@posthog/wizard 2.74.0 → 2.75.0

package/dist/{bounded-fs-CErPpkN2.js → bounded-fs-D85Tk3nS.js}

@@ -1,5 +1,5 @@
-import { s as logToFile } from "./debug-ECdmmlDM.js";
-import { n as analytics } from "./analytics-DZNb3aRN.js";
+import { s as logToFile } from "./debug-DUmMVUHn.js";
+import { n as analytics } from "./analytics-DSK0GXg1.js";
 import fs from "fs";
 import path from "path";
 import fg from "fast-glob";
@@ -239,4 +239,4 @@ function readFileHead(filePath, bytes) {
 //#endregion
 export { safeReadFile as a, readProjectFile as i, boundedGlob as n, walkProjectFiles as o, readFileHead as r, IGNORED_DIRS as t };
 
-//# sourceMappingURL=bounded-fs-CErPpkN2.js.map
+//# sourceMappingURL=bounded-fs-D85Tk3nS.js.map

package/dist/{bounded-fs-CErPpkN2.js.map → bounded-fs-D85Tk3nS.js.map}

@@ -1 +1 @@
-{"version":3,"file":"bounded-fs-CErPpkN2.js","names":[],"sources":["../src/utils/bounded-fs.ts"],"sourcesContent":["/**\n * Bounded filesystem primitives for scanning USER project trees. Every\n * detection-time glob, walk, and project-file read goes through here so the\n * worst case is a constant, never a function of the user's repo.\n */\nimport path from 'path';\nimport fs from 'fs';\nimport type { Dirent } from 'fs';\nimport fg from 'fast-glob';\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport type { WizardRunOptions } from './types';\n\n/**\n * Errno codes that are expected while walking an arbitrary tree and mean\n * \"skip this entry\", not \"something is broken\". Scanning from a broad dir\n * (e.g. `~`) routinely hits OS-protected paths (macOS `Library/Group\n * Containers/group.com.apple.*`) that throw EPERM/EACCES per entry — capturing\n * each as an exception buried real errors under thousands of noise events.\n */\nconst BENIGN_FS_ERROR_CODES = new Set<string>([\n  'EACCES', // permission denied\n  'EPERM', // operation not permitted (macOS-protected dirs)\n  'ENOENT', // entry vanished mid-walk\n  'ENOTDIR', // path component isn't a directory\n  'ELOOP', // symlink loop\n  'ENAMETOOLONG', // path too long\n  'EMFILE', // too many open files (environmental, not a wizard bug)\n  'ENFILE',\n]);\n\n/**\n * Report a swallowed filesystem error. Traversal stays best-effort — the caller\n * still skips the failing entry. Expected errno codes (permission denied, entry\n * vanished, symlink loops…) are logged to the debug file only; anything else is\n * genuinely unexpected and gets captured to error tracking. Preserves the\n * original Error (and its `code`, e.g. EACCES / ENOENT) when available.\n */\nfunction reportFsError(step: string, filePath: string, error: unknown): void {\n  const code = (error as NodeJS.ErrnoException | null)?.code;\n  if (code && BENIGN_FS_ERROR_CODES.has(code)) {\n    logToFile(`[bounded-fs] skipped ${step} (${code}): ${filePath}`);\n    return;\n  }\n  analytics.captureException(\n    error instanceof Error ? error : new Error(String(error)),\n    { step, path: filePath },\n  );\n}\n\nexport function getDotGitignore({\n  installDir,\n}: Pick<WizardRunOptions, 'installDir'>) {\n  const gitignorePath = path.join(installDir, '.gitignore');\n  const gitignoreExists = fs.existsSync(gitignorePath);\n\n  if (gitignoreExists) {\n    return gitignorePath;\n  }\n\n  return undefined;\n}\n\n/**\n * Directory names to skip when scanning a project tree — dependency\n * directories, build output, virtual environments, vendored trees.\n * Used verbatim by walkProjectFiles and as glob patterns by boundedGlob.\n */\nexport const IGNORED_DIRS = new Set<string>([\n  'node_modules',\n  '.git',\n  '.next',\n  '.nuxt',\n  '.svelte-kit',\n  '.turbo',\n  '.cache',\n  '.parcel-cache',\n  'dist',\n  'build',\n  'out',\n  'coverage',\n  '.coverage',\n  'venv',\n  '.venv',\n  '__pycache__',\n  '.pytest_cache',\n  'vendor',\n  'target',\n  '.gradle',\n  '.idea',\n  '.vscode',\n  'site-packages',\n  'DerivedData',\n  'Pods',\n]);\n\n/** IGNORED_DIRS as fast-glob ignore patterns. */\nexport const PROJECT_IGNORE_GLOBS: readonly string[] = [...IGNORED_DIRS].map(\n  (dir) => `**/${dir}/**`,\n);\n\n// Files larger than this are skipped, never materialized.\nexport const MAX_PROJECT_FILE_BYTES = 2 * 1024 * 1024;\n\n// A glob returns at most this many entries.\nexport const MAX_GLOB_MATCHES = 500;\n\n// A glob's traversal is destroyed after this long, even when abandoned.\nexport const GLOB_DEADLINE_MS = 8_000;\n\n// A directory contributes at most this many entries to a walk.\nexport const MAX_DIR_ENTRIES = 10_000;\n\n// A walk fires at most this many onFile callbacks.\nexport const MAX_WALK_FILES = 100_000;\n\nexport interface BoundedGlobOptions {\n  cwd: string;\n  /** Appended to PROJECT_IGNORE_GLOBS. */\n  extraIgnore?: readonly string[];\n  /** Stop after this many matches. Defaults to MAX_GLOB_MATCHES. */\n  limit?: number;\n  /** Match dotfiles. Traversal of dot-DIRECTORIES stays blocked by the ignore set. */\n  dot?: boolean;\n  /** fast-glob `deep` — maximum directory depth. */\n  deep?: number;\n}\n\n/**\n * Streams matches, stops at `limit`, destroys the crawl at GLOB_DEADLINE_MS.\n * Returns paths relative to `cwd`, possibly truncated.\n */\nexport async function boundedGlob(\n  patterns: string | string[],\n  options: BoundedGlobOptions,\n): Promise<string[]> {\n  const limit = options.limit ?? MAX_GLOB_MATCHES;\n  const stream = fg.stream(patterns, {\n    cwd: options.cwd,\n    dot: options.dot ?? false,\n    onlyFiles: true,\n    deep: options.deep,\n    ignore: [...PROJECT_IGNORE_GLOBS, ...(options.extraIgnore ?? [])],\n    suppressErrors: true,\n    followSymbolicLinks: false,\n  });\n\n  const matches: string[] = [];\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      resolve(matches);\n    };\n    const timer = setTimeout(() => {\n      stream.destroy();\n      finish();\n    }, GLOB_DEADLINE_MS);\n    stream.on('data', (entry: string | Buffer) => {\n      matches.push(String(entry));\n      if (matches.length >= limit) {\n        stream.destroy();\n        finish();\n      }\n    });\n    stream.once('error', finish);\n    stream.once('end', finish);\n    stream.once('close', finish);\n  });\n}\n\n/**\n * Walk a project tree, invoking `onFile(name, fullPath)` for every regular\n * file — including dotfiles like `.env` (the caller decides what it cares\n * about). Skips `IGNORED_DIRS` and hidden directories, follows symlinked\n * directories with realpath-based loop protection, descends at most\n * `maxDepth` levels below `rootDir`, and stops at the per-directory and\n * whole-walk caps. Filesystem errors are reported and skipped (best-effort).\n */\nexport function walkProjectFiles(\n  rootDir: string,\n  onFile: (name: string, fullPath: string) => void,\n  maxDepth = 3,\n): void {\n  const visited = new Set<string>();\n  let filesSeen = 0;\n  // Explicit stack — no call-stack recursion.\n  const stack: Array<{ dir: string; depth: number }> = [\n    { dir: rootDir, depth: 0 },\n  ];\n\n  while (stack.length > 0 && filesSeen < MAX_WALK_FILES) {\n    const { dir, depth } = stack.pop()!;\n\n    // realpath both resolves symlinked dirs and gives us a stable key to\n    // detect loops (symlink cycles, e.g. a -> ../a).\n    let realDir: string;\n    try {\n      realDir = fs.realpathSync(dir);\n    } catch (error) {\n      reportFsError('walkProjectFiles.realpath', dir, error);\n      continue;\n    }\n    if (visited.has(realDir)) continue;\n    visited.add(realDir);\n\n    let handle: fs.Dir;\n    try {\n      handle = fs.opendirSync(dir);\n    } catch (error) {\n      reportFsError('walkProjectFiles.opendir', dir, error);\n      continue;\n    }\n    try {\n      let entriesRead = 0;\n      let entry: Dirent | null;\n      while ((entry = handle.readSync()) !== null) {\n        if (++entriesRead > MAX_DIR_ENTRIES || filesSeen >= MAX_WALK_FILES) {\n          logToFile(\n            `[bounded-fs] walk capped in ${dir} (entries=${entriesRead}, files=${filesSeen})`,\n          );\n          break;\n        }\n        if (IGNORED_DIRS.has(entry.name)) continue;\n\n        const fullPath = path.join(dir, entry.name);\n\n        // Symlinks report isDirectory()/isFile() as false under withFileTypes,\n        // so resolve the target before deciding how to handle the entry.