@posthog/wizard 2.76.1 → 2.78.0

package/dist/debug-DWYDVp0B.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"debug-DWYDVp0B.js","names":["join","sep"],"sources":["../src/lib/headless-mode.ts","../src/env.ts","../src/lib/version.ts","../src/lib/constants.ts","../src/ui/wizard-ui.ts","../src/lib/health-checks/endpoints.ts","../src/lib/health-checks/readiness.ts","../src/ui/logging-ui.ts","../src/ui/index.ts","../src/utils/paths.ts","../src/utils/debug.ts"],"sourcesContent":["/**\n * Headless mode — the published-build, non-interactive run path.\n *\n * The headless flag and `--ci` both drive a non-interactive install\n * (session.ci === true), but through dedicated entry points so they can\n * diverge: runHeadlessInstall → runWizardHeadless for headless,\n * runCIInstall → runWizardCI for `--ci`. Both delegate to one shared pipeline\n * (runNonInteractive) today; the only forks are the api-key prefixes accepted\n * (ci-install) and the analytics build tag (the mode passed to the runner).\n *\n * The flag is deliberately named `--headless-DONOTUSE-EXPERIMENTAL` and hidden\n * from `--help`: the contract is still unstable and subject to breaking\n * changes, so it must not be advertised or relied on by external callers. This\n * module is the single source of truth for the flag's name and detection — keep\n * the scary name out of every other file so a future rename is one edit here.\n */\n\nimport type { Options } from 'yargs';\n\n/**\n * The on-CLI flag name. Intentionally ugly + undocumented; do not surface it in\n * `--help`, the README, or user-facing error messages.\n */\nexport const HEADLESS_FLAG = 'headless-DONOTUSE-EXPERIMENTAL';\n\n/**\n * The yargs option declaration for the headless flag. Commands opt in so that\n * unsupported commands reject headless execution instead of starting it.\n */\nexport const headlessOption: Record<string, Options> = {\n  [HEADLESS_FLAG]: {\n    default: false,\n    // EXPERIMENTAL + UNSTABLE: the non-interactive published-build run path.\n    // Declared unconditionally (unlike --ci) so it works in the shipped\n    // package, but hidden and intentionally ugly-named — the contract may\n    // break without notice, so it must not be advertised.\n    describe:\n      'EXPERIMENTAL — do not use. Unstable, subject to breaking changes.',\n    type: 'boolean',\n    hidden: true,\n  },\n};\n\n/**\n * Read the headless signal off a parsed argv / options bag. yargs always sets\n * the value under the declared key (`HEADLESS_FLAG`), so reading that key is\n * reliable regardless of camel-case expansion.\n */\nexport function isHeadless(options: Record<string, unknown>): boolean {\n  return options[HEADLESS_FLAG] === true;\n}\n\n// `--region` only means something non-interactively (API-key auth has no OAuth\n// token response to read `posthog_region` from), so only headless-capable\n// commands declare it.\nexport const regionOption: Record<string, Options> = {\n  region: {\n    describe: 'PostHog cloud region\\nenv: POSTHOG_WIZARD_REGION',\n    choices: ['us', 'eu'],\n    type: 'string',\n    hidden: true,\n  },\n};\n","/**\n * Central environment variable access for the PostHog wizard.\n *\n * ── Build-time constants ────────────────────────────────────────────\n * Inlined by tsdown's `env` option at compile time. After build, the\n * runtime value of these env vars has zero effect on the wizard.\n *\n * ── Runtime variables ───────────────────────────────────────────────\n * Read through `runtimeEnv()` with a typed allowlist. This makes every\n * runtime dependency on the environment explicit and grep-able.\n *\n * ── Direct process.env access ───────────────────────────────────────\n * Reserved for subprocess environment configuration (writes) and\n * vendored code. Production source outside those cases should use\n * this module instead.\n */\n\nimport { HEADLESS_FLAG } from '@lib/headless-mode';\n\n// ── Build-time constants ─────────────────────────────────────────────\n// tsdown replaces `process.env.NODE_ENV` with a string literal.\n// After build these are just `\"production\"`, `false`, etc.\n\nexport const NODE_ENV = process.env.NODE_ENV as string;\nexport const IS_DEV =\n  process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test';\n\n/**\n * True only in published/production builds. tsdown inlines\n * `process.env.NODE_ENV` as the literal `\"production\"` at build time, so this\n * collapses to `true` in `dist/` and stays `false` for `tsx`/dev/test runs\n * (where NODE_ENV is unset, `development`, or `test`). Used to gate features\n * that aren't supported in the shipped package — e.g. `--ci` mode.\n */\nexport const IS_PRODUCTION_BUILD = process.env.NODE_ENV === 'production';\n\n/** 'cloud' when launched with the experimental headless flag, else 'local' — resolved once from argv at launch. */\nexport const RUN_SURFACE: 'cloud' | 'local' = process.argv.some(\n  (a) => a === `--${HEADLESS_FLAG}` || a.startsWith(`--${HEADLESS_FLAG}=`),\n)\n  ? 'cloud'\n  : 'local';\n\n// ── Runtime environment ──────────────────────────────────────────────\n\n/**\n * Exhaustive allowlist of env vars the wizard reads at runtime.\n * Add new keys here when a new runtime dependency is needed.\n */\ntype RuntimeEnvKey =\n  // CI-build-only flag overrides (see utils/ci-flag-overrides.ts).\n  // Deliberately NOT POSTHOG_WIZARD_-prefixed: yargs .env('POSTHOG_WIZARD')\n  // would claim it as an unknown CLI option and strict-reject the run.\n  | 'WIZARD_CI_FLAG_OVERRIDES'\n  | 'WIZARD_CI_EXCLUDE_TASKS'\n  | 'WIZARD_CI_GATEWAY_TOKEN_FILE'\n  | 'WIZARD_CI_GATEWAY_URL'\n  // Wizard CLI configuration (yargs POSTHOG_WIZARD_ prefix)\n  | 'POSTHOG_WIZARD_BENCHMARK_CONFIG'\n  | 'POSTHOG_WIZARD_BENCHMARK_FILE'\n  | 'POSTHOG_WIZARD_LOG_DIR'\n  | 'POSTHOG_WIZARD_DEBUG'\n  // Identity of the PostHog task run whose sandbox launched this wizard. Set by\n  // the sandbox for every run it starts, agent or wizard. Deliberately NOT\n  // POSTHOG_WIZARD_-prefixed, for the same reason as the two keys above:\n  // yargs .env('POSTHOG_WIZARD') would claim them as CLI options and\n  // .strictOptions() would reject the run unless the wizard also declared them,\n  // which would tie every sandbox deploy to an npm release of this package.\n  | 'POSTHOG_TASK_RUN_ID'\n  | 'POSTHOG_TASK_ID'\n  | 'POSTHOG_HANDOFF_OUTPUT_PATH'\n  // Local/CI escape hatch to disable Warlock scanning without the PostHog flag.\n  | 'POSTHOG_WIZARD_WARLOCK_DISABLED'\n  | 'DEBUG'\n  // Agent / MCP\n  | 'MCP_URL'\n  | 'POSTHOG_API_KEY'\n  // Platform: terminal detection\n  | 'TERM'\n  | 'TERM_PROGRAM'\n  | 'TERMINAL_EMULATOR'\n  | 'CI'\n  | 'WT_SESSION'\n  | 'TERMINUS_SUBLIME'\n  | 'ConEmuTask'\n  // Platform: paths\n  | 'APPDATA'\n  | 'OPENCODE_CONFIG_DIR'\n  | 'XDG_CONFIG_HOME';\n\n/** Read a runtime environment variable. Only allowlisted keys compile. */\nexport function runtimeEnv(key: RuntimeEnvKey): string | undefined {\n  return process.env[key];\n}\n\n/**\n * The PostHog task run that launched this wizard, when one did. A cloud run's\n * sandbox exports both ids into the wizard's environment; every local run\n * leaves them undefined. Resolved once at launch, like RUN_SURFACE above.\n */\nexport const TASK_RUN_ID: string | undefined =\n  runtimeEnv('POSTHOG_TASK_RUN_ID') || undefined;\nexport const TASK_ID: string | undefined =\n  runtimeEnv('POSTHOG_TASK_ID') || undefined;\n","// Auto-generated by scripts/generate-version.js — do not edit\nexport const VERSION = '2.76.1';\n","/**\n * Shared constants for the PostHog wizard.\n */\n\nimport { VERSION } from './version';\n\n// ── Models ──────────────────────────────────────────────────────────\n// Coordinate IDs/efforts with the mint allowlists and gateway transport/required prompt policy; see agent/runner/README.md.\n\n/** Next sonnet generation (a `MODEL_FLAG_VARIANTS` key in the switchboard). */\nexport const SONNET_5_MODEL = 'claude-sonnet-5';\n\n/**\n * Default model for agent runs. Bare model IDs (no `anthropic/` prefix) so the\n * LLM gateway's Bedrock fallback can match map_to_bedrock_model().\n */\nexport const DEFAULT_AGENT_MODEL = SONNET_5_MODEL;\n\n/** Undated haiku, for scan triage. The alias tracks the current 4.5 release rather than pinning one. */\nexport const HAIKU_TRIAGE_MODEL = 'claude-haiku-4-5';\n\n/**\n * Cheaper, faster model for mechanical agent work (e.g. repo classification\n * during source-map detection). Passed via AgentConfig.modelOverride.\n */\nexport const HAIKU_MODEL = HAIKU_TRIAGE_MODEL;\n\n// Locally supported OpenAI models; constants alone do not authorize gateway use.\nexport const GPT5_6_LUNA_MODEL = 'openai/gpt-5.6-luna';\nexport const GPT5_6_TERRA_MODEL = 'openai/gpt-5.6-terra';\nexport const GPT5_6_SOL_MODEL = 'openai/gpt-5.6-sol';\n\n// ── Agent runner routing axes ────────────────────────────────────────\n\n/**\n * The two agent runner routing axes: **harness** (which agent SDK drives the LLM)\n * and **sequence** (which pipeline shape orchestrates the work). Single source\n * of truth for yargs `choices`, session fields, the runner registry, and tests\n * — `Object.values(Harness)` gives an iterable of the values when an array is\n * needed. Adding a member is enough to pick it up everywhere.\n *\n * Naming matches the directory layout — see `src/lib/agent/runner/harness/`\n * and `src/lib/agent/runner/sequence/`.\n */\nexport enum Harness {\n  anthropic = 'anthropic',\n  pi = 'pi',\n}\n\nexport enum Sequence {\n  linear = 'linear',\n  orchestrator = 'orchestrator',\n}\n\n/**\n * What kind of call produced a gateway generation — the `call_type` trace tag.\n * Splits a program's LLM spend by workload. Every member is sent explicitly so\n * an absent value means \"old build\", not \"agent\".\n */\nexport enum CallType {\n  /** The agent doing the work the user asked for. */\n  agent = 'agent',\n  /** Warlock's classifier deciding whether a YARA match is a true positive. */\n  yaraTriage = 'yara-triage',\n  /** The cheap repo scan that classifies which projects a program acts on. */\n  detection = 'detection',\n}\n\n// ── Integration / CLI ───────────────────────────────────────────────\n\n/**\n * Detection order matters: put framework-specific integrations BEFORE basic language fallbacks.\n */\nexport enum Integration {\n  // Frameworks\n  nextjs = 'nextjs',\n  nuxt = 'nuxt',\n  vue = 'vue',\n  reactRouter = 'react-router',\n  tanstackStart = 'tanstack-start',\n  tanstackRouter = 'tanstack-router',\n  reactNative = 'react-native',\n  angular = 'angular',\n  astro = 'astro',\n  django = 'django',\n  flask = 'flask',\n  fastapi = 'fastapi',\n  laravel = 'laravel',\n  sveltekit = 'sveltekit',\n  flutter = 'flutter',\n  kmp = 'kmp',\n  swift = 'swift',\n  android = 'android',\n  rails = 'rails',\n  elixir = 'elixir',\n  go = 'go',\n  rust = 'rust',\n  // Must stay after kmp/swift/android: those claim gradle projects first.\n  java = 'java',\n\n  // Language fallbacks. Keep javascriptNode last: it matches any package.json.