACD,QAAM,IAAI,MAAM,4CAA4C;;AAG9D,QAAO,CAAC,IAAI,QAAQ,iBAAiB;AACrC,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,gBAAgB;AAC/D,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,iBAAiB;AAChE,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,OAAO;AACtD,QAAO;EACL,gBAAgB,OAAO;EACvB,WAAW,OAAO;EACnB"}
+{"version":3,"file":"ci-install-D1Mum8Ah.js","names":[],"sources":["../src/commands/basic-integration/ci-install.ts"],"sourcesContent":["import type { Arguments } from 'yargs';\nimport { getUI, setUI } from '@ui';\nimport { LoggingUI } from '@ui/logging-ui';\nimport { runWizardCI, runWizardHeadless } from '@lib/runners';\nimport type { NonInteractiveMode } from '@lib/runners';\nimport { provisionNewAccount } from '@utils/provisioning';\nimport { posthogIntegrationConfig } from '@lib/programs/posthog-integration/index';\n\ntype Options = Arguments & {\n  region?: string;\n  baseUrl?: string;\n  installDir?: string;\n  apiKey?: string;\n  signup?: boolean;\n  email?: string;\n  name?: string;\n  projectId?: string;\n};\n\n/**\n * CI-mode install entry point (`--ci`, dev/test builds). Thin shell over the\n * shared non-interactive install — see `runNonInteractiveInstall`.\n */\nexport function runCIInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'ci');\n}\n\n/**\n * Headless install entry point (the experimental published-build run path; see\n * @lib/headless-mode). Thin shell over the shared non-interactive install.\n * Today it behaves exactly like `runCIInstall`; it is a separate function so\n * headless can diverge later (auth, prompts, …) without touching the CI path.\n */\nexport function runHeadlessInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'headless');\n}\n\n/**\n * Non-interactive install shared by CI and headless. Validates signup flags,\n * optionally provisions an account, then installs. `mode` only changes\n * user-facing labels, which api-key prefixes are accepted, and which runner is\n * invoked — the install itself is identical (see runNonInteractive).\n */\nfunction runNonInteractiveInstall(\n  argv: Arguments,\n  mode: NonInteractiveMode,\n): void {\n  const options = { ...argv } as Options;\n  const headless = mode === 'headless';\n  const label = headless ? 'Headless' : 'CI';\n  const runWizard = headless ? runWizardHeadless : runWizardCI;\n\n  // Base validation (region/install-dir/api-key) is owned by the runner.\n  // This layer only adds the signup branch on top.\n  if (!options.apiKey && !options.signup) {\n    const keyHint = headless\n      ? 'personal API key phx_xxx or pha_ OAuth access token'\n      : 'personal API key phx_xxx';\n    return failCI(\n      `${label} mode requires --api-key (${keyHint}). ` +\n        'To create a new account instead, use --signup --email you@example.com.',\n    );\n  }\n  if (!options.apiKey && options.signup && !options.email) {\n    return failCI(\n      `${label} --signup requires --email to create a new account.`,\n    );\n  }\n  warnOnUnexpectedKeyPrefix(options.apiKey, headless);\n\n  void (async () => {\n    if (!options.apiKey && options.signup) {\n      // Fail before the irreversible provisioning step rather than after it.\n      if (!options.installDir) {\n        return failCI(\n          `${label} mode requires --install-dir (directory to install in)`,\n        );\n      }\n      const provisioned = await provisionForSignup(options);\n      options.apiKey = provisioned.personalApiKey;\n      if (options.projectId == null) options.projectId = provisioned.projectId;\n    }\n    runWizard(posthogIntegrationConfig, options);\n  })().catch(() => {\n    process.exit(1);\n  });\n}\n\nfunction failCI(message: string): void {\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  getUI().log.error(message);\n  process.exit(1);\n}\n\n/**\n * Decide whether to warn about an unexpected `--api-key` prefix, and with what\n * message. Returns `null` when the key is acceptable for the mode.\n *\n * This is the one behavioral fork between `--ci` and headless mode: the LLM\n * Gateway accepts a personal API key (`phx_`) in either mode, but in headless\n * a `pha_` OAuth access token is *also* first-class — PostHog mints one under\n * the wizard's own OAuth application for cloud runs and passes it as the\n * api-key. Outside headless that token is unexpected and still warns.