\n        let isDir = entry.isDirectory();\n        let isFile = entry.isFile();\n        if (entry.isSymbolicLink()) {\n          try {\n            const st = fs.statSync(fullPath);\n            isDir = st.isDirectory();\n            isFile = st.isFile();\n          } catch (error) {\n            reportFsError('walkProjectFiles.stat', fullPath, error);\n            continue;\n          }\n        }\n\n        if (isDir) {\n          if (entry.name.startsWith('.')) continue; // skip hidden directories\n          if (depth < maxDepth) stack.push({ dir: fullPath, depth: depth + 1 });\n        } else if (isFile) {\n          filesSeen += 1;\n          onFile(entry.name, fullPath);\n        }\n      }\n    } finally {\n      try {\n        handle.closeSync();\n      } catch {\n        /* already closed */\n      }\n    }\n  }\n}\n\n/**\n * Read a project file as UTF-8, or null when missing, unreadable, or over\n * `maxBytes` (stat-gated: an oversized file is never materialized).\n */\nexport function readProjectFile(\n  filePath: string,\n  maxBytes = MAX_PROJECT_FILE_BYTES,\n): string | null {\n  try {\n    if (fs.statSync(filePath).size > maxBytes) return null;\n    return fs.readFileSync(filePath, 'utf-8');\n  } catch {\n    return null;\n  }\n}\n\n/**\n * `readProjectFile` that also reports unexpected errors to error tracking.\n * For walk callbacks where a failing read is worth a telemetry breadcrumb.\n */\nexport function safeReadFile(fullPath: string): string | null {\n  try {\n    if (fs.statSync(fullPath).size > MAX_PROJECT_FILE_BYTES) {\n      logToFile(`[bounded-fs] skipped oversized file: ${fullPath}`);\n      return null;\n    }\n    return fs.readFileSync(fullPath, 'utf-8');\n  } catch (error) {\n    reportFsError('safeReadFile', fullPath, error);\n    return null;\n  }\n}\n\n/**\n * The first `bytes` of a file without materializing the rest.\n */\nexport function readFileHead(filePath: string, bytes: number): string | null {\n  try {\n    const fd = fs.openSync(filePath, 'r');\n    try {\n      const buffer = Buffer.alloc(bytes);\n      const read = fs.readSync(fd, buffer, 0, bytes, 0);\n      return buffer.toString('utf-8', 0, read);\n    } finally {\n      fs.closeSync(fd);\n    }\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,MAAM,wBAAwB,IAAI,IAAY;CAC5C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;;;;AASF,SAAS,cAAc,MAAc,UAAkB,OAAsB;CAC3E,MAAM,OAAQ,OAAwC;AACtD,KAAI,QAAQ,sBAAsB,IAAI,KAAK,EAAE;AAC3C,YAAU,wBAAwB,KAAK,IAAI,KAAK,KAAK,WAAW;AAChE;;AAEF,WAAU,iBACR,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD;EAAE;EAAM,MAAM;EAAU,CACzB;;;;;;;AAqBH,MAAa,eAAe,IAAI,IAAY;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;AAGF,MAAa,uBAA0C,CAAC,GAAG,aAAa,CAAC,KACtE,QAAQ,MAAM,IAAI,KACpB;AAGD,MAAa,yBAAyB,IAAI,OAAO;AAMjD,MAAa,mBAAmB;;;;;AAwBhC,eAAsB,YACpB,UACA,SACmB;CACnB,MAAM,QAAQ,QAAQ,SAAA;CACtB,MAAM,SAAS,GAAG,OAAO,UAAU;EACjC,KAAK,QAAQ;EACb,KAAK,QAAQ,OAAO;EACpB,WAAW;EACX,MAAM,QAAQ;EACd,QAAQ,CAAC,GAAG,sBAAsB,GAAI,QAAQ,eAAe,EAAE,CAAE;EACjE,gBAAgB;EAChB,qBAAqB;EACtB,CAAC;CAEF,MAAM,UAAoB,EAAE;AAC5B,QAAO,IAAI,SAAS,YAAY;EAC9B,IAAI,UAAU;EACd,MAAM,eAAqB;AACzB,OAAI,QAAS;AACb,aAAU;AACV,gBAAa,MAAM;AACnB,WAAQ,QAAQ;;EAElB,MAAM,QAAQ,iBAAiB;AAC7B,UAAO,SAAS;AAChB,WAAQ;KACP,iBAAiB;AACpB,SAAO,GAAG,SAAS,UAA2B;AAC5C,WAAQ,KAAK,OAAO,MAAM,CAAC;AAC3B,OAAI,QAAQ,UAAU,OAAO;AAC3B,WAAO,SAAS;AAChB,YAAQ;;IAEV;AACF,SAAO,KAAK,SAAS,OAAO;AAC5B,SAAO,KAAK,OAAO,OAAO;AAC1B,SAAO,KAAK,SAAS,OAAO;GAC5B;;;;;;;;;;AAWJ,SAAgB,iBACd,SACA,QACA,WAAW,GACL;CACN,MAAM,0BAAU,IAAI,KAAa;CACjC,IAAI,YAAY;CAEhB,MAAM,QAA+C,CACnD;EAAE,KAAK;EAAS,OAAO;EAAG,CAC3B;AAED,QAAO,MAAM,SAAS,KAAK,YAAA,KAA4B;EACrD,MAAM,EAAE,KAAK,UAAU,MAAM,KAAK;EAIlC,IAAI;AACJ,MAAI;AACF,aAAU,GAAG,aAAa,IAAI;WACvB,OAAO;AACd,iBAAc,6BAA6B,KAAK,MAAM;AACtD;;AAEF,MAAI,QAAQ,IAAI,QAAQ,CAAE;AAC1B,UAAQ,IAAI,QAAQ;EAEpB,IAAI;AACJ,MAAI;AACF,YAAS,GAAG,YAAY,IAAI;WACrB,OAAO;AACd,iBAAc,4BAA4B,KAAK,MAAM;AACrD;;AAEF,MAAI;GACF,IAAI,cAAc;GAClB,IAAI;AACJ,WAAQ,QAAQ,OAAO,UAAU,MAAM,MAAM;AAC3C,QAAI,EAAE,cAAA,OAAiC,aAAA,KAA6B;AAClE,eACE,+BAA+B,IAAI,YAAY,YAAY,UAAU,UAAU,GAChF;AACD;;AAEF,QAAI,aAAa,IAAI,MAAM,KAAK,CAAE;IAElC,MAAM,WAAW,KAAK,KAAK,KAAK,MAAM,KAAK;IAI3C,IAAI,QAAQ,MAAM,aAAa;IAC/B,IAAI,SAAS,MAAM,QAAQ;AAC3B,QAAI,MAAM,gBAAgB,CACxB,KAAI;KACF,MAAM,KAAK,GAAG,SAAS,SAAS;AAChC,aAAQ,GAAG,aAAa;AACxB,cAAS,GAAG,QAAQ;aACb,OAAO;AACd,mBAAc,yBAAyB,UAAU,MAAM;AACvD;;AAIJ,QAAI,OAAO;AACT,SAAI,MAAM,KAAK,WAAW,IAAI,CAAE;AAChC,SAAI,QAAQ,SAAU,OAAM,KAAK;MAAE,KAAK;MAAU,OAAO,QAAQ;MAAG,CAAC;eAC5D,QAAQ;AACjB,kBAAa;AACb,YAAO,MAAM,MAAM,SAAS;;;YAGxB;AACR,OAAI;AACF,WAAO,WAAW;WACZ;;;;;;;;AAWd,SAAgB,gBACd,UACA,WAAW,wBACI;AACf,KAAI;AACF,MAAI,GAAG,SAAS,SAAS,CAAC,OAAO,SAAU,QAAO;AAClD,SAAO,GAAG,aAAa,UAAU,QAAQ;SACnC;AACN,SAAO;;;;;;;AAQX,SAAgB,aAAa,UAAiC;AAC5D,KAAI;AACF,MAAI,GAAG,SAAS,SAAS,CAAC,OAAA,SAA+B;AACvD,aAAU,wCAAwC,WAAW;AAC7D,UAAO;;AAET,SAAO,GAAG,aAAa,UAAU,QAAQ;UAClC,OAAO;AACd,gBAAc,gBAAgB,UAAU,MAAM;AAC9C,SAAO;;;;;;AAOX,SAAgB,aAAa,UAAkB,OAA8B;AAC3E,KAAI;EACF,MAAM,KAAK,GAAG,SAAS,UAAU,IAAI;AACrC,MAAI;GACF,MAAM,SAAS,OAAO,MAAM,MAAM;GAClC,MAAM,OAAO,GAAG,SAAS,IAAI,QAAQ,GAAG,OAAO,EAAE;AACjD,UAAO,OAAO,SAAS,SAAS,GAAG,KAAK;YAChC;AACR,MAAG,UAAU,GAAG;;SAEZ;AACN,SAAO"}
+{"version":3,"file":"bounded-fs-D85Tk3nS.js","names":[],"sources":["../src/utils/bounded-fs.ts"],"sourcesContent":["/**\n * Bounded filesystem primitives for scanning USER project trees. Every\n * detection-time glob, walk, and project-file read goes through here so the\n * worst case is a constant, never a function of the user's repo.\n */\nimport path from 'path';\nimport fs from 'fs';\nimport type { Dirent } from 'fs';\nimport fg from 'fast-glob';\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport type { WizardRunOptions } from './types';\n\n/**\n * Errno codes that are expected while walking an arbitrary tree and mean\n * \"skip this entry\", not \"something is broken\". Scanning from a broad dir\n * (e.g. `~`) routinely hits OS-protected paths (macOS `Library/Group\n * Containers/group.com.apple.*`) that throw EPERM/EACCES per entry — capturing\n * each as an exception buried real errors under thousands of noise events.\n */\nconst BENIGN_FS_ERROR_CODES = new Set<string>([\n  'EACCES', // permission denied\n  'EPERM', // operation not permitted (macOS-protected dirs)\n  'ENOENT', // entry vanished mid-walk\n  'ENOTDIR', // path component isn't a directory\n  'ELOOP', // symlink loop\n  'ENAMETOOLONG', // path too long\n  'EMFILE', // too many open files (environmental, not a wizard bug)\n  'ENFILE',\n]);\n\n/**\n * Report a swallowed filesystem error. Traversal stays best-effort — the caller\n * still skips the failing entry. Expected errno codes (permission denied, entry\n * vanished, symlink loops…) are logged to the debug file only; anything else is\n * genuinely unexpected and gets captured to error tracking. Preserves the\n * original Error (and its `code`, e.g. EACCES / ENOENT) when available.\n */\nfunction reportFsError(step: string, filePath: string, error: unknown): void {\n  const code = (error as NodeJS.ErrnoException | null)?.code;\n  if (code && BENIGN_FS_ERROR_CODES.has(code)) {\n    logToFile(`[bounded-fs] skipped ${step} (${code}): ${filePath}`);\n    return;\n  }\n  analytics.captureException(\n    error instanceof Error ? error : new Error(String(error)),\n    { step, path: filePath },\n  );\n}\n\nexport function getDotGitignore({\n  installDir,\n}: Pick<WizardRunOptions, 'installDir'>) {\n  const gitignorePath = path.join(installDir, '.gitignore');\n  const gitignoreExists = fs.existsSync(gitignorePath);\n\n  if (gitignoreExists) {\n    return gitignorePath;\n  }\n\n  return undefined;\n}\n\n/**\n * Directory names to skip when scanning a project tree — dependency\n * directories, build output, virtual environments, vendored trees.\n * Used verbatim by walkProjectFiles and as glob patterns by boundedGlob.