\n  python = 'python',\n  ruby = 'ruby',\n  javascript_web = 'javascript_web',\n  javascriptNode = 'javascript_node',\n}\n\nexport interface Args {\n  debug: boolean;\n  integration: Integration;\n}\n\n// ── Environment ──────────────────────────────────────────────────────\n\nimport { IS_DEV } from '@env';\nimport {\n  CONTEXT_MILL_LOCAL_URL,\n  getLocalDev,\n  POSTHOG_LOCAL_URL,\n} from './local-dev';\nexport { IS_DEV };\nexport const DEBUG = false;\n\n// ── URLs ─────────────────────────────────────────────────────────────\n\nexport const DEFAULT_URL = IS_DEV\n  ? POSTHOG_LOCAL_URL\n  : 'https://us.posthog.com';\n/**\n * Region-agnostic PostHog app URL. Resolves to us.posthog.com or\n * eu.posthog.com server-side based on the signed-in user's profile.\n * Use this for share-with-user links (e.g. settings pages) so they\n * land on the right region without us needing to know it client-side.\n */\nexport const POSTHOG_APP_URL = IS_DEV\n  ? POSTHOG_LOCAL_URL\n  : 'https://app.posthog.com';\nexport const DEFAULT_HOST_URL = IS_DEV\n  ? POSTHOG_LOCAL_URL\n  : 'https://us.i.posthog.com';\nexport const ISSUES_URL = 'https://github.com/posthog/wizard/issues';\n/** Public status page, linked from transient-failure guidance (e.g. OAuth server_error). */\nexport const POSTHOG_STATUS_PAGE_URL = 'https://www.posthogstatus.com';\nexport const CONTEXT_MILL_URL = 'https://github.com/PostHog/context-mill';\n/**\n * Latest context-mill release page — the BYOAI download link shown in\n * the privacy panel. Deliberately the release PAGE, not a direct asset\n * URL: asset URLs are ~89 chars and hard-wrap inside the 64-col panel,\n * which corrupts terminal copy/paste with a mid-URL line break. This\n * stays under one line; the panel names the exact asset to grab.\n */\nexport const CONTEXT_MILL_RELEASES_URL =\n  'https://github.com/PostHog/context-mill/releases/latest';\nexport const POSTHOG_DOCS_URL = 'https://posthog.com/docs';\nexport const POSTHOG_WIZARD_REPO_URL = 'https://github.com/PostHog/wizard';\nexport const POSTHOG_TERMS_URL = 'https://posthog.com/terms';\nexport const POSTHOG_PRIVACY_URL = 'https://posthog.com/privacy';\nexport const POSTHOG_ORG_AI_SETTINGS_URL =\n  'https://app.posthog.com/settings/organization-details#setting=organization-ai-consent';\nexport const WIZARD_CONTACT_EMAIL = 'wizard@posthog.com';\n\n/**\n * Two origins for the same release, same filenames. Interchangeable bases, so\n * making AWS primary is a `getSkillsBaseUrl` change, not a code change.\n */\nexport const GITHUB_SKILLS_BASE_URL =\n  'https://github.com/PostHog/context-mill/releases/latest/download';\nexport const AWS_SKILLS_BASE_URL = 'https://context-mill.posthog.com/latest';\n/** Alias of `@lib/local-dev`'s constant, kept for existing importers. */\nexport const LOCAL_SKILLS_BASE_URL = CONTEXT_MILL_LOCAL_URL;\n\n/**\n * Driven by `--local-context-mill`, NOT `--local-mcp` (which used to select\n * both). Takes no argument on purpose: callers can't pass the wrong flag.\n */\nexport function getSkillsBaseUrl(): string {\n  return getLocalDev().localContextMill\n    ? LOCAL_SKILLS_BASE_URL\n    : GITHUB_SKILLS_BASE_URL;\n}\n\n// ── Analytics (internal) ──────────────────────────────────────────────\n\nexport const ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY = 'sTMFPsFhdP1Ssg';\nexport const ANALYTICS_HOST_URL = 'https://internal-j.posthog.com';\nexport const ANALYTICS_TEAM_TAG = 'docs-and-wizard';\n\n// ── OAuth / Auth ────────────────────────────────────────────────────\n\nexport const OAUTH_PORTS = [8239, 8238, 8240, 8237, 8236, 8235] as const;\nexport const POSTHOG_US_CLIENT_ID = 'c4Rdw8DIxgtQfA80IiSnGKlNX8QN00cFWF00QQhM';\nexport const POSTHOG_EU_CLIENT_ID = 'bx2C5sZRN03TkdjraCcetvQFPGH6N2Y9vRLkcKEy';\nexport const POSTHOG_DEV_CLIENT_ID = 'DC5uRLVbGI02YQ82grxgnK6Qn12SXWpCqdPb60oZ';\nexport const POSTHOG_PROXY_CLIENT_ID = POSTHOG_US_CLIENT_ID;\nexport const DUMMY_PROJECT_API_KEY = '_YOUR_POSTHOG_PROJECT_TOKEN_';\n\n/**\n * Scopes the wizard requests during the agentic provisioning signup flow.\n *\n * Each entry is justified by what the wizard's agent step does after signup:\n * - user:read         identify the user for analytics + agent context\n * - project:read      look up the freshly-provisioned project\n * - llm_gateway:read  authenticate to gateway.{us,eu}.posthog.com/wizard\n *                     (the agent's LLM calls — without this scope, every\n *                     agent message returns 401)\n * - query:read        run HogQL queries when the agent needs data\n * - dashboard:write   create the onboarding dashboard during setup\n * - insight:write     create the onboarding insights during setup\n * - notebook:write    upload the events-audit report as a PostHog notebook\n *                     in step 6 of the events-audit skill (notebooks-create\n *                     MCP tool requires this scope)\n * - event_definition:write\n *                     create event definitions from the completed wizard\n *                     session's event plan\n *\n * Must be a subset of `ALLOWED_PROVISIONING_SCOPES` in\n * `ee/api/agentic_provisioning/views.py` on the backend.\n */\nexport const WIZARD_PROVISIONING_SCOPES = [\n  'user:read',\n  'project:read',\n  'llm_gateway:read',\n  'dashboard:write',\n  'insight:write',\n  'query:read',\n  'notebook:write',\n  'event_definition:write',\n] as const;\n\n/**\n * Scopes the wizard requests during the OAuth login flow. Superset of\n * `WIZARD_PROVISIONING_SCOPES` with scopes that only apply to the login\n * path and are not in the provisioning allowlist:\n * - health_issue:read     used by `wizard doctor`\n * - wizard_session:read   list / retrieve / stream sessions\n * - wizard_session:write  stream run state to /api/projects/{id}/wizard/sessions/\n * - event_definition:write\n *                          create event definitions when a session completes\n * - organization:read     read `organization.is_ai_data_processing_approved`\n *                         from /api/users/@me/ for the AI opt-in gate\n *\n * NOTE: every scope here must be within the wizard OAuth application's\n * server-side scope ceiling (`OAuthApplication.scopes` in posthog, set\n * via Django admin on BOTH prod regions). A scope outside the ceiling\n * does NOT fail the authorize request — the server silently clamps the\n * request to the ceiling (`clamp_scopes_to_ceiling` in posthog) and the\n * token comes back without it. Separately, the consent screen lets the\n * user deselect any scope the app doesn't mark required. Both paths\n * yield a granted `scope` narrower than requested, with no error, so\n * never assume the token carries this list — the token response's\n * `scope` field is the truth, and `missingOAuthScopes` (utils/oauth.ts)\n * diffs it at login. Ceiling procedure: the \"scope-ceiling-invalid-scope\"\n * runbook in PostHog/runbooks. Keep its worked example in sync when this\n * list changes.\n */\nexport const WIZARD_OAUTH_SCOPES = [\n  ...WIZARD_PROVISIONING_SCOPES,\n  'health_issue:read',\n  'wizard_session:read',\n  'wizard_session:write',\n  'organization:read',\n] as const;\n\n// ── Wizard run / variants ───────────────────────────────────────────\n\nexport const WIZARD_INTERACTION_EVENT_NAME = 'wizard interaction';\nexport const WIZARD_REMARK_EVENT_NAME = 'wizard remark';\n/** Boolean feature flag that routes a run to the experimental orchestrator runner. */\nexport const WIZARD_ORCHESTRATOR_FLAG_KEY = 'wizard-orchestrator';\n/** Multivariate flag: per-stage orchestrator overrides ride each variant's JSON payload (`{stage: {model?, effort?}}`). */\nexport const WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY =\n  'wizard-orchestrator-override';\n/** Boolean flag: on → pi for self-driving. Payload carries `{model, effort?, harness?, sequence?}` (model = a `MODEL_FLAG_VARIANTS` key); missing/invalid payload keeps the non-flagged default. */\nexport const WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY =\n  'wizard-self-driving-use-pi-harness';\n/** Boolean flag: agentic project scoping for non-interactive basic-integration runs. */\nexport const WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY =\n  'wizard-basic-integration-agentic-detection';\n/** Boolean flag: the orchestrator queues the program's runner-seeded tasks (the warehouse step). Off, no task is queued and the run is byte-identical to a no-sources project. */\nexport const WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY =\n  'wizard-orchestrator-seeded-tasks';\n// Reading a flag enters this run into that flag's experiment, so a closed set — not a\n// `wizard-` prefix anyone can name into — decides what a run evaluates. Test-pinned exhaustive.\nexport const WIZARD_FLAG_KEYS = [\n  WIZARD_ORCHESTRATOR_FLAG_KEY,\n  WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY,\n  WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY,\n  WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY,\n  WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY,\n] as const;\n/** User-Agent for wizard HTTP requests and MCP server identification. */\nexport const WIZARD_USER_AGENT = `posthog/wizard; version: ${VERSION}`;\n\n/**\n * User-Agent for a specific program's MCP calls, tagged with `program: <id>` so the\n * backend can attribute work per program (e.g. the `self-driving` program's warehouse\n * sources are recorded as `created_via=self_driving` rather than plain `wizard`). The\n * base `posthog/wizard` token is preserved, so anything keying only on that still matches.\n */\nexport function wizardUserAgentForProgram(programId?: string): string {\n  return programId\n    ? `${WIZARD_USER_AGENT}; program: ${programId}`\n    : WIZARD_USER_AGENT;\n}\n\n// ── Timeouts ─────────────────────────────────────────────────────────\n\n/** Timeout for framework / project detection probes (ms). */\nexport const DETECTION_TIMEOUT_MS = 10_000;\n\n/** Timeout for the agentic project scan (ms); past it the run falls back to root detection. */\nexport const AGENTIC_DETECTION_TIMEOUT_MS = 60_000;\n\n/**\n * Timeout for the OAuth authorization flow (ms).\n *\n * How long the user has to complete the browser login. The authorization\n * code is minted at approval and exchanged immediately on callback, so the\n * server-side code expiry (`AUTHORIZATION_CODE_EXPIRE_SECONDS`, 5 minutes)\n * bounds only the approval→exchange gap — manual-paste users have 5 minutes\n * from approval to submit the code — not how long this window may stay open.\n */\nexport const OAUTH_TIMEOUT_MS = 1_800_000;\n","/**\n * WizardUI — abstraction layer for all user-facing operations.\n *\n * Business logic calls `getUI()` instead of importing the store directly.\n * Implementations: InkUI (TUI), LoggingUI (CI).\n *\n * No prompt methods — the TUI screens own all user input.\n * Session-mutating methods trigger reactive screen resolution in the TUI.\n */\n\nimport type { SettingsConflict } from '@lib/agent/claude-settings';\nimport type { WizardReadinessResult } from '@lib/health-checks/readiness';\nimport type { ApiUser } from '@lib/api';\nimport type { Credentials, TaskNotice } from '@lib/wizard-session';\nimport type {\n  AskAnswers,\n  OutroData,\n  PendingQuestion,\n} from '@lib/wizard-session';\n\nexport enum TaskStatus {\n  Pending = 'pending',\n  InProgress = 'in_progress',\n  Completed = 'completed',\n  Skipped = 'skipped',\n}\n\nexport function isTaskStatus(value: string): value is TaskStatus {\n  return (Object.values(TaskStatus) as string[]).includes(value);\n}\n\n/**\n * One assistant turn's token usage, for the hidden Ctrl+T token/cost HUD.