\n *\n * Extracted as a pure predicate so the fork can be unit-tested without a UI.\n */\nexport function keyPrefixWarning(\n  apiKey: string | undefined,\n  headless: boolean,\n): string | null {\n  if (!apiKey || apiKey.startsWith('phx_')) return null;\n  if (headless && apiKey.startsWith('pha_')) return null;\n  const prefix = apiKey.slice(0, 4);\n  const hint =\n    prefix === 'pha_'\n      ? ' (pha_ is an OAuth access token — CI mode expects a personal API key)'\n      : prefix === 'phc_'\n      ? ' (phc_ is a project/client key — expected a personal API key)'\n      : '';\n  return `--api-key does not start with \"phx_\"${hint}. Continuing anyway, but the LLM Gateway may reject it with a 401.`;\n}\n\nfunction warnOnUnexpectedKeyPrefix(\n  apiKey: string | undefined,\n  headless: boolean,\n): void {\n  const message = keyPrefixWarning(apiKey, headless);\n  if (!message) return;\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  getUI().log.warn(message);\n}\n\n/**\n * Provision a new account and return its credentials. Throws on any failure\n * (after logging a user-facing message); the caller's `.catch` turns that\n * into a non-zero exit. The return type carries no failure sentinel.\n */\nasync function provisionForSignup(\n  options: Options,\n): Promise<{ personalApiKey: string; projectId: string }> {\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  const signupRegion = ((options.region as string) || 'us').toUpperCase() as\n    | 'US'\n    | 'EU';\n  getUI().log.info(\n    `Provisioning new PostHog account for ${String(\n      options.email,\n    )} in ${signupRegion}...`,\n  );\n\n  let result;\n  try {\n    result = await provisionNewAccount(\n      options.email as string,\n      options.name ?? '',\n      signupRegion,\n      { baseUrl: options.baseUrl },\n    );\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    getUI().log.error(`Provisioning failed: ${msg}`);\n    throw error;\n  }\n\n  if (!result.personalApiKey) {\n    getUI().log.error(\n      'Provisioning succeeded but no personal API key was returned — cannot continue install.',\n    );\n    throw new Error('provisioning returned no personal API key');\n  }\n\n  getUI().log.success('Account ready.');\n  getUI().log.info(`  Project API Key:  ${result.projectApiKey}`);\n  getUI().log.info(`  Personal API Key: ${result.personalApiKey}`);\n  getUI().log.info(`  Host:             ${result.host}`);\n  return {\n    personalApiKey: result.personalApiKey,\n    projectId: result.projectId,\n  };\n}\n"],"mappings":";;;;;;;;;AAuBA,SAAgB,aAAa,MAAuB;AAClD,0BAAyB,MAAM,KAAK;;;;;;;;AAStC,SAAgB,mBAAmB,MAAuB;AACxD,0BAAyB,MAAM,WAAW;;;;;;;;AAS5C,SAAS,yBACP,MACA,MACM;CACN,MAAM,UAAU,EAAE,GAAG,MAAM;CAC3B,MAAM,WAAW,SAAS;CAC1B,MAAM,QAAQ,WAAW,aAAa;CACtC,MAAM,YAAY,WAAW,oBAAoB;AAIjD,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,OAI9B,QAAO,OACL,GAAG,MAAM,4BAJK,WACZ,wDACA,2BAE2C,2EAE9C;AAEH,KAAI,CAAC,QAAQ,UAAU,QAAQ,UAAU,CAAC,QAAQ,MAChD,QAAO,OACL,GAAG,MAAM,qDACV;AAEH,2BAA0B,QAAQ,QAAQ,SAAS;AAEnD,EAAM,YAAY;AAChB,MAAI,CAAC,QAAQ,UAAU,QAAQ,QAAQ;AAErC,OAAI,CAAC,QAAQ,WACX,QAAO,OACL,GAAG,MAAM,wDACV;GAEH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,WAAQ,SAAS,YAAY;AAC7B,OAAI,QAAQ,aAAa,KAAM,SAAQ,YAAY,YAAY;;AAEjE,YAAU,0BAA0B,QAAQ;KAC1C,CAAC,YAAY;AACf,UAAQ,KAAK,EAAE;GACf;;AAGJ,SAAS,OAAO,SAAuB;AACrC,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;AAC/B,QAAO,CAAC,IAAI,MAAM,QAAQ;AAC1B,SAAQ,KAAK,EAAE;;;;;;;;;;;;;;AAejB,SAAgB,iBACd,QACA,UACe;AACf,KAAI,CAAC,UAAU,OAAO,WAAW,OAAO,CAAE,QAAO;AACjD,KAAI,YAAY,OAAO,WAAW,OAAO,CAAE,QAAO;CAClD,MAAM,SAAS,OAAO,MAAM,GAAG,EAAE;AAOjC,QAAO,uCALL,WAAW,SACP,0EACA,WAAW,SACX,kEACA,GAC6C;;AAGrD,SAAS,0BACP,QACA,UACM;CACN,MAAM,UAAU,iBAAiB,QAAQ,SAAS;AAClD,KAAI,CAAC,QAAS;AACd,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;AAC/B,QAAO,CAAC,IAAI,KAAK,QAAQ;;;;;;;AAQ3B,eAAe,mBACb,SACwD;AACxD,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;CAC/B,MAAM,gBAAiB,QAAQ,UAAqB,MAAM,aAAa;AAGvE,QAAO,CAAC,IAAI,KACV,wCAAwC,OACtC,QAAQ,MACT,CAAC,MAAM,aAAa,KACtB;CAED,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,oBACb,QAAQ,OACR,QAAQ,QAAQ,IAChB,cACA,EAAE,SAAS,QAAQ,SAAS,CAC7B;UACM,OAAO;EACd,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAClE,SAAO,CAAC,IAAI,MAAM,wBAAwB,MAAM;AAChD,QAAM;;AAGR,KAAI,CAAC,OAAO,gBAAgB;AAC1B,SAAO,CAAC,IAAI,MACV,yFACD;AACD,QAAM,IAAI,MAAM,4CAA4C;;AAG9D,QAAO,CAAC,IAAI,QAAQ,iBAAiB;AACrC,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,gBAAgB;AAC/D,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,iBAAiB;AAChE,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,OAAO;AACtD,QAAO;EACL,gBAAgB,OAAO;EACvB,WAAW,OAAO;EACnB"}

package/dist/commandments-BagyrYRW.js

@@ -0,0 +1,2 @@
+import { t as getWizardCommandments } from "./commandments-DiMtIz1o.js";
+export { getWizardCommandments };

package/dist/{commandments-DSNrOeOC.js → commandments-DiMtIz1o.js}

@@ -39,4 +39,4 @@ function getWizardCommandments() {
 //#endregion
 export { getWizardCommandments as t };
 
-//# sourceMappingURL=commandments-DSNrOeOC.js.map
+//# sourceMappingURL=commandments-DiMtIz1o.js.map

package/dist/{commandments-DSNrOeOC.js.map → commandments-DiMtIz1o.js.map}

@@ -1 +1 @@
-{"version":3,"file":"commandments-DSNrOeOC.js","names":[],"sources":["../src/lib/agent/commandments.ts"],"sourcesContent":["/**\n * Wizard-wide commandments that are always appended as a system prompt.\n *\n * Keep this as a simple string so it can be inlined into the compiled bundle\n * without extra files, copying, or runtime I/O.\n */\nconst WIZARD_COMMANDMENTS = [\n  'Never hallucinate a PostHog project token, host, or any other secret. Always use the real values that have been configured for this project (for example via environment variables).',\n\n  'Never substitute an empty string or placeholder for the project token when its source is missing — an empty key silently disables analytics with no error. The token is a public client-side key: read it from the environment or config, and where a build genuinely has no environment to read from (e.g. iOS/Android release and archive builds), embed the real token so a value always ships — never an empty one.',\n\n  'Never write API keys, access tokens, or other secrets directly into source code. Always reference environment variables instead, and rely on the wizard-tools MCP server (check_env_keys / set_env_values) to create or update .env files.',\n\n  'Always use the detect_package_manager tool from the wizard-tools MCP server to determine the package manager. Do not guess based on lockfiles or hard-code npm, yarn, pnpm, bun, pip, etc.',\n\n  'Before writing to any file, you MUST read that exact file immediately beforehand using the Read tool, even if you have already read it earlier in the run. This avoids tool failures and stale edits.',\n\n  'Treat feature flags, custom properties, and event names as part of an analytics contract. Prefer reusing existing names and patterns in the project. When you must introduce new ones, make them clear, descriptive, and consistent with existing conventions, and avoid scattering the same flag or property across many unrelated callsites.',\n\n  'Keep PostHog data capture at its defaults unless the user explicitly asks otherwise. Do not disable autocapture, do not disable session recording, and never set opt_out_capturing (or opted_out) to true in the SDK init config — these turn off data the user almost always wants. Note: posthog.opt_out_capturing() called at runtime for GDPR consent flows is legitimate; the rule is about the init configuration.',\n\n  \"Never put personally identifiable information — emails, full or partial names, phone numbers, physical or IP addresses, or other user-entered PII — in capture() event properties. PII belongs on the PERSON: send it via identify()/$set (or the SDK's person-property API), and capture events with a stable distinct id derived from the authenticated user or session, never a raw email or name. This holds for every SDK, client and server.