\n */\nexport const IGNORED_DIRS = new Set<string>([\n  'node_modules',\n  '.git',\n  '.next',\n  '.nuxt',\n  '.svelte-kit',\n  '.turbo',\n  '.cache',\n  '.parcel-cache',\n  'dist',\n  'build',\n  'out',\n  'coverage',\n  '.coverage',\n  'venv',\n  '.venv',\n  '__pycache__',\n  '.pytest_cache',\n  'vendor',\n  'target',\n  '.gradle',\n  '.idea',\n  '.vscode',\n  'site-packages',\n  'DerivedData',\n  'Pods',\n]);\n\n/** IGNORED_DIRS as fast-glob ignore patterns. */\nexport const PROJECT_IGNORE_GLOBS: readonly string[] = [...IGNORED_DIRS].map(\n  (dir) => `**/${dir}/**`,\n);\n\n// Files larger than this are skipped, never materialized.\nexport const MAX_PROJECT_FILE_BYTES = 2 * 1024 * 1024;\n\n// A glob returns at most this many entries.\nexport const MAX_GLOB_MATCHES = 500;\n\n// A glob's traversal is destroyed after this long, even when abandoned.\nexport const GLOB_DEADLINE_MS = 8_000;\n\n// A directory contributes at most this many entries to a walk.\nexport const MAX_DIR_ENTRIES = 10_000;\n\n// A walk fires at most this many onFile callbacks.\nexport const MAX_WALK_FILES = 100_000;\n\nexport interface BoundedGlobOptions {\n  cwd: string;\n  /** Appended to PROJECT_IGNORE_GLOBS. */\n  extraIgnore?: readonly string[];\n  /** Stop after this many matches. Defaults to MAX_GLOB_MATCHES. */\n  limit?: number;\n  /** Match dotfiles. Traversal of dot-DIRECTORIES stays blocked by the ignore set. */\n  dot?: boolean;\n  /** fast-glob `deep` — maximum directory depth. */\n  deep?: number;\n}\n\n/**\n * Streams matches, stops at `limit`, destroys the crawl at GLOB_DEADLINE_MS.\n * Returns paths relative to `cwd`, possibly truncated.\n */\nexport async function boundedGlob(\n  patterns: string | string[],\n  options: BoundedGlobOptions,\n): Promise<string[]> {\n  const limit = options.limit ?? MAX_GLOB_MATCHES;\n  const stream = fg.stream(patterns, {\n    cwd: options.cwd,\n    dot: options.dot ?? false,\n    onlyFiles: true,\n    deep: options.deep,\n    ignore: [...PROJECT_IGNORE_GLOBS, ...(options.extraIgnore ?? [])],\n    suppressErrors: true,\n    followSymbolicLinks: false,\n  });\n\n  const matches: string[] = [];\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      resolve(matches);\n    };\n    const timer = setTimeout(() => {\n      stream.destroy();\n      finish();\n    }, GLOB_DEADLINE_MS);\n    stream.on('data', (entry: string | Buffer) => {\n      matches.push(String(entry));\n      if (matches.length >= limit) {\n        stream.destroy();\n        finish();\n      }\n    });\n    stream.once('error', finish);\n    stream.once('end', finish);\n    stream.once('close', finish);\n  });\n}\n\n/**\n * Walk a project tree, invoking `onFile(name, fullPath)` for every regular\n * file — including dotfiles like `.env` (the caller decides what it cares\n * about). Skips `IGNORED_DIRS` and hidden directories, follows symlinked\n * directories with realpath-based loop protection, descends at most\n * `maxDepth` levels below `rootDir`, and stops at the per-directory and\n * whole-walk caps. Filesystem errors are reported and skipped (best-effort).\n */\nexport function walkProjectFiles(\n  rootDir: string,\n  onFile: (name: string, fullPath: string) => void,\n  maxDepth = 3,\n): void {\n  const visited = new Set<string>();\n  let filesSeen = 0;\n  // Explicit stack — no call-stack recursion.\n  const stack: Array<{ dir: string; depth: number }> = [\n    { dir: rootDir, depth: 0 },\n  ];\n\n  while (stack.length > 0 && filesSeen < MAX_WALK_FILES) {\n    const { dir, depth } = stack.pop()!;\n\n    // realpath both resolves symlinked dirs and gives us a stable key to\n    // detect loops (symlink cycles, e.g. a -> ../a).\n    let realDir: string;\n    try {\n      realDir = fs.realpathSync(dir);\n    } catch (error) {\n      reportFsError('walkProjectFiles.realpath', dir, error);\n      continue;\n    }\n    if (visited.has(realDir)) continue;\n    visited.add(realDir);\n\n    let handle: fs.Dir;\n    try {\n      handle = fs.opendirSync(dir);\n    } catch (error) {\n      reportFsError('walkProjectFiles.opendir', dir, error);\n      continue;\n    }\n    try {\n      let entriesRead = 0;\n      let entry: Dirent | null;\n      while ((entry = handle.readSync()) !== null) {\n        if (++entriesRead > MAX_DIR_ENTRIES || filesSeen >= MAX_WALK_FILES) {\n          logToFile(\n            `[bounded-fs] walk capped in ${dir} (entries=${entriesRead}, files=${filesSeen})`,\n          );\n          break;\n        }\n        if (IGNORED_DIRS.has(entry.name)) continue;\n\n        const fullPath = path.join(dir, entry.name);\n\n        // Symlinks report isDirectory()/isFile() as false under withFileTypes,\n        // so resolve the target before deciding how to handle the entry.\n        let isDir = entry.isDirectory();\n        let isFile = entry.isFile();\n        if (entry.isSymbolicLink()) {\n          try {\n            const st = fs.statSync(fullPath);\n            isDir = st.isDirectory();\n            isFile = st.isFile();\n          } catch (error) {\n            reportFsError('walkProjectFiles.stat', fullPath, error);\n            continue;\n          }\n        }\n\n        if (isDir) {\n          if (entry.name.startsWith('.')) continue; // skip hidden directories\n          if (depth < maxDepth) stack.push({ dir: fullPath, depth: depth + 1 });\n        } else if (isFile) {\n          filesSeen += 1;\n          onFile(entry.name, fullPath);\n        }\n      }\n    } finally {\n      try {\n        handle.closeSync();\n      } catch {\n        /* already closed */\n      }\n    }\n  }\n}\n\n/**\n * Read a project file as UTF-8, or null when missing, unreadable, or over\n * `maxBytes` (stat-gated: an oversized file is never materialized).\n */\nexport function readProjectFile(\n  filePath: string,\n  maxBytes = MAX_PROJECT_FILE_BYTES,\n): string | null {\n  try {\n    if (fs.statSync(filePath).size > maxBytes) return null;\n    return fs.readFileSync(filePath, 'utf-8');\n  } catch {\n    return null;\n  }\n}\n\n/**\n * `readProjectFile` that also reports unexpected errors to error tracking.\n * For walk callbacks where a failing read is worth a telemetry breadcrumb.\n */\nexport function safeReadFile(fullPath: string): string | null {\n  try {\n    if (fs.statSync(fullPath).size > MAX_PROJECT_FILE_BYTES) {\n      logToFile(`[bounded-fs] skipped oversized file: ${fullPath}`);\n      return null;\n    }\n    return fs.readFileSync(fullPath, 'utf-8');\n  } catch (error) {\n    reportFsError('safeReadFile', fullPath, error);\n    return null;\n  }\n}\n\n/**\n * The first `bytes` of a file without materializing the rest.\n */\nexport function readFileHead(filePath: string, bytes: number): string | null {\n  try {\n    const fd = fs.openSync(filePath, 'r');\n    try {\n      const buffer = Buffer.alloc(bytes);\n      const read = fs.readSync(fd, buffer, 0, bytes, 0);\n      return buffer.toString('utf-8', 0, read);\n    } finally {\n      fs.closeSync(fd);\n    }\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,MAAM,wBAAwB,IAAI,IAAY;CAC5C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;;;;AASF,SAAS,cAAc,MAAc,UAAkB,OAAsB;CAC3E,MAAM,OAAQ,OAAwC;AACtD,KAAI,QAAQ,sBAAsB,IAAI,KAAK,EAAE;AAC3C,YAAU,wBAAwB,KAAK,IAAI,KAAK,KAAK,WAAW;AAChE;;AAEF,WAAU,iBACR,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD;EAAE;EAAM,MAAM;EAAU,CACzB;;;;;;;AAqBH,MAAa,eAAe,IAAI,IAAY;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;AAGF,MAAa,uBAA0C,CAAC,GAAG,aAAa,CAAC,KACtE,QAAQ,MAAM,IAAI,KACpB;AAGD,MAAa,yBAAyB,IAAI,OAAO;AAMjD,MAAa,mBAAmB;;;;;AAwBhC,eAAsB,YACpB,UACA,SACmB;CACnB,MAAM,QAAQ,QAAQ,SAAA;CACtB,MAAM,SAAS,GAAG,OAAO,UAAU;EACjC,KAAK,QAAQ;EACb,KAAK,QAAQ,OAAO;EACpB,WAAW;EACX,MAAM,QAAQ;EACd,QAAQ,CAAC,GAAG,sBAAsB,GAAI,QAAQ,eAAe,EAAE,CAAE;EACjE,gBAAgB;EAChB,qBAAqB;EACtB,CAAC;CAEF,MAAM,UAAoB,EAAE;AAC5B,QAAO,IAAI,SAAS,YAAY;EAC9B,IAAI,UAAU;EACd,MAAM,eAAqB;AACzB,OAAI,QAAS;AACb,aAAU;AACV,gBAAa,MAAM;AACnB,WAAQ,QAAQ;;EAElB,MAAM,QAAQ,iBAAiB;AAC7B,UAAO,SAAS;AAChB,WAAQ;KACP,iBAAiB;AACpB,SAAO,GAAG,SAAS,UAA2B;AAC5C,WAAQ,KAAK,OAAO,MAAM,CAAC;AAC3B,OAAI,QAAQ,UAAU,OAAO;AAC3B,WAAO,SAAS;AAChB,YAAQ;;IAEV;AACF,SAAO,KAAK,SAAS,OAAO;AAC5B,SAAO,KAAK,OAAO,OAAO;AAC1B,SAAO,KAAK,SAAS,OAAO;GAC5B;;;;;;;;;;AAWJ,SAAgB,iBACd,SACA,QACA,WAAW,GACL;CACN,MAAM,0BAAU,IAAI,KAAa;CACjC,IAAI,YAAY;CAEhB,MAAM,QAA+C,CACnD;EAAE,KAAK;EAAS,OAAO;EAAG,CAC3B;AAED,QAAO,MAAM,SAAS,KAAK,YAAA,KAA4B;EACrD,MAAM,EAAE,KAAK,UAAU,MAAM,KAAK;EAIlC,IAAI;AACJ,MAAI;AACF,aAAU,GAAG,aAAa,IAAI;WACvB,OAAO;AACd