\n * `model` is the model that produced *this* turn (e.g. the SDK's\n * `message.message.model`) — a subagent can run on a different model than\n * the main session, and some programs override to Haiku, so pricing must key\n * off the per-turn model rather than a single run-wide assumption. Omit only\n * when the caller genuinely has no model context (falls back to Sonnet\n * pricing — see `pricePerMtokForModel` in `@lib/agent/token-pricing`).\n */\nexport interface TokenUsageDelta {\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheCreationTokens: number;\n  cacheCreation5m: number;\n  cacheCreation1h: number;\n  model?: string;\n}\n\nexport interface SpinnerHandle {\n  start(message?: string): void;\n  stop(message?: string): void;\n  message(msg?: string): void;\n}\n\n/**\n * Context passed to `showAuthError` so the screen can pick the right copy.\n *\n * `hasSettingsConflict` is true when a Claude Code settings file (project,\n * project-local, the user's global config, or managed) actually overrides the\n * LLM Gateway auth. `conflicts` carries the exact files and keys so the screen\n * can name them. When there is no conflict, the 401 has a different cause (bad\n * PAT prefix, missing scope, expired key, region mismatch) and we should not\n * advise the user to log out of Claude Code.\n */\nexport interface AuthErrorDetail {\n  hasSettingsConflict: boolean;\n  conflicts?: SettingsConflict[];\n  /**\n   * True when the agent SDK authenticated from a stored Claude login\n   * (`apiKeySource: \"/login managed key\"`) instead of the wizard's gateway\n   * token — conflicting Anthropic credentials. Takes priority in the screen.\n   */\n  usingManagedLogin?: boolean;\n  /** Human-readable places a conflicting Anthropic credential may live. */\n  credentialPlaces?: string[];\n  /**\n   * True when a pre-run refresh already failed on a dead grant. The login is\n   * gone and re-running is the only fix, so this outranks every other branch —\n   * none of the usual advice (key type, scopes, region) applies.\n   */\n  sessionExpired?: boolean;\n  logFilePath: string;\n}\n\nexport interface WizardUI {\n  // ── Lifecycle messages ────────────────────────────────────────────\n  intro(message: string): void;\n  /** Success outro with a plain text message. */\n  outro(message: string): void;\n  /**\n   * Error outro. Sets structured outroData and transitions run phase so\n   * the router advances to the outro screen. Use for abort/failure paths\n   * that need a custom error render — do NOT build the outroData by\n   * mutating session directly (nanostore holds a shallow copy).\n   */\n  outroError(data: OutroData): void;\n  /** Resolves when the user dismisses the outro screen (presses any key).\n   *  Lets the abort path wait for the user to read the error before the\n   *  process exits. Resolves immediately in non-TUI environments. */\n  waitForOutroDismissed(): Promise<void>;\n  cancel(message: string): void;\n\n  // ── Logging ───────────────────────────────────────────────────────\n  log: {\n    info(message: string): void;\n    warn(message: string): void;\n    error(message: string): void;\n    success(message: string): void;\n    step(message: string): void;\n  };\n\n  note(message: string): void;\n  pushStatus(message: string): void;\n\n  // ── Spinner ───────────────────────────────────────────────────────\n  spinner(): SpinnerHandle;\n\n  // ── Session state (triggers reactive screen resolution in TUI) ────\n  /** Signal that the main work (agent run) has started. */\n  startRun(): void;\n\n  /** Store OAuth/API credentials. Resolves past AuthScreen in TUI. */\n  setCredentials(credentials: Credentials): void;\n\n  /**\n   * Replace the credentials after a token refresh. Same store write as\n   * {@link setCredentials} without the `auth complete` capture — the user\n   * authenticated once, and a refresh is not a second login.\n   */\n  setAccessToken(credentials: Credentials): void;\n\n  /**\n   * Persist the user's `role_at_organization` once it's been fetched from\n   * `/api/users/@me/`. Drives role-tailored prompt suggestions on the\n   * McpSuggestedPromptsScreen. Pass `null` to clear / when unknown.\n   */\n  setRoleAtOrganization(role: string | null): void;\n\n  /**\n   * Persist the full user payload from `/api/users/@me/` so downstream\n   * screens can read account context (current org, team, plan, email,\n   * preferences, etc.) without re-fetching. Pass `null` to clear or\n   * when the request failed.\n   */\n  setApiUser(user: ApiUser | null): void;\n\n  /**\n   * Park until the org's AI opt-in gate clears\n   * (`organization.is_ai_data_processing_approved === true`, or the\n   * program never registered the gate — requiresAi: false / no auth\n   * step / CI session). The agent runner awaits this after setApiUser\n   * and BEFORE skill install or agent start: this is the enforcement\n   * point that keeps source on the machine while the TUI shows\n   * AiOptInRequiredScreen. Resolves immediately in non-TUI\n   * environments (CI auto-consents to AI usage).\n   */\n  waitForAiOptIn(): Promise<void>;\n\n  /** Show blocking service outage (pushes outage overlay in TUI). Blocks until dismissed. */\n  showBlockingOutage(result: WizardReadinessResult): Promise<void>;\n\n  /** Store non-blocking readiness warnings (shown as Health tab in RunScreen). */\n  setReadinessWarnings(result: WizardReadinessResult): void;\n\n  /** Warn that another process is blocking the OAuth port (pushes overlay in TUI). */\n  showPortConflict(processInfo: {\n    command: string;\n    pid: string;\n    port: number;\n    user: string;\n  }): Promise<void>;\n\n  /**\n   * Resolve with an OAuth authorization code the user enters by hand — the\n   * fallback for headless/remote shells where the browser can't reach the\n   * local callback server. The OAuth flow races this against the callback\n   * server. Implementations that can't prompt (CI/logging) never resolve.\n   */\n  waitForManualAuthCode(): Promise<string>;\n\n  showSettingsOverride(\n    conflicts: SettingsConflict[],\n    backupAndFix: () => boolean,\n  ): Promise<void>;\n\n  /**\n   * Show an optional step's notice and return whether to keep that step. Hosts\n   * that cannot prompt resolve false: a step nobody can answer must not run.\n   */\n  showTaskNotice(notice: TaskNotice): Promise<boolean>;\n\n  /**\n   * Dismiss an in-flight task notice as declined. Called when the offer times\n   * out: the notice sits in front of the run's final steps, so left unanswered\n   * it would hold the report behind a modal nobody is looking at.\n   */\n  cancelTaskNotice(): void;\n\n  /** Show auth error overlay when Anthropic API returns 401. */\n  showAuthError(detail?: AuthErrorDetail): void;\n\n  /** Show the session-timeout overlay when the OAuth login window expires. */\n  showSessionTimeout(): void;\n\n  /**\n   * Open the wizard_ask overlay and resolve with the user's answers.\n   * Implementations that can't ask (CI/logging) reject so the bridge can\n   * surface a clear \"not available\" error to the agent.\n   */\n  requestQuestion(question: PendingQuestion): Promise<AskAnswers>;\n\n  /**\n   * Dismiss the in-flight wizard_ask overlay, resolving its request with\n   * cancelled sentinels. No-op when nothing is pending. The ask bridge calls\n   * this on timeout so a stale pending question can't block later asks.\n   */\n  cancelPendingQuestion(): void;\n\n  // ── Display state ──────────────────────────────────────────────────\n  /** Set the detected framework label (e.g., \"Django with Wagtail CMS\") */\n  setDetectedFramework(label: string): void;\n\n  /** Register a callback to run when the TUI transitions onto the given screen. */\n  onEnterScreen(screen: string, fn: () => void): void;\n\n  setLoginUrl(url: string | null): void;\n\n  /** Direct PostHog authorize URL, shown in the manual-paste modal. */\n  setAuthorizeUrl(url: string | null): void;\n\n  // ── Task tracking from SDK TaskCreate/TaskUpdate events ───────────\n  // Receives the full materialised task list each call. The caller (agent\n  // loop) maintains a Map<taskId, …> from incremental Task* events and\n  // re-emits the snapshot here, preserving the existing store semantics.\n  syncTodos(\n    todos: Array<{ content: string; status: string; activeForm?: string }>,\n  ): void;\n\n  // ── Event plan from .posthog-events.json ────────────────────\n  setEventPlan(events: Array<{ name: string; description: string }>): void;\n\n  // ── Dashboard URL emitted by the agent via [DASHBOARD_URL] marker ──\n  setDashboardUrl(url: string): void;\n\n  /** Current \"stage of work\" — derived from the active tool call. Drives the\n   *  Visualizer tab's NOW PLAYING display. Pass an AgentPhase value. */\n  setStage(stage: string): void;\n\n  // ── Notebook URL emitted by the agent via [NOTEBOOK_URL] marker ──\n  setNotebookUrl(url: string): void;\n\n  /** Handoff doc from the `publish_handoff` tool; the task-stream push carries it as `handoff_text`. */\n  setHandoffText(text: string): void;\n\n  /** Accumulate one assistant turn's token usage into the hidden Ctrl+T\n   *  token/cost HUD's running estimate. No-op outside the TUI. */\n  addTokenUsage(delta: TokenUsageDelta): void;\n\n  /** Reconcile the HUD's running cost estimate to the SDK's authoritative\n   *  `total_cost_usd` once the agent run completes. No-op outside the TUI. */\n  setFinalTokenCostUsd(costUsd: number): void;\n\n  // ── Outro payload built by agent-runner ──\n  // Replaces the direct `session.outroData = X` mutation that breaks once\n  // setKey-based store mutations have forked the session reference.\n  setOutroData(data: OutroData): void;\n\n  // ── Generic frameworkContext setter for program file watchers ─────\n  setFrameworkContext(key: string, value: unknown): void;\n\n  /** Read a frameworkContext value from the LIVE session (store may have\n   * forked the reference the runner holds). Used by run configs to read\n   * values written by post-auth screens (e.g. the source-maps picker). */\n  getFrameworkContext(key: string): unknown;\n\n  /** Park until the named program step's gate predicate flips true. Resolves\n   * immediately if the step has no gate. Mirrors waitForAiOptIn for any\n   * post-auth interactive step the agent run must wait on. */\n  waitForGate(stepId: string): Promise<void>;\n}\n","import { AWS_SKILLS_BASE_URL, GITHUB_SKILLS_BASE_URL } from '@lib/constants';\nimport { logToFile } from '@utils/debug';\nimport { ServiceHealthStatus, type BaseHealthResult } from './types';\n\n// Direct gateway and skill-origin checks distinguish HTTP failures from connection failures.\n\nfunction noConnectionResult(error: string, attempts: number): BaseHealthResult {\n  return {\n    status: ServiceHealthStatus.NoConnection,\n    error,\n    rawIndicator: attempts > 1 ? `attempts=${attempts}` : undefined,\n  };\n}\n\nfunction downResult(error: string): BaseHealthResult {\n  return { status: ServiceHealthStatus.Down, error };\n}\n\n// Backoffs sized to cover typical wifi flakiness — a single dropped\n// packet recovers via the 500ms retry; a wifi access point reconnect\n// or wifi↔LTE handoff (2-5s) is caught by the 2000ms retry. Tighter\n// schedules miss multi-second blips because all retries land in the\n// same dead window.