\",\n\n  'Prefer minimal, targeted edits that achieve the requested behavior while preserving existing structure and style. Avoid large refactors, broad reformatting, or unrelated changes unless explicitly requested.',\n\n  'When you change a file that already exists, edit it in place. If an edit fails because the text you are matching is not unique, add just enough surrounding context to make it unique, or apply the change to each occurrence — never fall back to rewriting the whole file. Write a file in full only when you are creating it, never to modify one that already exists.',\n\n  'Before you overwrite or delete anything that already exists, look at what you would remove. This integration only adds instrumentation, so keep every part of the project unrelated to PostHog exactly as it was — never drop existing code, comments, or markup to make room for a change.',\n\n  'Do not spawn subagents unless explicitly instructed to do so.',\n\n  'Create tasks as soon as you understand the work you are going to carry out. Break the list into distinct stages of work that the user can follow through. Create all tasks in a single tool call, in the order you will be performing them. Drive the work with TaskUpdate: status in_progress when you begin a task, completed when done.',\n\n  'Keep task titles broad and stage-oriented — describe the purpose or area of work, not the specific files, paths, or symbols involved. Do not name individual files, modules, or directories inside task titles, and do not include illustrative examples within a task title.',\n\n  'Do not assume \"PostHog provider\" or \"PostHogProvider\" in task labels, status messages, or code. Only use a provider if the skill workflow explicitly requires one for the specific framework.',\n\n  'If you see a [YARA WARNING] or [YARA VIOLATION] message, handle it silently. Fix the issue (revert the write, avoid the flagged pattern) without mentioning security warnings or YARA to the user. These are internal guardrails, not user-facing alerts. Never show scary security language to the user.',\n\n  // wizard_ask Path A — translate prose question lists into a single tool call.\n  // The skill prose is intentionally underspecified; this commandment carries\n  // most of the discipline. Tightening: prefer adding rules here over editing\n  // individual skill markdown.\n  [\n    'When a skill instructs you to gather information from the user, use the `wizard_ask` MCP tool from the wizard-tools server. Never inline questions in your text output expecting a reply — the user has no way to answer text.',\n    'When a skill provides a numbered or bulleted list of questions, translate the entire list into a single `wizard_ask` tool call:',\n    '  - One tool call per skill step. Batch every question from that step into the `questions` array — never split into multiple calls.',\n    '  - Infer `kind` from the question phrasing: comma-separated alternatives (\"React, Vue, or vanilla JS?\") → `single`; phrasing like \"all that apply\" or \"any of\" → `multi`; everything else → `text`.',\n    '  - For `single` and `multi`, extract the alternatives from the prose into `options` as `{ label, value }` pairs. Use the human phrase as `label` and a lowercase-hyphenated form as `value` (e.g., `label: \"Vanilla JS\"`, `value: \"vanilla-js\"`).',\n    '  - Use a kebab-case slug of the question label as `id` (e.g., \"Tech stack\" → `tech-stack`, \"Show frequency\" → `show-frequency`).',\n    '  - Do not invent fields the schema does not define (no `source`, `category`, `priority`, etc.) — the tool rejects unknown fields and the wizard already knows which skill is running.',\n    'After `wizard_ask` returns, use the answers directly — do not re-ask in text or call `wizard_ask` again for the same fields.',\n  ].join('\\n'),\n].join('\\n');\n\nexport function getWizardCommandments(): string {\n  return WIZARD_COMMANDMENTS;\n}\n"],"mappings":";;;;;;;AAMA,MAAM,sBAAsB;CAC1B;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAMA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK;CACb,CAAC,KAAK,KAAK;AAEZ,SAAgB,wBAAgC;AAC9C,QAAO"}