,iBAAc,6BAA6B,KAAK,MAAM;AACtD;;AAEF,MAAI,QAAQ,IAAI,QAAQ,CAAE;AAC1B,UAAQ,IAAI,QAAQ;EAEpB,IAAI;AACJ,MAAI;AACF,YAAS,GAAG,YAAY,IAAI;WACrB,OAAO;AACd,iBAAc,4BAA4B,KAAK,MAAM;AACrD;;AAEF,MAAI;GACF,IAAI,cAAc;GAClB,IAAI;AACJ,WAAQ,QAAQ,OAAO,UAAU,MAAM,MAAM;AAC3C,QAAI,EAAE,cAAA,OAAiC,aAAA,KAA6B;AAClE,eACE,+BAA+B,IAAI,YAAY,YAAY,UAAU,UAAU,GAChF;AACD;;AAEF,QAAI,aAAa,IAAI,MAAM,KAAK,CAAE;IAElC,MAAM,WAAW,KAAK,KAAK,KAAK,MAAM,KAAK;IAI3C,IAAI,QAAQ,MAAM,aAAa;IAC/B,IAAI,SAAS,MAAM,QAAQ;AAC3B,QAAI,MAAM,gBAAgB,CACxB,KAAI;KACF,MAAM,KAAK,GAAG,SAAS,SAAS;AAChC,aAAQ,GAAG,aAAa;AACxB,cAAS,GAAG,QAAQ;aACb,OAAO;AACd,mBAAc,yBAAyB,UAAU,MAAM;AACvD;;AAIJ,QAAI,OAAO;AACT,SAAI,MAAM,KAAK,WAAW,IAAI,CAAE;AAChC,SAAI,QAAQ,SAAU,OAAM,KAAK;MAAE,KAAK;MAAU,OAAO,QAAQ;MAAG,CAAC;eAC5D,QAAQ;AACjB,kBAAa;AACb,YAAO,MAAM,MAAM,SAAS;;;YAGxB;AACR,OAAI;AACF,WAAO,WAAW;WACZ;;;;;;;;AAWd,SAAgB,gBACd,UACA,WAAW,wBACI;AACf,KAAI;AACF,MAAI,GAAG,SAAS,SAAS,CAAC,OAAO,SAAU,QAAO;AAClD,SAAO,GAAG,aAAa,UAAU,QAAQ;SACnC;AACN,SAAO;;;;;;;AAQX,SAAgB,aAAa,UAAiC;AAC5D,KAAI;AACF,MAAI,GAAG,SAAS,SAAS,CAAC,OAAA,SAA+B;AACvD,aAAU,wCAAwC,WAAW;AAC7D,UAAO;;AAET,SAAO,GAAG,aAAa,UAAU,QAAQ;UAClC,OAAO;AACd,gBAAc,gBAAgB,UAAU,MAAM;AAC9C,SAAO;;;;;;AAOX,SAAgB,aAAa,UAAkB,OAA8B;AAC3E,KAAI;EACF,MAAM,KAAK,GAAG,SAAS,UAAU,IAAI;AACrC,MAAI;GACF,MAAM,SAAS,OAAO,MAAM,MAAM;GAClC,MAAM,OAAO,GAAG,SAAS,IAAI,QAAQ,GAAG,OAAO,EAAE;AACjD,UAAO,OAAO,SAAS,SAAS,GAAG,KAAK;YAChC;AACR,MAAG,UAAU,GAAG;;SAEZ;AACN,SAAO"}

package/dist/{ci-install-CzWzi_qu.js → ci-install-CQLi_a-r.js}

@@ -1,7 +1,7 @@
 import { d as ErrorCodes, u as emitWizardError } from "./errors--OqLxmWR.js";
-import { f as getUI, m as LoggingUI, p as setUI } from "./debug-ECdmmlDM.js";
-import { n as provisionNewAccount } from "./provisioning-BewSEuFX.js";
-import { r as posthogIntegrationConfig } from "./posthog-integration-CxvkKY1j.js";
+import { f as getUI, m as LoggingUI, p as setUI } from "./debug-DUmMVUHn.js";
+import { n as provisionNewAccount } from "./provisioning-B74q1uSQ.js";
+import { X as posthogIntegrationConfig } from "./mint-failure-CQqypC_v.js";
 import { c as runWizardHeadless, l as runWizardCI, u as API_KEY_HINT } from "./bin.js";
 //#region src/commands/basic-integration/ci-install.ts
 /**
@@ -116,4 +116,4 @@ async function provisionForSignup(options) {
 //#endregion
 export { runCIInstall, runHeadlessInstall };
 
-//# sourceMappingURL=ci-install-CzWzi_qu.js.map
+//# sourceMappingURL=ci-install-CQLi_a-r.js.map

package/dist/{ci-install-CzWzi_qu.js.map → ci-install-CQLi_a-r.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ci-install-CzWzi_qu.js","names":[],"sources":["../src/commands/basic-integration/ci-install.ts"],"sourcesContent":["import type { Arguments } from 'yargs';\nimport { getUI, setUI } from '@ui';\nimport { LoggingUI } from '@ui/logging-ui';\nimport { API_KEY_HINT, runWizardCI, runWizardHeadless } from '@lib/runners';\nimport type { NonInteractiveMode } from '@lib/runners';\nimport { provisionNewAccount } from '@utils/provisioning';\nimport { posthogIntegrationConfig } from '@lib/programs/posthog-integration/index';\nimport { ErrorCodes, type ErrorCode } from '@lib/errors';\nimport { emitWizardError } from '@lib/errors';\n\ntype Options = Arguments & {\n  region?: string;\n  baseUrl?: string;\n  installDir?: string;\n  apiKey?: string;\n  signup?: boolean;\n  email?: string;\n  name?: string;\n  projectId?: string;\n};\n\n/**\n * CI-mode install entry point (`--ci`, dev/test builds). Thin shell over the\n * shared non-interactive install — see `runNonInteractiveInstall`.\n */\nexport function runCIInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'ci');\n}\n\n/**\n * Headless install entry point (the experimental published-build run path; see\n * @lib/headless-mode). Thin shell over the shared non-interactive install.\n * Today it behaves exactly like `runCIInstall`; it is a separate function so\n * headless can diverge later (auth, prompts, …) without touching the CI path.\n */\nexport function runHeadlessInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'headless');\n}\n\n/**\n * Non-interactive install shared by CI and headless. Validates signup flags,\n * optionally provisions an account, then installs. `mode` only changes\n * user-facing labels and which runner is invoked; the accepted keys and the\n * install itself are identical (see runNonInteractive).\n */\nfunction runNonInteractiveInstall(\n  argv: Arguments,\n  mode: NonInteractiveMode,\n): void {\n  const options = { ...argv } as Options;\n  const headless = mode === 'headless';\n  const label = headless ? 'Headless' : 'CI';\n  const runWizard = headless ? runWizardHeadless : runWizardCI;\n\n  // Base validation (region/install-dir/api-key) is owned by the runner.\n  // This layer only adds the signup branch on top.\n  if (!options.apiKey && !options.signup) {\n    return failCI(\n      `${label} mode requires --api-key (${API_KEY_HINT}). ` +\n        'To create a new account instead, use --signup --email you@example.com.',\n      ErrorCodes.ArgsMissingApiKey,\n    );\n  }\n  if (!options.apiKey && options.signup && !options.email) {\n    return failCI(\n      `${label} --signup requires --email to create a new account.`,\n      ErrorCodes.ArgsMissingEmail,\n    );\n  }\n  warnOnUnexpectedKeyPrefix(options.apiKey);\n\n  void (async () => {\n    if (!options.apiKey && options.signup) {\n      // Fail before the irreversible provisioning step rather than after it.\n      if (!options.installDir) {\n        return failCI(\n          `${label} mode requires --install-dir (directory to install in)`,\n          ErrorCodes.ArgsMissingInstallDir,\n        );\n      }\n      const provisioned = await provisionForSignup(options);\n      options.apiKey = provisioned.personalApiKey;\n      if (options.projectId == null) options.projectId = provisioned.projectId;\n    }\n    runWizard(posthogIntegrationConfig, options);\n  })().catch((error: unknown) => {\n    emitWizardError({\n      code: ErrorCodes.ArgsSignupProvisionFailed,\n      message: error instanceof Error ? error.message : String(error),\n    });\n    process.exit(1);\n  });\n}\n\nfunction failCI(message: string, code?: ErrorCode): void {\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  getUI().log.error(message);\n  if (code) emitWizardError({ code, message });\n  process.exit(1);\n}\n\n/**\n * Decide whether to warn about an unexpected `--api-key` prefix, and with what\n * message. Returns `null` when the key is acceptable.\n *\n * CI and headless accept the same two credentials: a personal API key (`phx_`)\n * and a `pha_` OAuth access token minted under the wizard's own OAuth\n * application (cloud runs, and the CI bot). Both authenticate the mint the\n * same way. Anything else is unexpected and warns.\n *\n * Extracted as a pure predicate so it can be unit-tested without a UI.\n */\nexport function keyPrefixWarning(apiKey: string | undefined): string | null {\n  if (!apiKey || apiKey.startsWith('phx_') || apiKey.startsWith('pha_')) {\n    return null;\n  }\n  const hint = apiKey.startsWith('phc_')\n    ? ' (phc_ is a project/client key; expected a personal API key or a wizard-app token)'\n    : '';\n  return `--api-key does not start with \"phx_\" or \"pha_\"${hint}. Continuing anyway, but the LLM Gateway may reject it with a 401.`;\n}\n\nfunction warnOnUnexpectedKeyPrefix(apiKey: string | undefined): void {\n  const message = keyPrefixWarning(apiKey);\n  if (!message) return;\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  getUI().log.warn(message);\n}\n\n/**\n * Provision a new account and return its credentials. Throws on any failure\n * (after logging a user-facing message); the caller's `.catch` turns that\n * into a non-zero exit. The return type carries no failure sentinel.\n */\nasync function provisionForSignup(\n  options: Options,\n): Promise<{ personalApiKey: string; projectId: string }> {\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  const signupRegion = ((options.region as string) || 'us').toUpperCase() as\n    | 'US'\n    | 'EU';\n  getUI().log.info(\n    `Provisioning new PostHog account for ${String(\n      options.email,\n    )} in ${signupRegion}...