\nconst RETRY_BACKOFFS_MS = [500, 2000];\n\nasync function attemptFetch(\n  url: string,\n  timeoutMs: number,\n  redirect: 'follow' | 'manual' | 'error',\n): Promise<\n  | { kind: 'response'; res: Response }\n  | { kind: 'error'; error: Error; timedOut: boolean }\n> {\n  const controller = new AbortController();\n  const tid = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    const res = await fetch(url, { signal: controller.signal, redirect });\n    clearTimeout(tid);\n    return { kind: 'response', res };\n  } catch (e) {\n    clearTimeout(tid);\n    const err = e instanceof Error ? e : new Error('Unknown error');\n    return { kind: 'error', error: err, timedOut: err.name === 'AbortError' };\n  }\n}\n\n// Exported so tests can pin the retry/taxonomy machinery directly.\nexport async function fetchEndpointHealth(\n  url: string,\n  timeoutMs = 5000,\n  isExpectedStatus: (status: number) => boolean = (s) => s === 200,\n  redirect: 'follow' | 'manual' | 'error' = 'follow',\n): Promise<BaseHealthResult> {\n  // Total attempts = 1 initial + RETRY_BACKOFFS_MS.length retries. Both\n  // unexpected HTTP statuses (4xx/5xx) and network errors trigger a retry:\n  // transient 5xx and Cloudflare edge blips often recover on a retry, and\n  // even nominally deterministic 4xx can be transient (CDN propagation\n  // lag after a release, token rotation, rate-limit window resets). GETs\n  // are idempotent so retrying is safe.\n  //\n  // Final status if every attempt fails:\n  //   - At least one HTTP response observed → `Down` (server-side evidence)\n  //   - Only network errors observed         → `NoConnection`\n  let lastHttpStatus: number | null = null;\n  let lastError = 'Unknown error';\n  let attempts = 0;\n\n  for (let i = 0; i <= RETRY_BACKOFFS_MS.length; i++) {\n    if (i > 0) {\n      const wait = RETRY_BACKOFFS_MS[i - 1];\n      logToFile(\n        `[health-checks] retry ${i}/${RETRY_BACKOFFS_MS.length} for ${url} in ${wait}ms (last: ${lastError})`,\n      );\n      await new Promise((r) => setTimeout(r, wait));\n    }\n    attempts++;\n\n    const outcome = await attemptFetch(url, timeoutMs, redirect);\n\n    if (outcome.kind === 'response') {\n      const res = outcome.res;\n      if (isExpectedStatus(res.status)) {\n        const result: BaseHealthResult = {\n          status: ServiceHealthStatus.Healthy,\n          rawIndicator:\n            attempts > 1\n              ? `HTTP ${res.status} (attempts=${attempts})`\n              : `HTTP ${res.status}`,\n        };\n        logToFile(\n          `[health-checks] GET ${url} -> ${result.status}` +\n            ` (${result.rawIndicator})`,\n        );\n        return result;\n      }\n      lastHttpStatus = res.status;\n      lastError = `HTTP ${res.status}`;\n      continue;\n    }\n\n    lastError = outcome.timedOut\n      ? `Request timed out after ${timeoutMs}ms`\n      : outcome.error.message;\n  }\n\n  const result =\n    lastHttpStatus !== null\n      ? downResult(`HTTP ${lastHttpStatus} (attempts=${attempts})`)\n      : noConnectionResult(lastError, attempts);\n  logToFile(\n    `[health-checks] GET ${url} -> ${result.status}` +\n      ` (attempts=${attempts}, ${result.error})`,\n  );\n  return result;\n}\n\nexport const checkLlmGatewayHealth = (\n  gatewayUrl: string,\n): Promise<BaseHealthResult> =>\n  fetchEndpointHealth(new URL('/readyz', gatewayUrl).href);\n\n/**\n * Skills are published to two origins under the same filenames and\n * `fetchWithRetry` fails over between them, so the run is only blocked when\n * neither answers. Probed in parallel — sequential probes would double the\n * worst case past `READINESS_TIMEOUT_MS`.\n */\nexport const checkSkillsOriginHealth = async (): Promise<BaseHealthResult> => {\n  const [github, aws] = await Promise.all([\n    fetchEndpointHealth(`${GITHUB_SKILLS_BASE_URL}/skill-menu.json`),\n    fetchEndpointHealth(`${AWS_SKILLS_BASE_URL}/skill-menu.json`),\n  ]);\n  return combineOriginHealth(github, aws);\n};\n\n/**\n * Mirrors `fetchWithRetry`: a download tries GitHub, then AWS, so the run is\n * only blocked when neither origin answers. Whichever failure the probes saw,\n * one origin serving means skills are reachable.\n */\nfunction combineOriginHealth(\n  github: BaseHealthResult,\n  aws: BaseHealthResult,\n): BaseHealthResult {\n  if (github.status === ServiceHealthStatus.Healthy) {\n    // Naming the dead origin makes a one-sided outage legible in the log and\n    // in the readiness reasons, where the status alone reads as \"fine\".\n    return aws.status === ServiceHealthStatus.Healthy\n      ? github\n      : withIndicatorSuffix(github, 'aws unavailable');\n  }\n\n  if (aws.status === ServiceHealthStatus.Healthy) {\n    return withIndicatorSuffix(aws, 'via aws, github unavailable');\n  }\n\n  const error = `github: ${github.error ?? 'unknown'} | aws: ${\n    aws.error ?? 'unknown'\n  }`;\n  const confirmedDown =\n    github.status === ServiceHealthStatus.Down ||\n    aws.status === ServiceHealthStatus.Down;\n  return {\n    status: confirmedDown\n      ? ServiceHealthStatus.Down\n      : ServiceHealthStatus.NoConnection,\n    error,\n    // Keeps the `attempts=N` the blocked-readiness analytics parses.\n    rawIndicator: github.rawIndicator ?? aws.rawIndicator,\n  };\n}\n\nfunction withIndicatorSuffix(\n  result: BaseHealthResult,\n  suffix: string,\n): BaseHealthResult {\n  return {\n    ...result,\n    rawIndicator: result.rawIndicator\n      ? `${result.rawIndicator} (${suffix})`\n      : suffix,\n  };\n}\n","import {\n  ServiceHealthStatus,\n  type AllServicesHealth,\n  type BaseHealthResult,\n  type HealthCheckKey,\n} from './types';\nimport { checkSkillsOriginHealth } from './endpoints';\nimport { logToFile } from '@utils/debug';\n\n// ---------------------------------------------------------------------------\n// Service labels (used in human-readable reason strings)\n// ---------------------------------------------------------------------------\n\nexport const SERVICE_LABELS: Record<HealthCheckKey, string> = {\n  skillsOrigin: 'Skills download',\n};\n\n// ---------------------------------------------------------------------------\n// Readiness config\n// ---------------------------------------------------------------------------\n\nexport interface WizardReadinessConfig {\n  /** Services where status=Down blocks the run (readiness=No). */\n  downBlocksRun: HealthCheckKey[];\n  /** Services where status=Degraded (or worse) blocks the run (readiness=No). */\n  degradedBlocksRun?: HealthCheckKey[];\n}\n\n// Skills gate startup; gateway readiness is checked against the minted URL.\nexport const DEFAULT_WIZARD_READINESS_CONFIG: WizardReadinessConfig = {\n  downBlocksRun: ['skillsOrigin'],\n};\n\nexport const SIGNUP_WIZARD_READINESS_CONFIG = DEFAULT_WIZARD_READINESS_CONFIG;\n\n// ---------------------------------------------------------------------------\n// Aggregate check\n// ---------------------------------------------------------------------------\n\nexport async function checkAllExternalServices(): Promise<AllServicesHealth> {\n  return { skillsOrigin: await checkSkillsOriginHealth() };\n}\n\n// ---------------------------------------------------------------------------\n// Wizard readiness evaluation\n// ---------------------------------------------------------------------------\n\nexport enum WizardReadiness {\n  Yes = 'yes',\n  No = 'no',\n  YesWithWarnings = 'yes_with_warnings',\n}\n\nexport interface WizardReadinessResult {\n  decision: WizardReadiness;\n  health: AllServicesHealth;\n  reasons: string[];\n}\n\nfunction describeResult(label: string, h: BaseHealthResult): string {\n  const parts = [`${label}: ${h.status}`];\n  if (h.rawIndicator) parts.push(`indicator=${h.rawIndicator}`);\n  if (h.error) parts.push(h.error);\n  return parts.join(' — ');\n}\n\n// Each probe can take up to one base timeout + two retries with the\n// 500ms / 2000ms backoffs in endpoints.ts (worst case ~17.5s for a\n// network failure that exhausts retries). Probes run in parallel so\n// the aggregate ceiling is one probe, not the sum.\nconst READINESS_TIMEOUT_MS = 20_000;\n\nexport async function evaluateWizardReadiness(\n  config: WizardReadinessConfig = DEFAULT_WIZARD_READINESS_CONFIG,\n): Promise<WizardReadinessResult> {\n  try {\n    const health = await Promise.race([\n      checkAllExternalServices(),\n      new Promise<AllServicesHealth>((resolve) =>\n        setTimeout(\n          () => resolve(allUnknown('Health check timed out')),\n          READINESS_TIMEOUT_MS,\n        ),\n      ),\n    ]);\n\n    const blockingKeys = getBlockingServiceKeys(health, config);\n    const reasons = blockingKeys.map((key) =>\n      describeResult(SERVICE_LABELS[key], health[key]),\n    );\n    if (blockingKeys.length > 0) {\n      const blockingDetails = blockingKeys.map((key) => {\n        const h = health[key];\n        return `${key} (${h.status}${h.error ? ` — ${h.error}` : ''})`;\n      });\n      logToFile(`[health-checks] blocked by: ${blockingDetails.join(', ')}`);\n      return { decision: WizardReadiness.No, health, reasons };\n    }\n\n    return { decision: WizardReadiness.Yes, health, reasons };\n  } catch (err) {\n    logToFile(\n      `[health-checks] error: ${err instanceof Error ? err.message : err}`,\n    );\n    // Health checks must never block the wizard run\n    return {\n      decision: WizardReadiness.Yes,\n      health: allUnknown('Unexpected error'),\n      reasons: [],\n    };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Blocking service detection\n// ---------------------------------------------------------------------------\n\n// Report only dependencies that prevent this run from starting.\nexport function getBlockingServiceKeys(\n  health: AllServicesHealth,\n  config: WizardReadinessConfig = DEFAULT_WIZARD_READINESS_CONFIG,\n): HealthCheckKey[] {\n  return (Object.keys(health) as HealthCheckKey[]).filter((key) => {\n    const result = health[key];\n    if (\n      config.downBlocksRun.includes(key) &&\n      (result.status === ServiceHealthStatus.Down ||\n        result.status === ServiceHealthStatus.NoConnection)\n    ) {\n      return true;\n    }\n    if (\n      (config.degradedBlocksRun ?? []).includes(key) &&\n      result.status !== ServiceHealthStatus.Healthy\n    ) {\n      return true;\n    }\n    return false;\n  });\n}\n\n/** Build an AllServicesHealth where every service is Degraded with the given error. */\nfunction allUnknown(error: string): AllServicesHealth {\n  const base: BaseHealthResult = {\n    status: ServiceHealthStatus.Degraded,\n    error,\n  };\n  return { skillsOrigin: base };\n}\n","/* eslint-disable no-console */\n/**\n * LoggingUI — Logging-only implementation for CI mode.\n * No prompts, no TUI, no interactivity. Just console output.