+{"version":3,"file":"commandments-DiMtIz1o.js","names":[],"sources":["../src/lib/agent/commandments.ts"],"sourcesContent":["/**\n * Wizard-wide commandments that are always appended as a system prompt.\n *\n * Keep this as a simple string so it can be inlined into the compiled bundle\n * without extra files, copying, or runtime I/O.\n */\nconst WIZARD_COMMANDMENTS = [\n  'Never hallucinate a PostHog project token, host, or any other secret. Always use the real values that have been configured for this project (for example via environment variables).',\n\n  'Never substitute an empty string or placeholder for the project token when its source is missing — an empty key silently disables analytics with no error. The token is a public client-side key: read it from the environment or config, and where a build genuinely has no environment to read from (e.g. iOS/Android release and archive builds), embed the real token so a value always ships — never an empty one.',\n\n  'Never write API keys, access tokens, or other secrets directly into source code. Always reference environment variables instead, and rely on the wizard-tools MCP server (check_env_keys / set_env_values) to create or update .env files.',\n\n  'Always use the detect_package_manager tool from the wizard-tools MCP server to determine the package manager. Do not guess based on lockfiles or hard-code npm, yarn, pnpm, bun, pip, etc.',\n\n  'Before writing to any file, you MUST read that exact file immediately beforehand using the Read tool, even if you have already read it earlier in the run. This avoids tool failures and stale edits.',\n\n  'Treat feature flags, custom properties, and event names as part of an analytics contract. Prefer reusing existing names and patterns in the project. When you must introduce new ones, make them clear, descriptive, and consistent with existing conventions, and avoid scattering the same flag or property across many unrelated callsites.',\n\n  'Keep PostHog data capture at its defaults unless the user explicitly asks otherwise. Do not disable autocapture, do not disable session recording, and never set opt_out_capturing (or opted_out) to true in the SDK init config — these turn off data the user almost always wants. Note: posthog.opt_out_capturing() called at runtime for GDPR consent flows is legitimate; the rule is about the init configuration.',\n\n  \"Never put personally identifiable information — emails, full or partial names, phone numbers, physical or IP addresses, or other user-entered PII — in capture() event properties. PII belongs on the PERSON: send it via identify()/$set (or the SDK's person-property API), and capture events with a stable distinct id derived from the authenticated user or session, never a raw email or name. This holds for every SDK, client and server.\",\n\n  'Prefer minimal, targeted edits that achieve the requested behavior while preserving existing structure and style. Avoid large refactors, broad reformatting, or unrelated changes unless explicitly requested.',\n\n  'When you change a file that already exists, edit it in place. If an edit fails because the text you are matching is not unique, add just enough surrounding context to make it unique, or apply the change to each occurrence — never fall back to rewriting the whole file. Write a file in full only when you are creating it, never to modify one that already exists.',\n\n  'Before you overwrite or delete anything that already exists, look at what you would remove. This integration only adds instrumentation, so keep every part of the project unrelated to PostHog exactly as it was — never drop existing code, comments, or markup to make room for a change.',\n\n  'Do not spawn subagents unless explicitly instructed to do so.',\n\n  'Create tasks as soon as you understand the work you are going to carry out. Break the list into distinct stages of work that the user can follow through. Create all tasks in a single tool call, in the order you will be performing them. Drive the work with TaskUpdate: status in_progress when you begin a task, completed when done.',\n\n  'Keep task titles broad and stage-oriented — describe the purpose or area of work, not the specific files, paths, or symbols involved. Do not name individual files, modules, or