`,\n  );\n\n  let result;\n  try {\n    result = await provisionNewAccount(\n      options.email as string,\n      options.name ?? '',\n      signupRegion,\n      { baseUrl: options.baseUrl },\n    );\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    getUI().log.error(`Provisioning failed: ${msg}`);\n    throw error;\n  }\n\n  if (!result.personalApiKey) {\n    getUI().log.error(\n      'Provisioning succeeded but no personal API key was returned — cannot continue install.',\n    );\n    throw new Error('provisioning returned no personal API key');\n  }\n\n  getUI().log.success('Account ready.');\n  getUI().log.info(`  Project API Key:  ${result.projectApiKey}`);\n  getUI().log.info(`  Personal API Key: ${result.personalApiKey}`);\n  getUI().log.info(`  Host:             ${result.host}`);\n  return {\n    personalApiKey: result.personalApiKey,\n    projectId: result.projectId,\n  };\n}\n"],"mappings":";;;;;;;;;;AAyBA,SAAgB,aAAa,MAAuB;AAClD,0BAAyB,MAAM,KAAK;;;;;;;;AAStC,SAAgB,mBAAmB,MAAuB;AACxD,0BAAyB,MAAM,WAAW;;;;;;;;AAS5C,SAAS,yBACP,MACA,MACM;CACN,MAAM,UAAU,EAAE,GAAG,MAAM;CAC3B,MAAM,WAAW,SAAS;CAC1B,MAAM,QAAQ,WAAW,aAAa;CACtC,MAAM,YAAY,WAAW,oBAAoB;AAIjD,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,OAC9B,QAAO,OACL,GAAG,MAAM,4BAA4B,aAAa,4EAElD,WAAW,kBACZ;AAEH,KAAI,CAAC,QAAQ,UAAU,QAAQ,UAAU,CAAC,QAAQ,MAChD,QAAO,OACL,GAAG,MAAM,sDACT,WAAW,iBACZ;AAEH,2BAA0B,QAAQ,OAAO;AAEzC,EAAM,YAAY;AAChB,MAAI,CAAC,QAAQ,UAAU,QAAQ,QAAQ;AAErC,OAAI,CAAC,QAAQ,WACX,QAAO,OACL,GAAG,MAAM,yDACT,WAAW,sBACZ;GAEH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,WAAQ,SAAS,YAAY;AAC7B,OAAI,QAAQ,aAAa,KAAM,SAAQ,YAAY,YAAY;;AAEjE,YAAU,0BAA0B,QAAQ;KAC1C,CAAC,OAAO,UAAmB;AAC7B,kBAAgB;GACd,MAAM,WAAW;GACjB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAChE,CAAC;AACF,UAAQ,KAAK,EAAE;GACf;;AAGJ,SAAS,OAAO,SAAiB,MAAwB;AACvD,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;AAC/B,QAAO,CAAC,IAAI,MAAM,QAAQ;AAC1B,KAAI,KAAM,iBAAgB;EAAE;EAAM;EAAS,CAAC;AAC5C,SAAQ,KAAK,EAAE;;;;;;;;;;;;;AAcjB,SAAgB,iBAAiB,QAA2C;AAC1E,KAAI,CAAC,UAAU,OAAO,WAAW,OAAO,IAAI,OAAO,WAAW,OAAO,CACnE,QAAO;AAKT,QAAO,iDAHM,OAAO,WAAW,OAAO,GAClC,uFACA,GACyD;;AAG/D,SAAS,0BAA0B,QAAkC;CACnE,MAAM,UAAU,iBAAiB,OAAO;AACxC,KAAI,CAAC,QAAS;AACd,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;AAC/B,QAAO,CAAC,IAAI,KAAK,QAAQ;;;;;;;AAQ3B,eAAe,mBACb,SACwD;AACxD,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;CAC/B,MAAM,gBAAiB,QAAQ,UAAqB,MAAM,aAAa;AAGvE,QAAO,CAAC,IAAI,KACV,wCAAwC,OACtC,QAAQ,MACT,CAAC,MAAM,aAAa,KACtB;CAED,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,oBACb,QAAQ,OACR,QAAQ,QAAQ,IAChB,cACA,EAAE,SAAS,QAAQ,SAAS,CAC7B;UACM,OAAO;EACd,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAClE,SAAO,CAAC,IAAI,MAAM,wBAAwB,MAAM;AAChD,QAAM;;AAGR,KAAI,CAAC,OAAO,gBAAgB;AAC1B,SAAO,CAAC,IAAI,MACV,yFACD;AACD,QAAM,IAAI,MAAM,4CAA4C;;AAG9D,QAAO,CAAC,IAAI,QAAQ,iBAAiB;AACrC,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,gBAAgB;AAC/D,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,iBAAiB;AAChE,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,OAAO;AACtD,QAAO;EACL,gBAAgB,OAAO;EACvB,WAAW,OAAO;EACnB"}
+{"version":3,"file":"ci-install-CQLi_a-r.js","names":[],"sources":["../src/commands/basic-integration/ci-install.ts"],"sourcesContent":["import type { Arguments } from 'yargs';\nimport { getUI, setUI } from '@ui';\nimport { LoggingUI } from '@ui/logging-ui';\nimport { API_KEY_HINT, runWizardCI, runWizardHeadless } from '@lib/runners';\nimport type { NonInteractiveMode } from '@lib/runners';\nimport { provisionNewAccount } from '@utils/provisioning';\nimport { posthogIntegrationConfig } from '@lib/programs/posthog-integration/index';\nimport { ErrorCodes, type ErrorCode } from '@lib/errors';\nimport { emitWizardError } from '@lib/errors';\n\ntype Options = Arguments & {\n  region?: string;\n  baseUrl?: string;\n  installDir?: string;\n  apiKey?: string;\n  signup?: boolean;\n  email?: string;\n  name?: string;\n  projectId?: string;\n};\n\n/**\n * CI-mode install entry point (`--ci`, dev/test builds). Thin shell over the\n * shared non-interactive install — see `runNonInteractiveInstall`.\n */\nexport function runCIInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'ci');\n}\n\n/**\n * Headless install entry point (the experimental published-build run path; see\n * @lib/headless-mode). Thin shell over the shared non-interactive install.\n * Today it behaves exactly like `runCIInstall`; it is a separate function so\n * headless can diverge later (auth, prompts, …) without touching the CI path.\n */\nexport function runHeadlessInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'headless');\n}\n\n/**\n * Non-interactive install shared by CI and headless. Validates signup flags,\n * optionally provisions an account, then installs. `mode` only changes\n * user-facing labels and which runner is invoked; the accepted keys and the\n * install itself are identical (see runNonInteractive).\n */\nfunction runNonInteractiveInstall(\n  argv: Arguments,\n  mode: NonInteractiveMode,\n): void {\n  const options = { ...argv } as Options;\n  const headless = mode === 'headless';\n  const label = headless ? 'Headless' : 'CI';\n  const runWizard = headless ? runWizardHeadless : runWizardCI;\n\n  // Base validation (region/install-dir/api-key) is owned by the runner.\n  // This layer only adds the signup branch on top.\n  if (!options.apiKey && !options.signup) {\n    return failCI(\n      `${label} mode requires --api-key (${API_KEY_HINT}). ` +\n        'To create a new account instead, use --signup --email you@example.com.',\n      ErrorCodes.ArgsMissingApiKey,\n    );\n  }\n  if (!options.apiKey && options.signup && !options.email) {\n    return failCI(\n      `${label} --signup requires --email to create a new account.`,\n      ErrorCodes.ArgsMissingEmail,\n    );\n  }\n  warnOnUnexpectedKeyPrefix(options.apiKey);\n\n  void (async () => {\n    if (!options.apiKey && options.signup) {\n      // Fail before the irreversible provisioning step rather than after it.\n      if (!options.installDir) {\n        return failCI(\n          `${label} mode requires --install-dir (directory to install in)`,\n          ErrorCodes.ArgsMissingInstallDir,\n        );\n      }\n      const provisioned = await provisionForSignup(options);\n      options.apiKey = provisioned.personalApiKey;\n      if (options.projectId == null) options.projectId = provisioned.projectId;\n    }\n    runWizard(posthogIntegrationConfig, options);\n  })().catch((error: unknown) => {\n    emitWizardError({\n      code: ErrorCodes.ArgsSignupProvisionFailed,\n      message: error instanceof Error ? error.message : String(error),\n    });\n    process.exit(1);\n  });\n}\n\nfunction failCI(message: string, code?: ErrorCode): void {\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  getUI().log.error(message);\n  if (code) emitWizardError({ code, message });\n  process.exit(1);\n}\n\n/**\n * Decide whether to warn about an unexpected `--api-key` prefix, and with what\n * message. Returns `null` when the key is acceptable.\n *\n * CI and headless accept the same two credentials: a personal API key (`phx_`)\n * and a `pha_` OAuth access token minted under the wizard's own OAuth\n * application (cloud runs, and the CI bot). Both authenticate the mint the\n * same way. Anything else is unexpected and warns.\n *\n * Extracted as a pure predicate so it can be unit-tested without a UI.\n */\nexport function keyPrefixWarning(apiKey: string | undefined): string | null {\n  if (!apiKey || apiKey.startsWith('phx_') || apiKey.startsWith('pha_')) {\n    return null;\n  }\n  const hint = apiKey.startsWith('phc_')\n    ? ' (phc_ is a project/client key; expected a personal API key or a wizard-app token)'\n    : '';\n  return `--api-key does not start with \"phx_\" or \"pha_\"${hint}. Continuing anyway, but the LLM Gateway may reject it with a 401.`;\n}\n\nfunction warnOnUnexpectedKeyPrefix(apiKey: string | undefined): void {\n  const message = keyPrefixWarning(apiKey);\n  if (!message) return;\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  getUI().log.warn(message);\n}\n\n/**\n * Provision a new account and return its credentials. Throws on any failure\n * (after logging a user-facing message); the caller's `.catch` turns that\n * into a non-zero exit. The return type carries no failure sentinel.