\n */\n\nimport {\n  TaskStatus,\n  type WizardUI,\n  type SpinnerHandle,\n  type AuthErrorDetail,\n  type TokenUsageDelta,\n} from './wizard-ui';\nimport type { SettingsConflict } from '@lib/agent/claude-settings';\nimport type { ApiUser } from '@lib/api';\nimport { OAUTH_TIMEOUT_MS } from '@lib/constants';\nimport {\n  type WizardReadinessResult,\n  getBlockingServiceKeys,\n  SERVICE_LABELS,\n} from '@lib/health-checks/readiness';\nimport type {\n  AskAnswers,\n  Credentials,\n  OutroData,\n  PendingQuestion,\n  TaskNotice,\n} from '@lib/wizard-session';\n\nexport class LoggingUI implements WizardUI {\n  intro(message: string): void {\n    console.log(`┌  ${message}`);\n  }\n\n  outro(message: string): void {\n    console.log(`└  ${message}`);\n  }\n\n  outroError(data: OutroData): void {\n    console.log(`✖  ${data.message ?? 'Wizard aborted'}`);\n    if (data.body) console.log(`│  ${data.body}`);\n    if (data.docsUrl) console.log(`│  Docs: ${data.docsUrl}`);\n  }\n\n  waitForOutroDismissed(): Promise<void> {\n    return Promise.resolve();\n  }\n\n  waitForAiOptIn(): Promise<void> {\n    // Non-TUI runs are CI runs, which auto-consent to AI usage.\n    return Promise.resolve();\n  }\n\n  cancel(message: string): void {\n    console.log(`■  ${message}`);\n  }\n\n  log = {\n    info(message: string): void {\n      console.log(`│  ${message}`);\n    },\n    warn(message: string): void {\n      console.log(`▲  ${message}`);\n    },\n    error(message: string): void {\n      console.log(`✖  ${message}`);\n    },\n    success(message: string): void {\n      console.log(`✔  ${message}`);\n    },\n    step(message: string): void {\n      console.log(`◇  ${message}`);\n    },\n  };\n\n  note(message: string): void {\n    console.log(`│  ${message}`);\n  }\n\n  spinner(): SpinnerHandle {\n    return {\n      start(message?: string) {\n        if (message) console.log(`◌  ${message}`);\n      },\n      stop(message?: string) {\n        if (message) console.log(`●  ${message}`);\n      },\n      message(msg?: string) {\n        if (msg) console.log(`◌  ${msg}`);\n      },\n    };\n  }\n\n  pushStatus(message: string): void {\n    console.log(`◇  ${message}`);\n  }\n\n  setDetectedFramework(label: string): void {\n    console.log(`✔  Framework: ${label}`);\n  }\n\n  onEnterScreen(_screen: string, _fn: () => void): void {\n    // No screen transitions in CI\n  }\n\n  setLoginUrl(url: string | null): void {\n    if (url) {\n      console.log(\n        `│  If the browser didn't open automatically, use this link:`,\n      );\n      console.log(`│  ${url}`);\n    }\n  }\n\n  setAuthorizeUrl(_url: string | null): void {\n    // Manual-paste modal is TUI-only; CI/non-interactive runs don't use it.\n  }\n\n  showBlockingOutage(result: WizardReadinessResult): Promise<void> {\n    console.log(`▲  Service health issues detected.`);\n    const blockingKeys = getBlockingServiceKeys(result.health);\n    if (blockingKeys.length > 0) {\n      console.log(`│`);\n      console.log(`│  Blocking services:`);\n      for (const key of blockingKeys) {\n        const status = result.health[key].status;\n        const error = result.health[key].error;\n        const label = SERVICE_LABELS[key];\n        const detail = error ? ` — ${error}` : '';\n        console.log(`│    ✖ ${label}: ${status}${detail}`);\n      }\n      console.log(`│`);\n    }\n    for (const reason of result.reasons) {\n      console.log(`│  ${reason}`);\n    }\n    console.log(\n      `│  Continuing anyway — health checks are advisory in non-interactive runs.`,\n    );\n    return Promise.resolve();\n  }\n\n  setReadinessWarnings(result: WizardReadinessResult): void {\n    console.log(`▲  Service health warnings detected.`);\n    for (const reason of result.reasons) {\n      console.log(`│  ${reason}`);\n    }\n  }\n\n  showPortConflict(_processInfo: {\n    command: string;\n    pid: string;\n    port: number;\n    user: string;\n  }): Promise<void> {\n    return Promise.resolve();\n  }\n\n  waitForManualAuthCode(): Promise<string> {\n    // No interactive prompt in CI/logging mode — never resolves. CI bypasses\n    // OAuth entirely, so this is only here to satisfy the interface.\n    return new Promise<string>(() => {\n      /* intentionally never resolves */\n    });\n  }\n\n  showTaskNotice(_notice: TaskNotice): Promise<boolean> {\n    return Promise.resolve(false);\n  }\n\n  cancelTaskNotice(): void {\n    // Nothing to dismiss — showTaskNotice never opened anything.\n  }\n\n  showSettingsOverride(\n    _conflicts: SettingsConflict[],\n    _backupAndFix: () => boolean,\n  ): Promise<void> {\n    return Promise.resolve();\n  }\n\n  requestQuestion(_question: PendingQuestion): Promise<AskAnswers> {\n    return Promise.reject(\n      new Error(\n        'wizard_ask is not available in CI / non-interactive mode. ' +\n          'Re-run the wizard without --ci to answer interactively.',\n      ),\n    );\n  }\n\n  cancelPendingQuestion(): void {\n    // Nothing to dismiss — requestQuestion never opens an overlay here.\n  }\n\n  showAuthError(detail?: AuthErrorDetail): void {\n    console.log(`✖  Authentication failed (401)`);\n    if (detail?.hasSettingsConflict) {\n      console.log(\n        `│  Claude Code auth is conflicting with the wizard. Please try again after logging out:`,\n      );\n      console.log(`│    claude auth logout`);\n    } else {\n      console.log(\n        `│  The PostHog LLM Gateway rejected the API key. Common causes:`,\n      );\n      console.log(\n        `│    - Wrong key type: pass a personal API key (phx_xxx). pha_ is an OAuth access token, phc_ is a project key.`,\n      );\n      console.log(\n        `│    - Missing scope: the personal API key needs the \"llm_gateway:read\" scope.`,\n      );\n      console.log(`│    - Expired or revoked key.`);\n      console.log(\n        `│    - Region mismatch: --region must match the region the key was issued in (us vs eu).`,\n      );\n    }\n    if (detail?.logFilePath) {\n      console.log(`│  Verbose log: ${detail.logFilePath}`);\n    }\n  }\n\n  showSessionTimeout(): void {\n    const minutes = Math.round(OAUTH_TIMEOUT_MS / 60_000);\n    console.log(\n      `✖  Login timed out. The OAuth link timed out after ${minutes} minutes.`,\n    );\n    console.log(`│  Re-run the wizard to get a fresh link and try again.`);\n  }\n\n  startRun(): void {\n    // No-op in CI mode\n  }\n\n  setCredentials(_credentials: Credentials): void {\n    // No-op in CI mode — credentials are handled directly\n  }\n\n  setAccessToken(_credentials: Credentials): void {\n    // No-op in CI mode — CI runs on a non-expiring key and never refreshes\n  }\n\n  setRoleAtOrganization(_role: string | null): void {\n    // No-op in CI mode — there's no TUI to render role-tailored prompts\n  }\n\n  setApiUser(_user: ApiUser | null): void {\n    // No-op in CI mode — there's no TUI to read account context from\n    // the session.\n  }\n\n  private lastTodoLine = '';\n\n  syncTodos(\n    todos: Array<{ content: string; status: string; activeForm?: string }>,\n  ): void {\n    const completed = todos.filter(\n      (t) => t.status === TaskStatus.Completed,\n    ).length;\n    const active = todos.filter((t) => t.status === TaskStatus.InProgress);\n    if (active.length === 0) return;\n    const labels = active.map((t) => t.activeForm || t.content).join(' · ');\n    const line = `◌  [${completed}/${todos.length}] ${labels}`;\n    // The queue re-renders on every transition; print only what changed.\n    if (line === this.lastTodoLine) return;\n    this.lastTodoLine = line;\n    console.log(line);\n  }\n\n  setEventPlan(_events: Array<{ name: string; description: string }>): void {\n    // No-op in CI mode\n  }\n\n  setDashboardUrl(_url: string): void {\n    // No-op in CI mode\n  }\n\n  setStage(_stage: string): void {\n    // No-op in CI mode\n  }\n\n  setNotebookUrl(_url: string): void {\n    // No-op in CI mode\n  }\n\n  setHandoffText(_text: string): void {\n    // No-op without a store — HeadlessUI overrides to feed the session sync\n  }\n\n  addTokenUsage(_delta: TokenUsageDelta): void {\n    // No-op — the hidden Ctrl+T HUD is TUI-only\n  }\n\n  setFinalTokenCostUsd(_costUsd: number): void {\n    // No-op — the hidden Ctrl+T HUD is TUI-only\n  }\n\n  setOutroData(_data: import('@lib/wizard-session').OutroData): void {\n    // No-op in CI mode\n  }\n\n  setFrameworkContext(_key: string, _value: unknown): void {\n    // No-op in CI mode\n  }\n\n  getFrameworkContext(_key: string): unknown {\n    // No frameworkContext in CI mode\n    return undefined;\n  }\n\n  waitForGate(_stepId: string): Promise<void> {\n    // No interactive gates in CI mode\n    return Promise.resolve();\n  }\n}\n","/**\n * UI singleton — provides getUI() and setUI() for the wizard.\n * Default: LoggingUI. Swap to InkUI at startup for TUI mode.\n */\n\nimport type { WizardUI } from './wizard-ui';\nimport { LoggingUI } from './logging-ui';\n\nlet currentUI: WizardUI = new LoggingUI();\n\nexport function getUI(): WizardUI {\n  return currentUI;\n}\n\nexport function setUI(ui: WizardUI): void {\n  currentUI = ui;\n}\n\nexport type { WizardUI, SpinnerHandle } from './wizard-ui';\n","import { tmpdir } from 'node:os';\nimport { join, sep } from 'node:path';\n\n// /tmp is stable and discoverable on macOS/Linux; Windows needs os.tmpdir()\nconst TMP = process.platform === 'win32' ? tmpdir() : '/tmp';\n\nexport const WIZARD_LOG_FILE = join(TMP, 'posthog-wizard.log');\nexport const WIZARD_BENCHMARK_FILE = join(TMP, 'posthog-wizard-benchmark.json');\n/** Default target of `--task-stream-log`. Dev builds only. */\nexport const WIZARD_TASK_STREAM_FILE = join(\n  TMP,\n  'posthog-wizard-task-stream.jsonl',\n);\nexport const WIZARD_YARA_REPORT_FILE = join(\n  TMP,\n  'posthog-wizard-yara-report.json',\n);\n/**\n * Strip an absolute installDir prefix off a project file path so the UI\n * renders `index.js:12` instead of `/Users/.../index.js:12`. Defends\n * against false matches like `/Users/foo` ⊂ `/Users/foobar/x.js` by\n * normalizing to a trailing path separator before the prefix check.\n */\nexport function relativeToInstallDir(file: string, installDir: string): string {\n  const prefix = installDir.endsWith(sep) ? installDir : installDir + sep;\n  return file.startsWith(prefix) ? file.slice(prefix.length) : file;\n}\n","import { appendFileSync, mkdirSync } from 'fs';\nimport path from 'path';\nimport { inspect } from 'node:util';\nimport { getUI } from '@ui';\nimport { IS_DEV, runtimeEnv } from '@env';\nimport { WIZARD_LOG_FILE } from './paths';\n\n// Dev builds may redirect the log so concurrent runs don't interleave one file.\nlet logFilePath =\n  (IS_DEV && process.env.POSTHOG_WIZARD_LOG_FILE) || WIZARD_LOG_FILE;\nlet fileLoggingEnabled = true;\nlet consoleLoggingEnabled = false;\n\nfunction stringify(value: unknown): string {\n  if (typeof value === 'string') return value;\n  if (value instanceof Error) return value.stack ?? String(value);\n  try {\n    // JSON.stringify throws on cycles and skips some values — fall back to\n    // inspect so a crash log line is never dropped.\n    return JSON.stringify(value, null, 2) ?? inspect(value, { depth: 3 });\n  } catch {\n    return inspect(value, { depth: 3 });\n  }\n}\n\nfunction renderLine(args: readonly unknown[]): string {\n  return args.map(stringify).join(' ');\n}\n\nexport function getLogFilePath(): string {\n  return logFilePath;\n}\n\nexport function configureLogFile(opts: {\n  path?: string;\n  enabled?: boolean;\n}): void {\n  if (opts.path !