directories inside task titles, and do not include illustrative examples within a task title.',\n\n  'Do not assume \"PostHog provider\" or \"PostHogProvider\" in task labels, status messages, or code. Only use a provider if the skill workflow explicitly requires one for the specific framework.',\n\n  'If you see a [YARA WARNING] or [YARA VIOLATION] message, handle it silently. Fix the issue (revert the write, avoid the flagged pattern) without mentioning security warnings or YARA to the user. These are internal guardrails, not user-facing alerts. Never show scary security language to the user.',\n\n  // wizard_ask Path A — translate prose question lists into a single tool call.\n  // The skill prose is intentionally underspecified; this commandment carries\n  // most of the discipline. Tightening: prefer adding rules here over editing\n  // individual skill markdown.\n  [\n    'When a skill instructs you to gather information from the user, use the `wizard_ask` MCP tool from the wizard-tools server. Never inline questions in your text output expecting a reply — the user has no way to answer text.',\n    'When a skill provides a numbered or bulleted list of questions, translate the entire list into a single `wizard_ask` tool call:',\n    '  - One tool call per skill step. Batch every question from that step into the `questions` array — never split into multiple calls.',\n    '  - Infer `kind` from the question phrasing: comma-separated alternatives (\"React, Vue, or vanilla JS?\") → `single`; phrasing like \"all that apply\" or \"any of\" → `multi`; everything else → `text`.',\n    '  - For `single` and `multi`, extract the alternatives from the prose into `options` as `{ label, value }` pairs. Use the human phrase as `label` and a lowercase-hyphenated form as `value` (e.g., `label: \"Vanilla JS\"`, `value: \"vanilla-js\"`).',\n    '  - Use a kebab-case slug of the question label as `id` (e.g., \"Tech stack\" → `tech-stack`, \"Show frequency\" → `show-frequency`).',\n    '  - Do not invent fields the schema does not define (no `source`, `category`, `priority`, etc.) — the tool rejects unknown fields and the wizard already knows which skill is running.',\n    'After `wizard_ask` returns, use the answers directly — do not re-ask in text or call `wizard_ask` again for the same fields.',\n  ].join('\\n'),\n].join('\\n');\n\nexport function getWizardCommandments(): string {\n  return WIZARD_COMMANDMENTS;\n}\n"],"mappings":";;;;;;;AAMA,MAAM,sBAAsB;CAC1B;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAEA;CAMA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK;CACb,CAAC,KAAK,KAAK;AAEZ,SAAgB,wBAAgC;AAC9C,QAAO"}

package/dist/{debug-dX5JKcxf.js → debug-C3ZR1TVF.js}

@@ -61,7 +61,7 @@ function runtimeEnv(key) {
 }
 //#endregion
 //#region src/lib/version.ts
-const VERSION = "2.50.0";
+const VERSION = "2.52.0";
 //#endregion
 //#region src/lib/constants.ts
 /**
@@ -72,7 +72,7 @@ const VERSION = "2.50.0";
 * LLM gateway's Bedrock fallback can match map_to_bedrock_model().
 */
 const DEFAULT_AGENT_MODEL = "claude-sonnet-4-6";
-/** Next sonnet generation. A `wizard-pi-model` option for pi-vs-anthropic parity. */
+/** Next sonnet generation (a `MODEL_FLAG_VARIANTS` key in the switchboard). */
 const SONNET_5_MODEL = "claude-sonnet-5";
 /**
 * Cheaper, faster model for mechanical agent work (e.g. repo classification
@@ -84,24 +84,9 @@ const HAIKU_MODEL = "claude-haiku-4-5-20251001";
 * from `PROGRAM_BINDINGS[id].model` or `contextMillOverride`.
 */
 const OPUS_MODEL = "claude-opus-4-8";
-/**
-* OpenAI-class peer of sonnet, served by the LLM gateway over OpenAI
-* completions. Enables cross-provider A/B without a wizard release.
-*/
-const GPT5_MODEL = "openai/gpt-5";
-/** Newer sonnet-class openai flagship (list: $2.50/$15 per MTok). */
-const GPT5_4_MODEL = "openai/gpt-5.4";
-/**
-* Smaller, faster, cheaper openai reasoning model. The pi runner is paired with
-* this (a reasoning model follows the integration skill; the mini tier keeps a
-* run to a few minutes where flagship gpt-5 takes far longer). Reasoning effort
-* is set per-model in the switchboard capability matrix.