\n */\nasync function provisionForSignup(\n  options: Options,\n): Promise<{ personalApiKey: string; projectId: string }> {\n  setUI(new LoggingUI());\n  getUI().intro('PostHog Wizard');\n  const signupRegion = ((options.region as string) || 'us').toUpperCase() as\n    | 'US'\n    | 'EU';\n  getUI().log.info(\n    `Provisioning new PostHog account for ${String(\n      options.email,\n    )} in ${signupRegion}...`,\n  );\n\n  let result;\n  try {\n    result = await provisionNewAccount(\n      options.email as string,\n      options.name ?? '',\n      signupRegion,\n      { baseUrl: options.baseUrl },\n    );\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    getUI().log.error(`Provisioning failed: ${msg}`);\n    throw error;\n  }\n\n  if (!result.personalApiKey) {\n    getUI().log.error(\n      'Provisioning succeeded but no personal API key was returned — cannot continue install.',\n    );\n    throw new Error('provisioning returned no personal API key');\n  }\n\n  getUI().log.success('Account ready.');\n  getUI().log.info(`  Project API Key:  ${result.projectApiKey}`);\n  getUI().log.info(`  Personal API Key: ${result.personalApiKey}`);\n  getUI().log.info(`  Host:             ${result.host}`);\n  return {\n    personalApiKey: result.personalApiKey,\n    projectId: result.projectId,\n  };\n}\n"],"mappings":";;;;;;;;;;AAyBA,SAAgB,aAAa,MAAuB;AAClD,0BAAyB,MAAM,KAAK;;;;;;;;AAStC,SAAgB,mBAAmB,MAAuB;AACxD,0BAAyB,MAAM,WAAW;;;;;;;;AAS5C,SAAS,yBACP,MACA,MACM;CACN,MAAM,UAAU,EAAE,GAAG,MAAM;CAC3B,MAAM,WAAW,SAAS;CAC1B,MAAM,QAAQ,WAAW,aAAa;CACtC,MAAM,YAAY,WAAW,oBAAoB;AAIjD,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,OAC9B,QAAO,OACL,GAAG,MAAM,4BAA4B,aAAa,4EAElD,WAAW,kBACZ;AAEH,KAAI,CAAC,QAAQ,UAAU,QAAQ,UAAU,CAAC,QAAQ,MAChD,QAAO,OACL,GAAG,MAAM,sDACT,WAAW,iBACZ;AAEH,2BAA0B,QAAQ,OAAO;AAEzC,EAAM,YAAY;AAChB,MAAI,CAAC,QAAQ,UAAU,QAAQ,QAAQ;AAErC,OAAI,CAAC,QAAQ,WACX,QAAO,OACL,GAAG,MAAM,yDACT,WAAW,sBACZ;GAEH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,WAAQ,SAAS,YAAY;AAC7B,OAAI,QAAQ,aAAa,KAAM,SAAQ,YAAY,YAAY;;AAEjE,YAAU,0BAA0B,QAAQ;KAC1C,CAAC,OAAO,UAAmB;AAC7B,kBAAgB;GACd,MAAM,WAAW;GACjB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAChE,CAAC;AACF,UAAQ,KAAK,EAAE;GACf;;AAGJ,SAAS,OAAO,SAAiB,MAAwB;AACvD,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;AAC/B,QAAO,CAAC,IAAI,MAAM,QAAQ;AAC1B,KAAI,KAAM,iBAAgB;EAAE;EAAM;EAAS,CAAC;AAC5C,SAAQ,KAAK,EAAE;;;;;;;;;;;;;AAcjB,SAAgB,iBAAiB,QAA2C;AAC1E,KAAI,CAAC,UAAU,OAAO,WAAW,OAAO,IAAI,OAAO,WAAW,OAAO,CACnE,QAAO;AAKT,QAAO,iDAHM,OAAO,WAAW,OAAO,GAClC,uFACA,GACyD;;AAG/D,SAAS,0BAA0B,QAAkC;CACnE,MAAM,UAAU,iBAAiB,OAAO;AACxC,KAAI,CAAC,QAAS;AACd,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;AAC/B,QAAO,CAAC,IAAI,KAAK,QAAQ;;;;;;;AAQ3B,eAAe,mBACb,SACwD;AACxD,OAAM,IAAI,WAAW,CAAC;AACtB,QAAO,CAAC,MAAM,iBAAiB;CAC/B,MAAM,gBAAiB,QAAQ,UAAqB,MAAM,aAAa;AAGvE,QAAO,CAAC,IAAI,KACV,wCAAwC,OACtC,QAAQ,MACT,CAAC,MAAM,aAAa,KACtB;CAED,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,oBACb,QAAQ,OACR,QAAQ,QAAQ,IAChB,cACA,EAAE,SAAS,QAAQ,SAAS,CAC7B;UACM,OAAO;EACd,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAClE,SAAO,CAAC,IAAI,MAAM,wBAAwB,MAAM;AAChD,QAAM;;AAGR,KAAI,CAAC,OAAO,gBAAgB;AAC1B,SAAO,CAAC,IAAI,MACV,yFACD;AACD,QAAM,IAAI,MAAM,4CAA4C;;AAG9D,QAAO,CAAC,IAAI,QAAQ,iBAAiB;AACrC,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,gBAAgB;AAC/D,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,iBAAiB;AAChE,QAAO,CAAC,IAAI,KAAK,uBAAuB,OAAO,OAAO;AACtD,QAAO;EACL,gBAAgB,OAAO;EACvB,WAAW,OAAO;EACnB"}

package/dist/{debug-D4y9vVWt.js → debug-CBmI5YUF.js}

@@ -1,2 +1,2 @@
-import { n as configureLogFileFromEnvironment, s as logToFile } from "./debug-ECdmmlDM.js";
+import { n as configureLogFileFromEnvironment, s as logToFile } from "./debug-DUmMVUHn.js";
 export { configureLogFileFromEnvironment, logToFile };

package/dist/{debug-ECdmmlDM.js → debug-DUmMVUHn.js}

@@ -69,7 +69,7 @@ const TASK_RUN_ID = runtimeEnv("POSTHOG_TASK_RUN_ID") || void 0;
 const TASK_ID = runtimeEnv("POSTHOG_TASK_ID") || void 0;
 //#endregion
 //#region src/lib/version.ts
-const VERSION = "2.74.0";
+const VERSION = "2.75.0";
 //#endregion
 //#region src/lib/constants.ts
 /**
@@ -322,181 +322,6 @@ function isTaskStatus(value) {
 	return Object.values(TaskStatus).includes(value);
 }
 //#endregion
-//#region src/lib/health-checks/statuspage.ts
-function mapIndicator(v) {
-	switch (v) {
-		case "none": return "healthy";
-		case "minor": return "degraded";
-		case "major":
-		case "critical": return "down";
-		default: return "degraded";
-	}
-}
-function mapComponentRaw(v) {
-	switch (v) {
-		case "operational": return "healthy";
-		case "degraded_performance":
-		case "under_maintenance": return "degraded";
-		case "partial_outage":
-		case "major_outage": return "down";
-		default: return "degraded";
-	}
-}
-function errResult$1(error) {
-	return {
-		status: "degraded",
-		error
-	};
-}
-async function fetchStatuspageIndicator(url, timeoutMs = 5e3) {
-	try {
-		const controller = new AbortController();
-		const tid = setTimeout(() => controller.abort(), timeoutMs);
-		const res = await fetch(url, { signal: controller.signal });
-		clearTimeout(tid);
-		if (!res.ok) return errResult$1(`HTTP ${res.status}`);
-		const indicator = (await res.json()).status?.indicator ?? null;
-		return {
-			status: mapIndicator(indicator),
-			rawIndicator: indicator ?? void 0
-		};
-	} catch (e) {
-		if (e instanceof Error && e.name === "AbortError") return errResult$1("Request timed out");
-		return errResult$1(e instanceof Error ? e.message : "Unknown error");
-	}
-}
-async function fetchStatuspageSummary(url, timeoutMs = 5e3) {
-	try {
-		const controller = new AbortController();
-		const tid = setTimeout(() => controller.abort(), timeoutMs);
-		const res = await fetch(url, { signal: controller.signal });
-		clearTimeout(tid);
-		if (!res.ok) return errResult$1(`HTTP ${res.status}`);
-		const data = await res.json();
-		const indicator = data.status?.indicator ?? null;
-		const overall = mapIndicator(indicator);
-		const affected = (data.components ?? []).map((c) => ({
-			name: c.name,
-			status: mapComponentRaw(c.status),
-			rawStatus: c.status
-		})).filter((c) => c.status !== "healthy");
-		return {
-			status: affected.length > 0 ? "degraded" : overall,
-			rawIndicator: indicator ?? void 0,
-			degradedOrDownComponents: affected.length > 0 ? affected : void 0
-		};
-	} catch (e) {
-		if (e instanceof Error && e.name === "AbortError") return errResult$1("Request timed out");
-		return errResult$1(e instanceof Error ? e.message : "Unknown error");
-	}
-}
-const checkAnthropicHealth = () => fetchStatuspageIndicator("https://status.claude.com/api/v2/status.json");
-const checkGithubHealth = () => fetchStatuspageIndicator("https://www.githubstatus.com/api/v2/status.json");
-const checkNpmOverallHealth = () => fetchStatuspageIndicator("https://status.npmjs.org/api/v2/status.json");
-const checkNpmComponentHealth = () => fetchStatuspageSummary("https://status.npmjs.org/api/v2/summary.json");
-const checkCloudflareOverallHealth = () => fetchStatuspageIndicator("https://www.cloudflarestatus.com/api/v2/status.json");
-const checkCloudflareComponentHealth = () => fetchStatuspageSummary("https://www.cloudflarestatus.com/api/v2/summary.json");
-//#endregion
-//#region src/lib/health-checks/incidentio.ts
-function mapIncidentImpact(impact) {
-	switch (impact) {
-		case "full_outage": return "down";
-		case "partial_outage":
-		case "degraded_performance": return "degraded";
-		default: return "degraded";
-	}
-}
-function mapComponentStatus(status) {
-	switch (status) {
-		case "operational": return "healthy";
-		case "full_outage": return "down";
-		case "partial_outage":
-		case "degraded_performance": return "degraded";
-		default: return "degraded";
-	}
-}
-/**
-* Build an error result for fetch failures. The kind matters for
-* downstream reconciliation:
-*
-*   - 'http' (incident.io returned a bad status code) → `Down`. We
-*     reached the status page but it told us something is wrong on
-*     its side. We have a definitive response.