== undefined) {\n    logFilePath = opts.path;\n    ensuredLogDir = false;\n  }\n  if (opts.enabled !== undefined) fileLoggingEnabled = opts.enabled;\n}\n\nlet ensuredLogDir = false;\nlet reportedLogFailure = false;\n\n// Failed log writes go to error tracking, once per process. Dynamic import:\n// analytics logs through this module, so a static import would be a cycle.\nfunction reportLogFailureOnce(err: unknown): void {\n  if (reportedLogFailure) return;\n  reportedLogFailure = true;\n  void import('./analytics')\n    .then(({ analytics }) =>\n      analytics.captureException(\n        err instanceof Error ? err : new Error(String(err)),\n        {\n          source: 'log-file-write',\n          log_path: logFilePath,\n          platform: process.platform,\n        },\n      ),\n    )\n    .catch(() => {\n      // Reporting must never crash the wizard either.\n    });\n}\n\n// The log's directory isn't guaranteed to exist (Windows %TEMP%,\n// POSTHOG_WIZARD_LOG_DIR) — create it on first failure.\nfunction appendLine(text: string): void {\n  try {\n    appendFileSync(logFilePath, text);\n  } catch (err) {\n    if (ensuredLogDir) {\n      reportLogFailureOnce(err);\n      return;\n    }\n    ensuredLogDir = true;\n    try {\n      mkdirSync(path.dirname(logFilePath), { recursive: true });\n      appendFileSync(logFilePath, text);\n    } catch (retryErr) {\n      reportLogFailureOnce(retryErr);\n    }\n  }\n}\n\nexport function configureLogFileFromEnvironment(): void {\n  const dir = runtimeEnv('POSTHOG_WIZARD_LOG_DIR');\n  if (dir) {\n    configureLogFile({ path: path.join(dir, 'posthog-wizard.log') });\n  }\n}\n\nexport function initLogFile(): void {\n  if (!fileLoggingEnabled) return;\n  const divider = '='.repeat(60);\n  appendLine(\n    `\\n${divider}\\nPostHog Wizard Run: ${new Date().toISOString()}\\n${divider}\\n`,\n  );\n}\n\nexport function logToFile(...args: unknown[]): void {\n  if (!fileLoggingEnabled) return;\n  const ts = new Date().toISOString();\n  appendLine(`[${ts}] ${renderLine(args)}\\n`);\n}\n\nexport function debug(...args: unknown[]): void {\n  if (!consoleLoggingEnabled) return;\n  getUI().log.info(renderLine(args));\n}\n\nexport function enableDebugLogs(): void {\n  consoleLoggingEnabled = true;\n}\n"],"mappings":";;;;;;;;;;;AAuBA,MAAa,gBAAgB;;;;;AAM7B,MAAa,iBAA0C,GACpD,gBAAgB;CACf,SAAS;CAKT,UACE;CACF,MAAM;CACN,QAAQ;CACT,EACF;;;;;;AAOD,SAAgB,WAAW,SAA2C;AACpE,QAAO,QAAQ,mBAAmB;;AAMpC,MAAa,eAAwC,EACnD,QAAQ;CACN,UAAU;CACV,SAAS,CAAC,MAAM,KAAK;CACrB,MAAM;CACN,QAAQ;CACT,EACF;;;;;;;;;;;;;;;;;;;ACvCD,MAAa,WAAA;;AAcb,MAAa,cAAiC,QAAQ,KAAK,MACxD,MAAM,MAAM,sCAAwB,EAAE,WAAW,oCAAsB,CACzE,GACG,UACA;;AAkDJ,SAAgB,WAAW,KAAwC;AACjE,QAAO,QAAQ,IAAI;;;;;;;AAQrB,MAAa,cACX,WAAW,sBAAsB,IAAI,KAAA;AACvC,MAAa,UACX,WAAW,kBAAkB,IAAI,KAAA;;;ACtGnC,MAAa,UAAU;;;;;;;ACSvB,MAAa,iBAAiB;;;;;AAM9B,MAAa,sBAAsB;;AAGnC,MAAa,qBAAqB;;;;;AAMlC,MAAa,cAAc;AAG3B,MAAa,oBAAoB;AACjC,MAAa,qBAAqB;AAClC,MAAa,mBAAmB;;;;;;;;;;;AAchC,IAAY,UAAL,yBAAA,SAAA;AACL,SAAA,eAAA;AACA,SAAA,QAAA;;KACD;AAED,IAAY,WAAL,yBAAA,UAAA;AACL,UAAA,YAAA;AACA,UAAA,kBAAA;;KACD;;;;AAqBD,IAAY,cAAL,yBAAA,aAAA;AAEL,aAAA,YAAA;AACA,aAAA,UAAA;AACA,aAAA,SAAA;AACA,aAAA,iBAAA;AACA,aAAA,mBAAA;AACA,aAAA,oBAAA;AACA,aAAA,iBAAA;AACA,aAAA,aAAA;AACA,aAAA,WAAA;AACA,aAAA,YAAA;AACA,aAAA,WAAA;AACA,aAAA,aAAA;AACA,aAAA,aAAA;AACA,aAAA,eAAA;AACA,aAAA,aAAA;AACA,aAAA,SAAA;AACA,aAAA,WAAA;AACA,aAAA,aAAA;AACA,aAAA,WAAA;AACA,aAAA,YAAA;AACA,aAAA,QAAA;AACA,aAAA,UAAA;AAEA,aAAA,UAAA;AAGA,aAAA,YAAA;AACA,aAAA,UAAA;AACA,aAAA,oBAAA;AACA,aAAA,oBAAA;;KACD;;;;;;;AA6BD,MAAa,kBAET;AAIJ,MAAa,aAAa;;AAE1B,MAAa,0BAA0B;AACvC,MAAa,mBAAmB;;;;;;;;AAQhC,MAAa,4BACX;AACF,MAAa,mBAAmB;AAEhC,MAAa,oBAAoB;AACjC,MAAa,sBAAsB;AACnC,MAAa,8BACX;AACF,MAAa,uBAAuB;;;;;AAMpC,MAAa,yBACX;AACF,MAAa,sBAAsB;;AAEnC,MAAa,wBAAwB;;;;;AAMrC,SAAgB,mBAA2B;AACzC,QAAO,aAAa,CAAC,mBACjB,wBACA;;AAKN,MAAa,6CAA6C;AAC1D,MAAa,qBAAqB;AAClC,MAAa,qBAAqB;AAIlC,MAAa,cAAc;CAAC;CAAM;CAAM;CAAM;CAAM;CAAM;CAAK;AAC/D,MAAa,uBAAuB;AACpC,MAAa,uBAAuB;AACpC,MAAa,wBAAwB;AACrC,MAAa,0BAA0B;AACvC,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;AAwBrC,MAAa,6BAA6B;CACxC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BD,MAAa,sBAAsB;CACjC,GAAG;CACH;CACA;CACA;CACA;CACD;AAID,MAAa,gCAAgC;AAC7C,MAAa,2BAA2B;;AAExC,MAAa,+BAA+B;;AAE5C,MAAa,wCACX;;AAEF,MAAa,8CACX;;AAEF,MAAa,sDACX;;AAEF,MAAa,4CACX;AAGF,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACD;;AAED,MAAa,oBAAoB,4BAA4B;;;;;;;AAQ7D,SAAgB,0BAA0B,WAA4B;AACpE,QAAO,YACH,GAAG,kBAAkB,aAAa,cAClC;;;AAMN,MAAa,uBAAuB;;AAGpC,MAAa,+BAA+B;;;;;;;;;;AAW5C,MAAa,mBAAmB;;;AC9ShC,IAAY,aAAL,yBAAA,YAAA;AACL,YAAA,aAAA;AACA,YAAA,gBAAA;AACA,YAAA,eAAA;AACA,YAAA,aAAA;;KACD;AAED,SAAgB,aAAa,OAAoC;AAC/D,QAAQ,OAAO,OAAO,WAAW,CAAc,SAAS,MAAM;;;;ACtBhE,SAAS,mBAAmB,OAAe,UAAoC;AAC7E,QAAO;EACL,QAAA;EACA;EACA,cAAc,WAAW,IAAI,YAAY,aAAa,KAAA;EACvD;;AAGH,SAAS,WAAW,OAAiC;AACnD,QAAO;EAAE,QAAA;EAAkC;EAAO;;AAQpD,MAAM,oBAAoB,CAAC,KAAK,IAAK;AAErC,eAAe,aACb,KACA,WACA,UAIA;CACA,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,MAAM,iBAAiB,WAAW,OAAO,EAAE,UAAU;AAC3D,KAAI;EACF,MAAM,MAAM,MAAM,MAAM,KAAK;GAAE,QAAQ,WAAW;GAAQ;GAAU,CAAC;AACrE,eAAa,IAAI;AACjB,SAAO;GAAE,MAAM;GAAY;GAAK;UACzB,GAAG;AACV,eAAa,IAAI;EACjB,MAAM,MAAM,aAAa,QAAQ,oBAAI,IAAI,MAAM,gBAAgB;AAC/D,SAAO;GAAE,MAAM;GAAS,OAAO;GAAK,UAAU,IAAI,SAAS;GAAc;;;AAK7E,eAAsB,oBACpB,KACA,YAAY,KACZ,oBAAiD,MAAM,MAAM,KAC7D,WAA0C,UACf;CAW3B,IAAI,iBAAgC;CACpC,IAAI,YAAY;CAChB,IAAI,WAAW;AAEf,MAAK,IAAI,IAAI,GAAG,KAAK,kBAAkB,QAAQ,KAAK;AAClD,MAAI,IAAI,GAAG;GACT,MAAM,OAAO,kBAAkB,IAAI;AACnC,aACE,yBAAyB,EAAE,GAAG,kBAAkB,OAAO,OAAO,IAAI,MAAM,KAAK,YAAY,UAAU,GACpG;AACD,SAAM,IAAI,SAAS,MAAM,WAAW,GAAG,KAAK,CAAC;;AAE/C;EAEA,MAAM,UAAU,MAAM,aAAa,KAAK,WAAW,SAAS;AAE5D,MAAI,QAAQ,SAAS,YAAY;GAC/B,MAAM,MAAM,QAAQ;AACpB,OAAI,iBAAiB,IAAI,OAAO,EAAE;IAChC,MAAM,SAA2B;KAC/B,QAAA;KACA,cACE,WAAW,IACP,QAAQ,IAAI,OAAO,aAAa,SAAS,KACzC,QAAQ,IAAI;KACnB;AACD,cACE,uBAAuB,IAAI,MAAM,OAAO,OAAA,IACjC,OAAO,aAAa,GAC5B;AACD,WAAO;;AAET,oBAAiB,IAAI;AACrB,eAAY,QAAQ,IAAI;AACxB;;AAGF,cAAY,QAAQ,WAChB,2BAA2B,UAAU,MACrC,QAAQ,MAAM;;CAGpB,MAAM,SACJ,mBAAmB,OACf,WAAW,QAAQ,eAAe,aAAa,SAAS,GAAG,GAC3D,mBAAmB,WAAW,SAAS;AAC7C,WACE,uBAAuB,IAAI,MAAM,OAAO,OAAA,aACxB,SAAS,IAAI,OAAO,MAAM,GAC3C;AACD,QAAO;;AAGT,MAAa,yBACX,eAEA,oBAAoB,IAAI,IAAI,WAAW,WAAW,CAAC,KAAK;;;;;;;AAQ1D,MAAa,0BAA0B,YAAuC;CAC5E,MAAM,CAAC,QAAQ,OAAO,MAAM,QAAQ,IAAI,CACtC,oBAAoB,GAAG,uBAAuB,kBAAkB,EAChE,oBAAoB,GAAG,oBAAoB,kBAAkB,CAC9D,CAAC;AACF,QAAO,oBAAoB,QAAQ,IAAI;;;;;;;AAQzC,SAAS,oBACP,QACA,KACkB;AAClB,KAAI,OAAO,WAAA,UAGT,QAAO,IAAI,WAAA,YACP,SACA,oBAAoB,QAAQ,kBAAkB;AAGpD,KAAI,IAAI,WAAA,UACN,QAAO,oBAAoB,KAAK,8BAA8B;CAGhE,MAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,UACjD,IAAI,SAAS;AAKf,QAAO;EACL,QAHA,OAAO,WAAA,UACP,IAAI,WAAA,SAAA,SAAA;EAKJ;EAEA,cAAc,OAAO,gBAAgB,IAAI;EAC1C;;AAGH,SAAS,oBACP,QACA,QACkB;AAClB,QAAO;EACL,GAAG;EACH,cAAc,OAAO,eACjB,GAAG,OAAO,aAAa,IAAI,OAAO,KAClC;EACL;;;;ACxKH,MAAa,iBAAiD,EAC5D,cAAc,mBACf;AAcD,MAAa,kCAAyD,EACpE,eAAe,CAAC,eAAe,EAChC;AAED,MAAa,iCAAiC;AAM9C,eAAsB,2BAAuD;AAC3E,QAAO,EAAE,cAAc,MAAM,yBAAyB,EAAE;;AAmB1D,SAAS,eAAe,OAAe,GAA6B;CAClE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI,EAAE,SAAS;AACvC,KAAI,EAAE,aAAc,OAAM,KAAK,aAAa,EAAE,eAAe;AAC7D,KAAI,EAAE,MAAO,OAAM,KAAK,EAAE,MAAM;AAChC,QAAO,MAAM,KAAK,MAAM;;AAO1B,MAAM,uBAAuB;AAE7B,eAAsB,wBACpB,SAAgC,iCACA;AAChC,KAAI;EACF,MAAM,SAAS,MAAM,QAAQ,KAAK,CAChC,0BAA0B,EAC1B,IAAI,SAA4B,YAC9B,iBACQ,QAAQ,WAAW,yBAAyB,CAAC,EACnD,qBACD,CACF,CACF,CAAC;EAEF,MAAM,eAAe,uBAAuB,QAAQ,OAAO;EAC3D,MAAM,UAAU,aAAa,KAAK,QAChC,eAAe,eAAe,MAAM,OAAO,KAAK,CACjD;AACD,MAAI,aAAa,SAAS,GAAG;AAK3B,aAAU,+BAJc,aAAa,KAAK,QAAQ;IAChD,MAAM,IAAI,OAAO;AACjB,WAAO,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE,UAAU,GAAG;KAC5D,CACuD,KAAK,KAAK,GAAG;AACtE,UAAO;IAAE,UAAA;IAA8B;IAAQ;IAAS;;AAG1D,SAAO;GAAE,UAAA;GAA+B;GAAQ;GAAS;UAClD,KAAK;AACZ,YACE,0BAA0B,eAAe,QAAQ,IAAI,UAAU,MAChE;AAED,SAAO;GACL,UAAA;GACA,QAAQ,WAAW,mBAAmB;GACtC,SAAS,EAAE;GACZ;;;AASL,SAAgB,uBACd,QACA,SAAgC,iCACd;AAClB,QAAQ,OAAO,KAAK,OAAO,CAAsB,QAAQ,QAAQ;EAC/D,MAAM,SAAS,OAAO;AACtB,MACE,OAAO,cAAc,SAAS,IAAI,KACjC,OAAO,WAAA,UACN,OAAO,WAAA,iBAET,QAAO;AAET,OACG,OAAO,qBAAqB,EAAE,EAAE,SAAS,IAAI,IAC9C,OAAO,WAAA,UAEP,QAAO;AAET,SAAO;GACP;;;AAIJ,SAAS,WAAW,OAAkC;AAKpD,QAAO,EAAE,cAJsB;EAC7B,QAAA;EACA;EACD,EAC4B;;;;ACtH/B,IAAa,YAAb,MAA2C;CACzC,MAAM,SAAuB;AAC3B,UAAQ,IAAI,MAAM,UAAU;;CAG9B,MAAM,SAAuB;AAC3B,UAAQ,IAAI,MAAM,UAAU;;CAG9B,WAAW,MAAuB;AAChC,UAAQ,IAAI,MAAM,KAAK,WAAW,mBAAmB;AACrD,MAAI,KAAK,KAAM,SAAQ,IAAI,MAAM,KAAK,OAAO;AAC7C,MAAI,KAAK,QAAS,SAAQ,IAAI,YAAY,KAAK,UAAU;;CAG3D,wBAAuC;AACrC,SAAO,QAAQ,SAAS;;CAG1B,iBAAgC;AAE9B,SAAO,QAAQ,SAAS;;CAG1B,OAAO,SAAuB;AAC5B,UAAQ,IAAI,MAAM,UAAU;;CAG9B,MAAM;EACJ,KAAK,SAAuB;AAC1B,WAAQ,IAAI,MAAM,UAAU;;EAE9B,KAAK,SAAuB;AAC1B,WAAQ,IAAI,MAAM,UAAU;;EAE9B,MAAM,SAAuB;AAC3B,WAAQ,IAAI,MAAM,UAAU;;EAE9B,QAAQ,SAAuB;AAC7B,WAAQ,IAAI,MAAM,UAAU;;EAE9B,KAAK,SAAuB;AAC1B,WAAQ,IAAI,MAAM,UAAU;;EAE/B;CAED,KAAK,SAAuB;AAC1B,UAAQ,IAAI,MAAM,UAAU;;CAG9B,UAAyB;AACvB,SAAO;GACL,MAAM,SAAkB;AACtB,QAAI,QAAS,SAAQ,IAAI,MAAM,UAAU;;GAE3C,KAAK,SAAkB;AACrB,QAAI,QAAS,SAAQ,IAAI,MAAM,UAAU;;GAE3C,QAAQ,KAAc;AACpB,QAAI,IAAK,SAAQ,IAAI,MAAM,MAAM;;GAEpC;;CAGH,WAAW,SAAuB;AAChC,UAAQ,IAAI,MAAM,UAAU;;CAG9B,qBAAqB,OAAqB;AACxC,UAAQ,IAAI,iBAAiB,QAAQ;;CAGvC,cAAc,SAAiB,KAAuB;CAItD,YAAY,KAA0B;AACpC,MAAI,KAAK;AACP,WAAQ,IACN,8DACD;AACD,WAAQ,IAAI,MAAM,MAAM;;;CAI5B,gBAAgB,MAA2B;CAI3C,mBAAmB,QAA8C;AAC/D,UAAQ,IAAI,qCAAqC;EACjD,MAAM,eAAe,uBAAuB,OAAO,OAAO;AAC1D,MAAI,aAAa,SAAS,GAAG;AAC3B,WAAQ,IAAI,IAAI;AAChB,WAAQ,IAAI,wBAAwB;AACpC,QAAK,MAAM,OAAO,cAAc;IAC9B,MAAM,SAAS,OAAO,OAAO,KAAK;IAClC,MAAM,QAAQ,OAAO,OAAO,KAAK;IACjC,MAAM,QAAQ,eAAe;IAC7B,MAAM,SAAS,QAAQ,MAAM,UAAU;AACvC,YAAQ,IAAI,UAAU,MAAM,IAAI,SAAS,SAAS;;AAEpD,WAAQ,IAAI,IAAI;;AAElB,OAAK,MAAM,UAAU,OAAO,QAC1B,SAAQ,IAAI,MAAM,SAAS;AAE7B,UAAQ,IACN,6EACD;AACD,SAAO,QAAQ,SAAS;;CAG1B,qBAAqB,QAAqC;AACxD,UAAQ,IAAI,uCAAuC;AACnD,OAAK,MAAM,UAAU,OAAO,QAC1B,SAAQ,IAAI,MAAM,SAAS;;CAI/B,iBAAiB,cAKC;AAChB,SAAO,QAAQ,SAAS;;CAG1B,wBAAyC;AAGvC,SAAO,IAAI,cAAsB,GAE/B;;CAGJ,eAAe,SAAuC;AACpD,SAAO,QAAQ,QAAQ,MAAM;;CAG/B,mBAAyB;CAIzB,qBACE,YACA,eACe;AACf,SAAO,QAAQ,SAAS;;CAG1B,gBAAgB,WAAiD;AAC/D,SAAO,QAAQ,uBACb,IAAI,MACF,oHAED,CACF;;CAGH,wBAA8B;CAI9B,cAAc,QAAgC;AAC5C,UAAQ,IAAI,iCAAiC;AAC7C,MAAI,QAAQ,qBAAqB;AAC/B,WAAQ,IACN,0FACD;AACD,WAAQ,IAAI,0BAA0B;SACjC;AACL,WAAQ,IACN,kEACD;AACD,WAAQ,IACN,kHACD;AACD,WAAQ,IACN,iFACD;AACD,WAAQ,IAAI,iCAAiC;AAC7C,WAAQ,IACN,2FACD;;AAEH,MAAI,QAAQ,YACV,SAAQ,IAAI,mBAAmB,OAAO,cAAc;;CAIxD,qBAA2B;EACzB,MAAM,UAAU,KAAK,MAAM,mBAAmB,IAAO;AACrD,UAAQ,IACN,sDAAsD,QAAQ,WAC/D;AACD,UAAQ,IAAI,0DAA0D;;CAGxE,WAAiB;CAIjB,eAAe,cAAiC;CAIhD,eAAe,cAAiC;CAIhD,sBAAsB,OAA4B;CAIlD,WAAW,OAA6B;CAKxC,eAAuB;CAEvB,UACE,OACM;EACN,MAAM,YAAY,MAAM,QACrB,MAAM,EAAE,WAAA,YACV,CAAC;EACF,MAAM,SAAS,MAAM,QAAQ,MAAM,EAAE,WAAA,cAAiC;AACtE,MAAI,OAAO,WAAW,EAAG;EACzB,MAAM,SAAS,OAAO,KAAK,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,MAAM;EACvE,MAAM,OAAO,OAAO,UAAU,GAAG,MAAM,OAAO,IAAI;AAElD,MAAI,SAAS,KAAK,aAAc;AAChC,OAAK,eAAe;AACpB,UAAQ,IAAI,KAAK;;CAGnB,aAAa,SAA6D;CAI1E,gBAAgB,MAAoB;CAIpC,SAAS,QAAsB;CAI/B,eAAe,MAAoB;CAInC,eAAe,OAAqB;CAIpC,cAAc,QAA+B;CAI7C,qBAAqB,UAAwB;CAI7C,aAAa,OAAsD;CAInE,oBAAoB,MAAc,QAAuB;CAIzD,oBAAoB,MAAuB;CAK3C,YAAY,SAAgC;AAE1C,SAAO,QAAQ,SAAS;;;;;AC/S5B,IAAI,YAAsB,IAAI,WAAW;AAEzC,SAAgB,QAAkB;