-*/
-const GPT5_MINI_MODEL = "openai/gpt-5-mini";
 const GPT5_6_LUNA_MODEL = "openai/gpt-5.6-luna";
 const GPT5_6_TERRA_MODEL = "openai/gpt-5.6-terra";
 const GPT5_6_SOL_MODEL = "openai/gpt-5.6-sol";
-const GPT5_5_MODEL = "openai/gpt-5.5";
 /**
 * The two agent runner routing axes: **harness** (which agent SDK drives the LLM)
 * and **sequence** (which pipeline shape orchestrates the work). Single source
@@ -264,18 +249,18 @@ const WIZARD_INTERACTION_EVENT_NAME = "wizard interaction";
 const WIZARD_REMARK_EVENT_NAME = "wizard remark";
 /** Boolean feature flag that routes a run to the experimental orchestrator runner. */
 const WIZARD_ORCHESTRATOR_FLAG_KEY = "wizard-orchestrator";
-/** Boolean flag: on → pi harness + the pi model pairing; off/missing → binding default. */
-const WIZARD_USE_PI_HARNESS_FLAG_KEY = "wizard-use-pi-harness";
-/** Multivariate flag: pi's model. Variant keys map to gateway ids in `PI_MODEL_FLAG_VARIANTS`. */
-const WIZARD_PI_MODEL_FLAG_KEY = "wizard-pi-model";
-/** Multivariate flag: reasoning-effort override for pi models (minimal/low/medium/high/xhigh). */
-const WIZARD_PI_EFFORT_FLAG_KEY = "wizard-pi-effort";
-/** Boolean flag: on → pi for self-driving. Payload carries `{model, effort?, harness?, sequence?}` (model = wizard-pi-model variant key); missing/invalid payload keeps the non-flagged default. */
+/** Multivariate flag: per-stage orchestrator overrides ride each variant's JSON payload (`{stage: {model?, effort?}}`). */
+const WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY = "wizard-orchestrator-override";
+/** Boolean flag: on → pi for self-driving. Payload carries `{model, effort?, harness?, sequence?}` (model = a `MODEL_FLAG_VARIANTS` key); missing/invalid payload keeps the non-flagged default. */
 const WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY = "wizard-self-driving-use-pi-harness";
-/** Feature flag key that gates the intro-screen "Tools" menu. */
-const WIZARD_TOOLS_MENU_FLAG_KEY = "wizard-tools-menu";
 /** Boolean flag: agentic project scoping for non-interactive basic-integration runs. */
 const WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY = "wizard-basic-integration-agentic-detection";
+const WIZARD_FLAG_KEYS = [
+	WIZARD_ORCHESTRATOR_FLAG_KEY,
+	WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY,
+	WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY,
+	WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY
+];
 /** User-Agent for wizard HTTP requests and MCP server identification. */
 const WIZARD_USER_AGENT = `posthog/wizard; version: ${VERSION}`;
 /**
@@ -984,7 +969,7 @@ let reportedLogFailure = false;
 function reportLogFailureOnce(err) {
 	if (reportedLogFailure) return;
 	reportedLogFailure = true;
-	import("./analytics-C7QE7PWl.js").then(({ analytics }) => analytics.captureException(err instanceof Error ? err : new Error(String(err)), {
+	import("./analytics-D2xds3nw.js").then(({ analytics }) => analytics.captureException(err instanceof Error ? err : new Error(String(err)), {
 		source: "log-file-write",
 		log_path: logFilePath,
 		platform: process.platform
@@ -1028,6 +1013,6 @@ function enableDebugLogs() {
 	consoleLoggingEnabled = true;
 }
 //#endregion