-*   - 'network' (timeout, DNS failure, TCP/TLS failure) → `NoConnection`.
-*     We never reached the status page. Treating this as `Degraded`
-*     (the previous behavior) silently flipped the reconciliation in
-*     `readiness.ts` from "soft" to "confirmed outage" whenever the
-*     user's own network was flaky — exactly the false positive this
-*     module is meant to help diagnose.
-*/
-function errResult(error, kind) {
-	return {
-		status: kind === "http" ? "down" : "no-connection",
-		error
-	};
-}
-const POSTHOG_STATUS_URL = "https://www.posthogstatus.com/api/v1/summary";
-async function fetchPosthogStatus(timeoutMs = 5e3) {
-	try {
-		const controller = new AbortController();
-		const tid = setTimeout(() => controller.abort(), timeoutMs);
-		const res = await fetch(POSTHOG_STATUS_URL, { signal: controller.signal });
-		clearTimeout(tid);
-		if (!res.ok) {
-			const err = errResult(`HTTP ${res.status}`, "http");
-			return {
-				overall: err,
-				components: err
-			};
-		}
-		const incidents = (await res.json()).ongoing_incidents ?? [];
-		if (incidents.length === 0) return {
-			overall: { status: "healthy" },
-			components: { status: "healthy" }
-		};
-		let worstOverall = "degraded";
-		const affected = [];
-		for (const incident of incidents) {
-			if (mapIncidentImpact(incident.current_worst_impact) === "down") worstOverall = "down";
-			for (const comp of incident.affected_components ?? []) {
-				const compStatus = mapComponentStatus(comp.current_status);
-				if (compStatus !== "healthy") affected.push({
-					name: comp.group_name ? `${comp.group_name} — ${comp.name}` : comp.name,
-					status: compStatus,
-					rawStatus: comp.current_status
-				});
-			}
-		}
-		return {
-			overall: { status: worstOverall },
-			components: {
-				status: affected.length > 0 ? "degraded" : worstOverall,
-				degradedOrDownComponents: affected.length > 0 ? affected : void 0
-			}
-		};
-	} catch (e) {
-		if (e instanceof Error && e.name === "AbortError") {
-			const err = errResult("Request timed out", "network");
-			return {
-				overall: err,
-				components: err
-			};
-		}
-		const err = errResult(e instanceof Error ? e.message : "Unknown error", "network");
-		return {
-			overall: err,
-			components: err
-		};
-	}
-}
-let _cache = null;
-function getPosthogHealth() {
-	if (!_cache) _cache = fetchPosthogStatus();
-	return _cache;
-}
-const checkPosthogOverallHealth = async () => (await getPosthogHealth()).overall;
-const checkPosthogComponentHealth = async () => (await getPosthogHealth()).components;
-//#endregion
 //#region src/lib/health-checks/endpoints.ts
 function noConnectionResult(error, attempts) {
 	return {
@@ -563,11 +388,11 @@ async function fetchEndpointHealth(url, timeoutMs = 5e3, isExpectedStatus = (s)
 		}
 		lastError = outcome.timedOut ? `Request timed out after ${timeoutMs}ms` : outcome.error.message;
 	}
-	const result = lastHttpStatus !== null ? downResult(`HTTP ${lastHttpStatus} (attempts=${attempts})`, lastHttpStatus) : noConnectionResult(lastError, attempts);
+	const result = lastHttpStatus !== null ? downResult(`HTTP ${lastHttpStatus} (attempts=${attempts})`) : noConnectionResult(lastError, attempts);
 	logToFile(`[health-checks] GET ${url} -> ${result.status} (attempts=${attempts}, ${result.error})`);
 	return result;
 }
-const checkMcpHealth = () => fetchEndpointHealth("https://mcp.posthog.com/", 5e3, (s) => s >= 200 && s < 400, "manual");
+const checkLlmGatewayHealth = (gatewayUrl) => fetchEndpointHealth(new URL("/readyz", gatewayUrl).href);
 /**
 * Skills are published to two origins under the same filenames and
 * `fetchWithRetry` fails over between them, so the run is only blocked when
@@ -601,111 +426,11 @@ function withIndicatorSuffix(result, suffix) {
 }
 //#endregion
 //#region src/lib/health-checks/readiness.ts
-const SERVICE_LABELS = {
-	anthropic: "Anthropic",
-	posthogOverall: "PostHog",
-	posthogComponents: "PostHog (components)",
-	github: "GitHub",
-	npmOverall: "npm",
-	npmComponents: "npm (components)",
-	cloudflareOverall: "Cloudflare",
-	cloudflareComponents: "Cloudflare (components)",
-	mcp: "MCP",
-	skillsOrigin: "Skills download"
-};
-/**
-* See README section "Health checks" for the full rationale.
-* Adjust these arrays to change what blocks a wizard run.
-*
-* The AI gateway is not probed: its URL is only known from the run's token
-* mint, and a failed mint already stops the run at bootstrap with the
-* server's reason.
-*/
-const DEFAULT_WIZARD_READINESS_CONFIG = {
-	downBlocksRun: [
-		"anthropic",
-		"npmOverall",
-		"mcp",
-		"skillsOrigin"
-	],
-	degradedBlocksRun: ["anthropic"]
-};
-/**
-* Reduced readiness config for --signup provisioning flows.
-*
-* Provisioning only needs PostHog - it doesn't use Anthropic directly, npm,
-* the skills origins, or MCP.
-*/
-const SIGNUP_WIZARD_READINESS_CONFIG = { downBlocksRun: ["posthogOverall"] };
+const SERVICE_LABELS = { skillsOrigin: "Skills download" };
+const DEFAULT_WIZARD_READINESS_CONFIG = { downBlocksRun: ["skillsOrigin"] };
+const SIGNUP_WIZARD_READINESS_CONFIG = DEFAULT_WIZARD_READINESS_CONFIG;
 async function checkAllExternalServices() {
-	const [anthropic, posthogOverall, posthogComponents, github, npmOverall, npmComponents, cloudflareOverall, cloudflareComponents, mcp, skillsOrigin] = await Promise.all([
-		checkAnthropicHealth(),
-		checkPosthogOverallHealth(),
-		checkPosthogComponentHealth(),
-		checkGithubHealth(),
-		checkNpmOverallHealth(),
-		checkNpmComponentHealth(),
-		checkCloudflareOverallHealth(),
-		checkCloudflareComponentHealth(),
-		checkMcpHealth(),
-		checkSkillsOriginHealth()
-	]);
-	return reconcilePosthogReachability({
-		anthropic,
-		posthogOverall,
-		posthogComponents,
-		github,
-		npmOverall,
-		npmComponents,
-		cloudflareOverall,
-		cloudflareComponents,
-		mcp,
-		skillsOrigin
-	});
-}
-/**
-* When a PostHog-owned endpoint probe returns `NoConnection`, decide
-* whether it's a real outage or a likely-local issue by checking the
-* official status page (`posthogstatus.com`):
-*
-*   - Status page says PostHog is `Down` / `Degraded` → upgrade
-*     mcp to `Down`. The status page corroborates.
-*   - Status page is `Healthy` → keep `NoConnection`. The status page
-*     contradicts; this is probably the user's network.
-*   - Status page is also `NoConnection` → keep `NoConnection`. User
-*     can't reach two independent PostHog properties; almost
-*     certainly their network. (This case relies on incidentio.ts
-*     correctly emitting `NoConnection` for fetch failures rather
-*     than the previous `Degraded`, which used to silently flip the
-*     reconciliation into a false positive.)
-*
-* Why `Degraded` corroborates: a `Degraded` reading here only fires
-* when incident.io's API parsed successfully and reported a real
-* `partial_outage` or `degraded_performance` for some component. That's
-* PostHog acknowledging an issue, even if narrower than a full outage.
-* If our MCP probe is also failing, those two signals together
-* justify pointing at PostHog rather than the user.
-*
-* A narrower variant — only corroborate when the affected component is
-* MCP-related (US/EU Cloud, app) — would be more precise. We
-* have the data in `posthogComponents` but don't use it here. If the
-* analytics show false positives concentrated in this case, it's a
-* cheap follow-up.
-*
-* Mutates a copy of `health` and returns it.