AAChC,QAAO;;AAGT,SAAgB,MAAM,IAAoB;AACxC,aAAY;;;;ACXd,MAAM,MAAM,QAAQ,aAAa,UAAU,QAAQ,GAAG;AAEtD,MAAa,kBAAkBA,OAAK,KAAK,qBAAqB;AAC9D,MAAa,wBAAwBA,OAAK,KAAK,gCAAgC;;AAE/E,MAAa,0BAA0BA,OACrC,KACA,mCACD;AACD,MAAa,0BAA0BA,OACrC,KACA,kCACD;;;;;;;AAOD,SAAgB,qBAAqB,MAAc,YAA4B;CAC7E,MAAM,SAAS,WAAW,SAASC,MAAI,GAAG,aAAa,aAAaA;AACpE,QAAO,KAAK,WAAW,OAAO,GAAG,KAAK,MAAM,OAAO,OAAO,GAAG;;;;ACjB/D,IAAI,cACiD;AACrD,IAAI,qBAAqB;AACzB,IAAI,wBAAwB;AAE5B,SAAS,UAAU,OAAwB;AACzC,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,iBAAiB,MAAO,QAAO,MAAM,SAAS,OAAO,MAAM;AAC/D,KAAI;AAGF,SAAO,KAAK,UAAU,OAAO,MAAM,EAAE,IAAI,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;SAC/D;AACN,SAAO,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;;;AAIvC,SAAS,WAAW,MAAkC;AACpD,QAAO,KAAK,IAAI,UAAU,CAAC,KAAK,IAAI;;AAGtC,SAAgB,iBAAyB;AACvC,QAAO;;AAGT,SAAgB,iBAAiB,MAGxB;AACP,KAAI,KAAK,SAAS,KAAA,GAAW;AAC3B,gBAAc,KAAK;AACnB,kBAAgB;;AAElB,KAAI,KAAK,YAAY,KAAA,EAAW,sBAAqB,KAAK;;AAG5D,IAAI,gBAAgB;AACpB,IAAI,qBAAqB;AAIzB,SAAS,qBAAqB,KAAoB;AAChD,KAAI,mBAAoB;AACxB,sBAAqB;AAChB,QAAO,2BACT,MAAM,EAAE,gBACP,UAAU,iBACR,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC,EACnD;EACE,QAAQ;EACR,UAAU;EACV,UAAU,QAAQ;EACnB,CACF,CACF,CACA,YAAY,GAEX;;AAKN,SAAS,WAAW,MAAoB;AACtC,KAAI;AACF,iBAAe,aAAa,KAAK;UAC1B,KAAK;AACZ,MAAI,eAAe;AACjB,wBAAqB,IAAI;AACzB;;AAEF,kBAAgB;AAChB,MAAI;AACF,aAAU,KAAK,QAAQ,YAAY,EAAE,EAAE,WAAW,MAAM,CAAC;AACzD,kBAAe,aAAa,KAAK;WAC1B,UAAU;AACjB,wBAAqB,SAAS;;;;AAKpC,SAAgB,kCAAwC;CACtD,MAAM,MAAM,WAAW,yBAAyB;AAChD,KAAI,IACF,kBAAiB,EAAE,MAAM,KAAK,KAAK,KAAK,qBAAqB,EAAE,CAAC;;AAIpE,SAAgB,cAAoB;AAClC,KAAI,CAAC,mBAAoB;CACzB,MAAM,UAAU,IAAI,OAAO,GAAG;AAC9B,YACE,KAAK,QAAQ,yCAAwB,IAAI,MAAM,EAAC,aAAa,CAAC,IAAI,QAAQ,IAC3E;;AAGH,SAAgB,UAAU,GAAG,MAAuB;AAClD,KAAI,CAAC,mBAAoB;AAEzB,YAAW,qBADA,IAAI,MAAM,EAAC,aAAa,CACjB,IAAI,WAAW,KAAK,CAAC,IAAI;;AAG7C,SAAgB,MAAM,GAAG,MAAuB;AAC9C,KAAI,CAAC,sBAAuB;AAC5B,QAAO,CAAC,IAAI,KAAK,WAAW,KAAK,CAAC;;AAGpC,SAAgB,kBAAwB;AACtC,yBAAwB"}

package/dist/defaults-DulzMJpN.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults-DulzMJpN.js","names":["z"],"sources":["../src/steps/add-mcp-server-to-clients/results.ts","../src/steps/add-mcp-server-to-clients/defaults.ts"],"sourcesContent":["/**\n * Per-client outcome of an MCP server / plugin install or removal.\n *\n * \"Nothing to do\" is a first-class outcome rather than a silent no-op:\n * re-running `mcp add` on a machine that's already set up is the common case,\n * and collapsing it into an empty result set is what made the flow report\n * \"Installation skipped.\" with no explanation. Failures carry a short reason\n * for the same reason — an empty list tells the user nothing.\n *\n * The names are action-neutral because both `mcp add` and `mcp remove` report\n * through them: `Changed` is \"installed\" or \"removed\" depending on the flow.\n */\n\nexport enum McpClientStatus {\n  /** We made the change — wrote the config, installed or removed the server. */\n  Changed = 'changed',\n  /** Already in the requested state; nothing was touched. */\n  Unchanged = 'unchanged',\n  Failed = 'failed',\n}\n\nexport interface McpClientResult {\n  name: string;\n  status: McpClientStatus;\n  /** Short, user-facing explanation. Set for failures. */\n  detail?: string;\n}\n\n/** Result shape every client's addServer/removeServer/installPlugin returns. */\nexport interface InstallResult {\n  success: boolean;\n  /** Already in the requested state — nothing was written or removed. */\n  alreadyInstalled?: boolean;\n  /** Raw failure text from the underlying CLI or filesystem error. */\n  reason?: string;\n}\n\n/**\n * Failure text comes from CLIs we invoke with the user's personal API key on the\n * command line (`--header \"Authorization: Bearer phx_...\"`), so it can carry the\n * key into the log file, the TUI and exception reports. Mask it first.\n */\nexport const redactSecrets = (raw: string): string =>\n  raw\n    .replace(/Bearer\\s+\\S+/gi, 'Bearer [redacted]')\n    .replace(/ph[xspc]_[A-Za-z0-9_-]+/g, '[redacted]');\n\n/** First non-empty line of an error, trimmed to something a TUI line can hold. */\nexport const summarizeFailure = (raw?: string): string | undefined => {\n  const line = redactSecrets(raw ?? '')\n    .split('\\n')\n    .map((l) => l.trim())\n    .find((l) => l.length > 0);\n  if (!line) return undefined;\n  return line.length > 120 ? `${line.slice(0, 117)}...` : line;\n};\n\nexport const toClientResult = (\n  name: string,\n  result: InstallResult | undefined,\n): McpClientResult => {\n  if (!result?.success) {\n    return {\n      name,\n      status: McpClientStatus.Failed,\n      detail: summarizeFailure(result?.reason),\n    };\n  }\n  return {\n    name,\n    status: result.alreadyInstalled\n      ? McpClientStatus.Unchanged\n      : McpClientStatus.Changed,\n  };\n};\n\nexport const isOk = (r: McpClientResult): boolean =>\n  r.status !== McpClientStatus.Failed;\n\nexport const namesWithStatus = (\n  results: McpClientResult[],\n  status: McpClientStatus,\n): string[] => results.filter((r) => r.status === status).map((r) => r.name);\n","import z from 'zod';\n\nexport const DefaultMCPClientConfig = z\n  .object({\n    mcpServers: z.record(\n      z.string(),\n      z.union([\n        z.object({\n          command: z.string().optional(),\n          args: z.array(z.string()).optional(),\n          env: z.record(z.string(), z.string()).optional(),\n        }),\n        z.object({\n          url: z.string(),\n          headers: z.record(z.string(), z.string()).optional(),\n        }),\n      ]),\n    ),\n  })\n  .passthrough();\n\nexport const AVAILABLE_FEATURES = {\n  'Data & Analytics': [\n    {\n      value: 'dashboards',\n      label: 'Dashboards',\n      hint: 'Dashboard creation and management',\n    },\n    {\n      value: 'insights',\n      label: 'Insights',\n      hint: 'Analytics insights',\n    },\n    {\n      value: 'product_analytics',\n      label: 'Product Analytics',\n      hint: 'Insight CRUD management',\n    },\n    {\n      value: 'experiments',\n      label: 'Experiments',\n      hint: 'A/B testing experiments',\n    },\n    {\n      value: 'surveys',\n      label: 'Surveys',\n      hint: 'Survey management',\n    },\n    {\n      value: 'annotations',\n      label: 'Annotations',\n      hint: 'Annotation management',\n    },\n    {\n      value: 'replay',\n      label: 'Session Replay',\n      hint: 'Session recording management',\n    },\n    {\n      value: 'sql',\n      label: 'SQL',\n      hint: 'SQL query execution',\n    },\n    {\n      value: 'web_analytics',\n      label: 'Web Analytics',\n      hint: 'Web analytics queries and digests',\n    },\n    {\n      value: 'customer_analytics',\n      label: 'Usage metrics',\n      hint: 'Customer usage metric tracking',\n    },\n    {\n      value: 'signals',\n      label: 'Signals',\n      hint: 'Signal reports and source configs',\n    },\n  ],\n  'AI Engineering': [\n    {\n      value: 'llm_analytics',\n      label: 'AI Observability',\n      hint: 'LLM usage and cost tracking',\n    },\n  ],\n  'Development Tools': [\n    {\n      value: 'error_tracking',\n      label: 'Error Tracking',\n      hint: 'Error monitoring and debugging',\n    },\n    {\n      value: 'logs',\n      label: 'Logs',\n      hint: 'Log querying',\n    },\n    {\n      value: 'flags',\n      label: 'Feature Flags',\n      hint: 'Feature flag management',\n    },\n    {\n      value: 'early_access_features',\n      label: 'Early Access Features',\n      hint: 'Early access feature management',\n    },\n    {\n      value: 'cohorts',\n      label: 'Cohorts',\n      hint: 'Cohort management',\n    },\n    {\n      value: 'sdk_doctor',\n      label: 'SDK Doctor',\n      hint: 'SDK health diagnostics',\n    },\n    {\n      value: 'tracing',\n      label: 'APM Tracing',\n      hint: 'Distributed trace and span queries',\n    },\n  ],\n  'Data Management': [\n    {\n      value: 'events',\n      label: 'Events',\n      hint: 'Event and property definitions',\n    },\n    {\n      value: 'persons',\n      label: 'Persons',\n      hint: 'Person and group management',\n    },\n    {\n      value: 'actions',\n      label: 'Actions',\n      hint: 'Action definitions',\n    },\n    {\n      value: 'data_warehouse',\n      label: 'Data Warehouse',\n      hint: 'Data warehouse management',\n    },\n    {\n      value: 'endpoints',\n      label: 'Endpoints',\n      hint: 'Data warehouse endpoint management',\n    },\n    {\n      value: 'data_schema',\n      label: 'Data Schema',\n      hint: 'Data schema exploration',\n    },\n    {\n      value: 'batch_exports',\n      label: 'Batch Exports',\n      hint: 'Scheduled data exports',\n    },\n  ],\n  'CDP & Automation': [\n    {\n      value: 'hog_functions',\n      label: 'Hog Functions',\n      hint: 'CDP function management',\n    },\n    {\n      value: 'hog_function_templates',\n      label: 'Hog Function Templates',\n      hint: 'CDP function template browsing',\n    },\n    {\n      value: 'workflows',\n      label: 'Workflows',\n      hint: 'Workflow management',\n    },\n  ],\n  'Platform & Management': [\n    {\n      value: 'workspace',\n      label: 'Workspace',\n      hint: 'Organization and project management',\n    },\n    {\n      value: 'docs',\n      label: 'Documentation',\n      hint: 'PostHog documentation search',\n    },\n    {\n      value: 'notebooks',\n      label: 'Notebooks',\n      hint: 'Notebook management',\n    },\n    {\n      value: 'alerts',\n      label: 'Alerts',\n      hint: 'Alert management',\n    },\n    {\n      value: 'platform_features',\n      label: 'Platform Features',\n      hint: 'Activity logs, approvals, comments, and roles',\n    },\n    {\n      value: 'integrations',\n      label: 'Integrations',\n      hint: 'Connected integration management',\n    },\n    {\n      value: 'conversations',\n      label: 'Conversations',\n      hint: 'Support ticket management',\n    },\n    {\n      value: 'core',\n      label: 'Subscriptions',\n      hint: 'Scheduled insight and dashboard deliveries',\n    },\n    {\n      value: 'search',\n      label: 'Search',\n      hint: 'Entity search across the project',\n    },\n    {\n      value: 'reverse_proxy',\n      label: 'Reverse Proxy',\n      hint: 'Reverse proxy record management',\n    },\n    {\n      value: 'debug',\n      label: 'Debug',\n      hint: 'Debug and diagnostic tools',\n    },\n  ],\n};\n\nexport const ALL_FEATURE_VALUES = Object.values(AVAILABLE_FEATURES)\n  .flat()\n  .map((feature) => feature.value);\n\nexport const isAllFeaturesSelected = (features: string[]): boolean =>\n  features.length === ALL_FEATURE_VALUES.length &&\n  ALL_FEATURE_VALUES.every((feature) => features.includes(feature));\n\nexport const buildMCPUrl = (selectedFeatures?: string[], local?: boolean) => {\n  const host = local ? 'http://localhost:8787' : 'https://mcp.posthog.com';\n  const baseUrl = `${host}/mcp`;\n\n  const params: string[] = [];\n\n  // Add features param if not all features selected\n  if (\n    selectedFeatures &&\n    selectedFeatures.length > 0 &&\n    !isAllFeaturesSelected(selectedFeatures)\n  ) {\n    params.push(`features=${selectedFeatures.join(',')}`);\n  }\n\n  return params.length > 0 ? `${baseUrl}?