-export { POSTHOG_STATUS_PAGE_URL as $, GPT5_4_MODEL as A, Integration as B, ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY as C, runtimeEnv as Ct, DEFAULT_AGENT_MODEL as D, CONTEXT_MILL_URL as E, regionOption as Et, GPT5_MINI_MODEL as F, POSTHOG_DEV_CLIENT_ID as G, OAUTH_TIMEOUT_MS as H, GPT5_MODEL as I, POSTHOG_FLAG_HEADER_PREFIX as J, POSTHOG_DOCS_URL as K, HAIKU_MODEL as L, GPT5_6_LUNA_MODEL as M, GPT5_6_SOL_MODEL as N, DETECTION_TIMEOUT_MS as O, GPT5_6_TERRA_MODEL as P, POSTHOG_PROXY_CLIENT_ID as Q, Harness as R, ANALYTICS_HOST_URL as S, RUN_SURFACE as St, CONTEXT_MILL_RELEASES_URL as T, isHeadless as Tt, OPUS_MODEL as U, OAUTH_PORTS as V, POSTHOG_APP_URL as W, POSTHOG_PRIVACY_URL as X, POSTHOG_ORG_AI_SETTINGS_URL as Y, POSTHOG_PROPERTY_HEADER_PREFIX as Z, evaluateWizardReadiness as _, WIZARD_USE_PI_HARNESS_FLAG_KEY as _t, getLogFilePath as a, WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY as at, isTaskStatus as b, VERSION as bt, WIZARD_BENCHMARK_FILE as c, WIZARD_OAUTH_SCOPES as ct, relativeToInstallDir as d, WIZARD_PI_MODEL_FLAG_KEY as dt, POSTHOG_TERMS_URL as et, getUI as f, WIZARD_PROVISIONING_SCOPES as ft, SIGNUP_WIZARD_READINESS_CONFIG as g, WIZARD_USER_AGENT as gt, SERVICE_LABELS as h, WIZARD_TOOLS_MENU_FLAG_KEY as ht, enableDebugLogs as i, Sequence as it, GPT5_5_MODEL as j, DUMMY_PROJECT_API_KEY as k, WIZARD_LOG_FILE as l, WIZARD_ORCHESTRATOR_FLAG_KEY as lt, LoggingUI as m, WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY as mt, configureLogFileFromEnvironment as n, REMOTE_SKILLS_BASE_URL as nt, initLogFile as o, WIZARD_CONTACT_EMAIL as ot, setUI as p, WIZARD_REMARK_EVENT_NAME as pt, POSTHOG_EU_CLIENT_ID as q, debug as r, SONNET_5_MODEL as rt, logToFile as s, WIZARD_INTERACTION_EVENT_NAME as st, configureLogFile as t, POSTHOG_US_CLIENT_ID as tt, WIZARD_YARA_REPORT_FILE as u, WIZARD_PI_EFFORT_FLAG_KEY as ut, getBlockingServiceKeys as v, getSkillsBaseUrl as vt, ANALYTICS_TEAM_TAG as w, headlessOption as wt, AGENTIC_DETECTION_TIMEOUT_MS as x, NODE_ENV as xt, TaskStatus as y, wizardUserAgentForProgram as yt, ISSUES_URL as z };
+export { SONNET_5_MODEL as $, GPT5_6_LUNA_MODEL as A, POSTHOG_APP_URL as B, ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY as C, DEFAULT_AGENT_MODEL as D, CONTEXT_MILL_URL as E, ISSUES_URL as F, POSTHOG_ORG_AI_SETTINGS_URL as G, POSTHOG_DOCS_URL as H, Integration as I, POSTHOG_PROXY_CLIENT_ID as J, POSTHOG_PRIVACY_URL as K, OAUTH_PORTS as L, GPT5_6_TERRA_MODEL as M, HAIKU_MODEL as N, DETECTION_TIMEOUT_MS as O, Harness as P, REMOTE_SKILLS_BASE_URL as Q, OAUTH_TIMEOUT_MS as R, ANALYTICS_HOST_URL as S, CONTEXT_MILL_RELEASES_URL as T, POSTHOG_EU_CLIENT_ID as U, POSTHOG_DEV_CLIENT_ID as V, POSTHOG_FLAG_HEADER_PREFIX as W, POSTHOG_TERMS_URL as X, POSTHOG_STATUS_PAGE_URL as Y, POSTHOG_US_CLIENT_ID as Z, evaluateWizardReadiness as _, runtimeEnv as _t, getLogFilePath as a, WIZARD_OAUTH_SCOPES as at, isTaskStatus as b, regionOption as bt, WIZARD_BENCHMARK_FILE as c, WIZARD_PROVISIONING_SCOPES as ct, relativeToInstallDir as d, WIZARD_USER_AGENT as dt, Sequence as et, getUI as f, getSkillsBaseUrl as ft, SIGNUP_WIZARD_READINESS_CONFIG as g, RUN_SURFACE as gt, SERVICE_LABELS as h, NODE_ENV as ht, enableDebugLogs as i, WIZARD_INTERACTION_EVENT_NAME as it, GPT5_6_SOL_MODEL as j, DUMMY_PROJECT_API_KEY as k, WIZARD_LOG_FILE as l, WIZARD_REMARK_EVENT_NAME as lt, LoggingUI as m, VERSION as mt, configureLogFileFromEnvironment as n, WIZARD_CONTACT_EMAIL as nt, initLogFile as o, WIZARD_ORCHESTRATOR_FLAG_KEY as ot, setUI as p, wizardUserAgentForProgram as pt, POSTHOG_PROPERTY_HEADER_PREFIX as q, debug as r, WIZARD_FLAG_KEYS as rt, logToFile as s, WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY as st, configureLogFile as t, WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY as tt, WIZARD_YARA_REPORT_FILE as u, WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY as ut, getBlockingServiceKeys as v, headlessOption as vt, ANALYTICS_TEAM_TAG as w, AGENTIC_DETECTION_TIMEOUT_MS as x, TaskStatus as y, isHeadless as yt, OPUS_MODEL as z };
 
-//# sourceMappingURL=debug-dX5JKcxf.js.map
+//# sourceMappingURL=debug-C3ZR1TVF.js.map