-*/
-function reconcilePosthogReachability(health) {
-	const posthogStatus = health.posthogOverall.status;
-	if (!(posthogStatus === "down" || posthogStatus === "degraded")) return health;
-	const upgrade = (r) => r.status === "no-connection" ? {
-		...r,
-		status: "down",
-		error: r.error ? `${r.error} (corroborated by status page)` : "corroborated by status page"
-	} : r;
-	return {
-		...health,
-		mcp: upgrade(health.mcp)
-	};
+	return { skillsOrigin: await checkSkillsOriginHealth() };
 }
 function describeResult(label, h) {
 	const parts = [`${label}: ${h.status}`];
@@ -713,26 +438,12 @@ function describeResult(label, h) {
 	if (h.error) parts.push(h.error);
 	return parts.join(" — ");
 }
-const MAX_COMPONENT_NAMES = 8;
-function describeComponents(label, h) {
-	const affected = h.degradedOrDownComponents;
-	if (!affected || affected.length === 0) return `${label} components: all operational`;
-	const shown = affected.slice(0, MAX_COMPONENT_NAMES).map((c) => `${c.name} (${c.status})`);
-	const suffix = affected.length > MAX_COMPONENT_NAMES ? `, +${affected.length - MAX_COMPONENT_NAMES} more` : "";
-	return `${label} components impacted: ${shown.join(", ")}${suffix}`;
-}
 const READINESS_TIMEOUT_MS = 2e4;
 async function evaluateWizardReadiness(config = DEFAULT_WIZARD_READINESS_CONFIG) {
 	try {
 		const health = await Promise.race([checkAllExternalServices(), new Promise((resolve) => setTimeout(() => resolve(allUnknown("Health check timed out")), READINESS_TIMEOUT_MS))]);
-		const reasons = [];
-		for (const key of Object.keys(health)) {
-			const result = health[key];
-			const label = SERVICE_LABELS[key];
-			reasons.push(describeResult(label, result));
-			if ("degradedOrDownComponents" in result) reasons.push(describeComponents(label, result));
-		}
 		const blockingKeys = getBlockingServiceKeys(health, config);
+		const reasons = blockingKeys.map((key) => describeResult(SERVICE_LABELS[key], health[key]));
 		if (blockingKeys.length > 0) {
 			logToFile(`[health-checks] blocked by: ${blockingKeys.map((key) => {
 				const h = health[key];
@@ -744,11 +455,6 @@ async function evaluateWizardReadiness(config = DEFAULT_WIZARD_READINESS_CONFIG)
 				reasons
 			};
 		}
-		if (Object.values(health).some((h) => h.status !== "healthy")) return {
-			decision: "yes_with_warnings",
-			health,
-			reasons
-		};
 		return {
 			decision: "yes",
 			health,
@@ -759,27 +465,12 @@ async function evaluateWizardReadiness(config = DEFAULT_WIZARD_READINESS_CONFIG)
 		return {
 			decision: "yes",
 			health: allUnknown("Unexpected error"),
-			reasons: ["Health check failed unexpectedly — proceeding anyway"]
+			reasons: []
 		};
 	}
 }
-/** Keys that are component-level detail, not top-level services. */
-const COMPONENT_KEYS = [
-	"posthogComponents",
-	"npmComponents",
-	"cloudflareComponents"
-];
-/**
-* Get the keys of services that would block a wizard run per the given config.
-*
-* `NoConnection` blocks the same services as `Down` — the wizard genuinely
-* can't continue if it can't reach the gateway. The screen shows softer
-* framing in that case (HealthCheckScreen) so we don't falsely accuse
-* PostHog of an outage when the user's network is the likely cause.
-*/
 function getBlockingServiceKeys(health, config = DEFAULT_WIZARD_READINESS_CONFIG) {
 	return Object.keys(health).filter((key) => {
-		if (COMPONENT_KEYS.includes(key)) return false;
 		const result = health[key];
 		if (config.downBlocksRun.includes(key) && (result.status === "down" || result.status === "no-connection")) return true;
 		if ((config.degradedBlocksRun ?? []).includes(key) && result.status !== "healthy") return true;
@@ -788,22 +479,10 @@ function getBlockingServiceKeys(health, config = DEFAULT_WIZARD_READINESS_CONFIG
 }
 /** Build an AllServicesHealth where every service is Degraded with the given error. */
 function allUnknown(error) {
-	const base = {
+	return { skillsOrigin: {
 		status: "degraded",
 		error
-	};
-	return {
-		anthropic: base,
-		posthogOverall: base,
-		posthogComponents: { ...base },
-		github: base,
-		npmOverall: base,
-		npmComponents: { ...base },
-		cloudflareOverall: base,
-		cloudflareComponents: { ...base },
-		mcp: base,
-		skillsOrigin: base
-	};
+	} };
 }
 //#endregion
 //#region src/ui/logging-ui.ts
@@ -1021,7 +700,7 @@ let reportedLogFailure = false;
 function reportLogFailureOnce(err) {
 	if (reportedLogFailure) return;
 	reportedLogFailure = true;
-	import("./analytics-CfadnLFG.js").then(({ analytics }) => analytics.captureException(err instanceof Error ? err : new Error(String(err)), {
+	import("./analytics-yurAACt5.js").then(({ analytics }) => analytics.captureException(err instanceof Error ? err : new Error(String(err)), {
 		source: "log-file-write",
 		log_path: logFilePath,
 		platform: process.platform
@@ -1065,6 +744,6 @@ function enableDebugLogs() {
 	consoleLoggingEnabled = true;
 }
 //#endregion
-export { Sequence as $, DUMMY_PROJECT_API_KEY as A, OAUTH_PORTS as B, ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY as C, CONTEXT_MILL_URL as D, CONTEXT_MILL_RELEASES_URL as E, HAIKU_MODEL as F, POSTHOG_EU_CLIENT_ID as G, POSTHOG_APP_URL as H, HAIKU_TRIAGE_MODEL as I, POSTHOG_PROXY_CLIENT_ID as J, POSTHOG_ORG_AI_SETTINGS_URL as K, Harness as L, GPT5_6_LUNA_MODEL as M, GPT5_6_SOL_MODEL as N, DEFAULT_AGENT_MODEL as O, GPT5_6_TERRA_MODEL as P, SONNET_5_MODEL as Q, ISSUES_URL as R, ANALYTICS_HOST_URL as S, regionOption as St, AWS_SKILLS_BASE_URL as T, POSTHOG_DEV_CLIENT_ID as U, OAUTH_TIMEOUT_MS as V, POSTHOG_DOCS_URL as W, POSTHOG_TERMS_URL as X, POSTHOG_STATUS_PAGE_URL as Y, POSTHOG_US_CLIENT_ID as Z, evaluateWizardReadiness as _, TASK_ID as _t, getLogFilePath as a, WIZARD_ORCHESTRATOR_FLAG_KEY as at, isTaskStatus as b, headlessOption as bt, WIZARD_BENCHMARK_FILE as c, WIZARD_PROVISIONING_SCOPES as ct, relativeToInstallDir as d, WIZARD_USER_AGENT as dt, WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY as et, getUI as f, getSkillsBaseUrl as ft, SIGNUP_WIZARD_READINESS_CONFIG as g, RUN_SURFACE as gt, SERVICE_LABELS as h, NODE_ENV as ht, enableDebugLogs as i, WIZARD_OAUTH_SCOPES as it, GITHUB_SKILLS_BASE_URL as j, DETECTION_TIMEOUT_MS as k, WIZARD_LOG_FILE as l, WIZARD_REMARK_EVENT_NAME as lt, LoggingUI as m, VERSION as mt, configureLogFileFromEnvironment as n, WIZARD_FLAG_KEYS as nt, initLogFile as o, WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY as ot, setUI as p, wizardUserAgentForProgram as pt, POSTHOG_PRIVACY_URL as q, debug as r, WIZARD_INTERACTION_EVENT_NAME as rt, logToFile as s, WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY as st, configureLogFile as t, WIZARD_CONTACT_EMAIL as tt, WIZARD_YARA_REPORT_FILE as u, WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY as ut, getBlockingServiceKeys as v, TASK_RUN_ID as vt, ANALYTICS_TEAM_TAG as w, AGENTIC_DETECTION_TIMEOUT_MS as x, isHeadless as xt, TaskStatus as y, runtimeEnv as yt, Integration as z };
+export { SONNET_5_MODEL as $, DETECTION_TIMEOUT_MS as A, Integration as B, ANALYTICS_HOST_URL as C, regionOption as Ct, CONTEXT_MILL_RELEASES_URL as D, AWS_SKILLS_BASE_URL as E, GPT5_6_TERRA_MODEL as F, POSTHOG_DOCS_URL as G, OAUTH_TIMEOUT_MS as H, HAIKU_MODEL as I, POSTHOG_PRIVACY_URL as J, POSTHOG_EU_CLIENT_ID as K, HAIKU_TRIAGE_MODEL as L, GITHUB_SKILLS_BASE_URL as M, GPT5_6_LUNA_MODEL as N, CONTEXT_MILL_URL as O, GPT5_6_SOL_MODEL as P, POSTHOG_US_CLIENT_ID as Q, Harness as R, AGENTIC_DETECTION_TIMEOUT_MS as S, isHeadless as St, ANALYTICS_TEAM_TAG as T, POSTHOG_APP_URL as U, OAUTH_PORTS as V, POSTHOG_DEV_CLIENT_ID as W, POSTHOG_STATUS_PAGE_URL as X, POSTHOG_PROXY_CLIENT_ID as Y, POSTHOG_TERMS_URL as Z, evaluateWizardReadiness as _, RUN_SURFACE as _t, getLogFilePath as a, WIZARD_OAUTH_SCOPES as at, TaskStatus as b, runtimeEnv as bt, WIZARD_BENCHMARK_FILE as c, WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY as ct, relativeToInstallDir as d, WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY as dt, Sequence as et, getUI as f, WIZARD_USER_AGENT as ft, SIGNUP_WIZARD_READINESS_CONFIG as g, NODE_ENV as gt, SERVICE_LABELS as h, VERSION as ht, enableDebugLogs as i, WIZARD_INTERACTION_EVENT_NAME as it, DUMMY_PROJECT_API_KEY as j, DEFAULT_AGENT_MODEL as k, WIZARD_LOG_FILE as l, WIZARD_PROVISIONING_SCOPES as lt, LoggingUI as m, wizardUserAgentForProgram as mt, configureLogFileFromEnvironment as n, WIZARD_CONTACT_EMAIL as nt, initLogFile as o, WIZARD_ORCHESTRATOR_FLAG_KEY as ot, setUI as p, getSkillsBaseUrl as pt, POSTHOG_ORG_AI_SETTINGS_URL as q, debug as r, WIZARD_FLAG_KEYS as rt, logToFile as s, WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY as st, configureLogFile as t, WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY as tt, WIZARD_YARA_REPORT_FILE as u, WIZARD_REMARK_EVENT_NAME as ut, getBlockingServiceKeys as v, TASK_ID as vt, ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY as w, isTaskStatus as x, headlessOption as xt, checkLlmGatewayHealth as y, TASK_RUN_ID as yt, ISSUES_URL as z };
 
-//# sourceMappingURL=debug-ECdmmlDM.js.map
+//# sourceMappingURL=debug-DUmMVUHn.js.map