${params.join('&')}` : baseUrl;\n};\n\nexport const getNativeHTTPServerConfig = (\n  apiKey: string | undefined,\n  selectedFeatures?: string[],\n  local?: boolean,\n) => {\n  const config: Record<string, unknown> = {\n    url: buildMCPUrl(selectedFeatures, local),\n  };\n\n  // Only add auth header if API key is provided (not OAuth mode)\n  if (apiKey) {\n    config.headers = {\n      Authorization: `Bearer ${apiKey}`,\n    };\n  }\n\n  return config;\n};\n\nexport const getDefaultServerConfig = (\n  apiKey: string | undefined,\n  selectedFeatures?: string[],\n  local?: boolean,\n) => {\n  const urlWithFeatures = buildMCPUrl(selectedFeatures, local);\n\n  // OAuth mode: no auth header, let MCP handle OAuth\n  if (!apiKey) {\n    return {\n      command: 'npx',\n      args: ['-y', 'mcp-remote@latest', urlWithFeatures],\n    };\n  }\n\n  // API key mode: include auth header\n  return {\n    command: 'npx',\n    args: [\n      '-y',\n      'mcp-remote@latest',\n      urlWithFeatures,\n      '--header',\n      `Authorization:\\${POSTHOG_AUTH_HEADER}`,\n    ],\n    env: {\n      POSTHOG_AUTH_HEADER: `Bearer ${apiKey}`,\n    },\n  };\n};\n"],"mappings":";;;;;;;AA0CA,MAAa,iBAAiB,QAC5B,IACG,QAAQ,kBAAkB,oBAAoB,CAC9C,QAAQ,4BAA4B,aAAa;;AAGtD,MAAa,oBAAoB,QAAqC;CACpE,MAAM,OAAO,cAAc,OAAO,GAAG,CAClC,MAAM,KAAK,CACX,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,MAAM,MAAM,EAAE,SAAS,EAAE;AAC5B,KAAI,CAAC,KAAM,QAAO,KAAA;AAClB,QAAO,KAAK,SAAS,MAAM,GAAG,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO;;AAG1D,MAAa,kBACX,MACA,WACoB;AACpB,KAAI,CAAC,QAAQ,QACX,QAAO;EACL;EACA,QAAA;EACA,QAAQ,iBAAiB,QAAQ,OAAO;EACzC;AAEH,QAAO;EACL;EACA,QAAQ,OAAO,mBAAA,cAAA;EAGhB;;AAGH,MAAa,QAAQ,MACnB,EAAE,WAAA;AAEJ,MAAa,mBACX,SACA,WACa,QAAQ,QAAQ,MAAM,EAAE,WAAW,OAAO,CAAC,KAAK,MAAM,EAAE,KAAK;AChFtCA,IACnC,OAAO,EACN,YAAYA,IAAE,OACZA,IAAE,QAAQ,EACVA,IAAE,MAAM,CACNA,IAAE,OAAO;CACP,SAASA,IAAE,QAAQ,CAAC,UAAU;CAC9B,MAAMA,IAAE,MAAMA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACpC,KAAKA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACjD,CAAC,EACFA,IAAE,OAAO;CACP,KAAKA,IAAE,QAAQ;CACf,SAASA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,CAAC,CACH,CAAC,CACH,EACF,CAAC,CACD,aAAa;AAEhB,MAAa,qBAAqB;CAChC,oBAAoB;EAClB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,kBAAkB,CAChB;EACE,OAAO;EACP,OAAO;EACP,MAAM;EACP,CACF;CACD,qBAAqB;EACnB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,mBAAmB;EACjB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,oBAAoB;EAClB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,yBAAyB;EACvB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACF;AAED,MAAa,qBAAqB,OAAO,OAAO,mBAAmB,CAChE,MAAM,CACN,KAAK,YAAY,QAAQ,MAAM;AAElC,MAAa,yBAAyB,aACpC,SAAS,WAAW,mBAAmB,UACvC,mBAAmB,OAAO,YAAY,SAAS,SAAS,QAAQ,CAAC;AAEnE,MAAa,eAAe,kBAA6B,UAAoB;CAE3E,MAAM,UAAU,GADH,QAAQ,0BAA0B,0BACvB;CAExB,MAAM,SAAmB,EAAE;AAG3B,KACE,oBACA,iBAAiB,SAAS,KAC1B,CAAC,sBAAsB,iBAAiB,CAExC,QAAO,KAAK,YAAY,iBAAiB,KAAK,IAAI,GAAG;AAGvD,QAAO,OAAO,SAAS,IAAI,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,KAAK;;AAGhE,MAAa,6BACX,QACA,kBACA,UACG;CACH,MAAM,SAAkC,EACtC,KAAK,YAAY,kBAAkB,MAAM,EAC1C;AAGD,KAAI,OACF,QAAO,UAAU,EACf,eAAe,UAAU,UAC1B;AAGH,QAAO;;AAGT,MAAa,0BACX,QACA,kBACA,UACG;CACH,MAAM,kBAAkB,YAAY,kBAAkB,MAAM;AAG5D,KAAI,CAAC,OACH,QAAO;EACL,SAAS;EACT,MAAM;GAAC;GAAM;GAAqB;GAAgB;EACnD;AAIH,QAAO;EACL,SAAS;EACT,MAAM;GACJ;GACA;GACA;GACA;GACA;GACD;EACD,KAAK,EACH,qBAAqB,UAAU,UAChC;EACF"}

package/dist/env-api-key-DwmkB3fm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env-api-key-DwmkB3fm.js","names":["path"],"sources":["../src/utils/env-api-key.ts"],"sourcesContent":["import * as path from 'path';\nimport { readProjectFile } from './bounded-fs';\n\n/**\n * Read POSTHOG_PERSONAL_API_KEY from .env.local or .env in the current\n * working directory. Returns undefined when no key is found.\n */\nexport function readApiKeyFromEnv(): string | undefined {\n  for (const envFile of ['.env.local', '.env']) {\n    // null when missing or unreadable, e.g. a `.env` directory (a Python virtualenv).\n    const content = readProjectFile(path.join(process.cwd(), envFile));\n    const match = content?.match(/^POSTHOG_PERSONAL_API_KEY=(.+)$/m);\n    if (match) return match[1].trim();\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;;AAOA,SAAgB,oBAAwC;AACtD,MAAK,MAAM,WAAW,CAAC,cAAc,OAAO,EAAE;EAG5C,MAAM,QADU,gBAAgBA,OAAK,KAAK,QAAQ,KAAK,EAAE,QAAQ,CAAC,EAC3C,MAAM,mCAAmC;AAChE,MAAI,MAAO,QAAO,MAAM,GAAG,MAAM"}

package/dist/environment-1wA7uwAS.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment-1wA7uwAS.js","names":[],"sources":["../src/utils/environment.ts"],"sourcesContent":["import readEnvModule from 'read-env';\n\nconst readEnv =\n  typeof readEnvModule === 'function'\n    ? readEnvModule\n    : (readEnvModule as any).default;\nimport { tryGetPackageJson } from './setup-utils';\nimport type { WizardRunOptions } from './types';\nimport { boundedGlob } from './bounded-fs';\nimport { IS_DEV } from '@lib/constants';\n\nexport function isNonInteractiveEnvironment(): boolean {\n  if (IS_DEV) {\n    return false;\n  }\n\n  if (!process.stdout.isTTY || !process.stderr.isTTY) {\n    return true;\n  }\n\n  return false;\n}\n\n/**\n * Session fields the environment must never set, matched case-insensitively\n * against the camel-cased key `read-env` produces.\n *\n * `e2eAsk` re-wires the `wizard_ask` bridge in an otherwise non-interactive\n * run. Only the e2e TUI host may set it: a real `--ci` run has nobody to answer,\n * so every question would stall for the bridge timeout instead of failing fast\n * with an actionable error. See `shouldDisableAsk`.\n */\nconst NEVER_FROM_ENV = ['e2eAsk'];\n\n/**\n * Session args from the `POSTHOG_WIZARD_*` environment variables.\n *\n * `read-env` camel-cases every prefixed variable into a key, and the CI runner\n * spreads the whole bag into `buildSession` — so adding a field to the session\n * silently adds an environment variable that sets it. Most of them are meant to\n * work that way (`POSTHOG_WIZARD_DEBUG` → `debug`); the ones in\n * {@link NEVER_FROM_ENV} are not, and are dropped here rather than at the call\n * site, so a second caller cannot reopen the door.\n */\nexport function readEnvironment(): Record<string, unknown> {\n  const result = readEnv('POSTHOG_WIZARD') as Record<string, unknown>;\n\n  for (const key of Object.keys(result)) {\n    if (NEVER_FROM_ENV.some((k) => k.toLowerCase() === key.toLowerCase())) {\n      delete result[key];\n    }\n  }\n\n  return result;\n}\n\nexport async function detectEnvVarPrefix(\n  options: WizardRunOptions,\n): Promise<string> {\n  const packageJson = await tryGetPackageJson(options);\n  if (!packageJson) return 'VITE_PUBLIC_';\n\n  const deps = { ...packageJson.dependencies, ...packageJson.devDependencies };\n  const has = (name: string) => name in deps;\n  // O(1) matches per probe: one config file existing anywhere answers it.\n  const hasAnyFile = async (patterns: string[]) => {\n    const matches = await boundedGlob(patterns, {\n      cwd: options.installDir,\n      limit: 1,\n    });\n    return matches.length > 0;\n  };\n\n  // --- Next.js\n  if (has('next') || (await hasAnyFile(['**/next.config.{js,ts,mjs,cjs}']))) {\n    return 'NEXT_PUBLIC_';\n  }\n\n  // --- Create React App\n  if (\n    has('react-scripts') ||\n    has('create-react-app') ||\n    (await hasAnyFile(['**/config-overrides.js']))\n  ) {\n    return 'REACT_APP_';\n  }\n\n  // --- Vite (vanilla, TanStack, Solid, etc.)\n  // Note: Vite does not need PUBLIC_ but we use it to follow the docs, to improve the chances of an LLM getting it right.\n  if (has('vite') || (await hasAnyFile(['**/vite.config.{js,ts,mjs,cjs}']))) {\n    return 'VITE_PUBLIC_';\n  }\n\n  // --- SvelteKit\n  if (\n    has('@sveltejs/kit') ||\n    (await hasAnyFile(['**/svelte.config.{js,ts}']))\n  ) {\n    return 'PUBLIC_';\n  }\n\n  // --- TanStack Start (uses Vite)\n  if (\n    has('@tanstack/start') ||\n    (await hasAnyFile(['**/tanstack.config.{js,ts}']))\n  ) {\n    return 'VITE_PUBLIC_';\n  }\n\n  // --- SolidStart (uses Vite)\n  if (has('solid-start') || (await hasAnyFile(['**/solid.config.{js,ts}']))) {\n    return 'VITE_PUBLIC_';\n  }\n\n  // --- Astro\n  if (has('astro') || (await hasAnyFile(['**/astro.config.{js,ts,mjs}']))) {\n    return 'PUBLIC_';\n  }\n\n  // We default to Vite if we can't detect a specific framework, since it's the most commonly used.\n  return 'VITE_PUBLIC_';\n}\n"],"mappings":";;;;;;;;;;AAEA,MAAM,UACJ,OAAO,kBAAkB,aACrB,gBACC,cAAsB;AAM7B,SAAgB,8BAAuC;AAKrD,KAAI,CAAC,QAAQ,OAAO,SAAS,CAAC,QAAQ,OAAO,MAC3C,QAAO;AAGT,QAAO;;;;;;;;;;;AAYT,MAAM,iBAAiB,CAAC,SAAS;;;;;;;;;;;AAYjC,SAAgB,kBAA2C;CACzD,MAAM,SAAS,QAAQ,iBAAiB;AAExC,MAAK,MAAM,OAAO,OAAO,KAAK,OAAO,CACnC,KAAI,eAAe,MAAM,MAAM,EAAE,aAAa,KAAK,IAAI,aAAa,CAAC,CACnE,QAAO,OAAO;AAIlB,QAAO"}

package/dist/errors--OqLxmWR.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors--OqLxmWR.js","names":[],"sources":["../src/lib/errors/codes.ts","../src/lib/errors/emit.ts","../src/lib/errors/catalog.ts","../src/lib/errors/auth.ts","../src/lib/agent/signals.ts","../src/lib/errors/agent-map.ts","../src/lib/errors/detect-map.ts","../src/lib/errors/skill-map.ts","../src/lib/errors/sanitize.ts","../src/lib/errors/run-failure.ts"],"sourcesContent":["export const ErrorCodes = {\n  CliNodeVersion: 'PHW_CLI_NODE_VERSION',\n  CliBadArgs: 'PHW_CLI_BAD_ARGS',\n  CliFlagUnavailable: 'PHW_CLI_FLAG_UNAVAILABLE',\n  CliInteractiveRequired: 'PHW_CLI_INTERACTIVE_REQUIRED',\n  ArgsMissingApiKey: 'PHW_ARGS_MISSING_API_KEY',\n  ArgsMissingInstallDir: 'PHW_ARGS_MISSING_INSTALL_DIR',\n  ArgsMissingEmail: 'PHW_ARGS_MISSING_EMAIL',\n  ArgsSignupProvisionFailed: 'PHW_ARGS_SIGNUP_PROVISION_FAILED',\n  AuthKeyType: 'PHW_AUTH_KEY_TYPE',\n  AuthMissingScope: 'PHW_AUTH_MISSING_SCOPE',\n  AuthRegionMismatch: 'PHW_AUTH_REGION_MISMATCH',\n  AuthInvalidOrExpired: 'PHW_AUTH_INVALID_OR_EXPIRED',\n  /** The OAuth grant itself is gone — distinct from a merely expired token. */\n  AuthSessionExpired: 'PHW_AUTH_SESSION_EXPIRED',\n  AuthSettingsConflict: 'PHW_AUTH_SETTINGS_CONFLICT',\n  AuthStoredLoginConflict: 'PHW_AUTH_STORED_LOGIN_CONFLICT',\n  AuthProjectFetchFailed: 'PHW_AUTH_PROJECT_FETCH_FAILED',\n  EnvLocalServicesDown: 'PHW_ENV_LOCAL_SERVICES_DOWN',\n  EnvServiceOutage: 'PHW_ENV_SERVICE_OUTAGE',\n  DetectBadDirectory: 'PHW_DETECT_BAD_DIRECTORY',\n  DetectNoFramework: 'PHW_DETECT_NO_FRAMEWORK',\n  DetectUnsupportedVersion: 'PHW_DETECT_UNSUPPORTED_VERSION',\n  DetectUnsupportedPlatform: 'PHW_DETECT_UNSUPPORTED_PLATFORM',\n  DetectNoPosthogSdk: 'PHW_DETECT_NO_POSTHOG_SDK',\n  DetectNoProjectFiles: 'PHW_DETECT_NO_PROJECT_FILES',\n  DetectNoSources: 'PHW_DETECT_NO_SOURCES',\n  DetectNoPackageJson: 'PHW_DETECT_NO_PACKAGE_JSON',\n  DetectNoSdks: 'PHW_DETECT_NO_SDKS',\n  DetectMissingStripe: 'PHW_DETECT_MISSING_STRIPE',\n  DetectUnclassified: 'PHW_DETECT_UNCLASSIFIED',\n  SkillMenuFetchFailed: 'PHW_SKILL_MENU_FETCH_FAILED',\n  SkillNotFound: 'PHW_SKILL_NOT_FOUND',\n  SkillDownloadFailed: 'PHW_SKILL_DOWNLOAD_FAILED',\n  AgentAbort: 'PHW_AGENT_ABORT',\n  AgentMcpMissing: 'PHW_AGENT_MCP_MISSING',\n  AgentResourceMissing: 'PHW_AGENT_RESOURCE_MISSING',\n  AgentRateLimit: 'PHW_AGENT_RATE_LIMIT',\n  AgentApiError: 'PHW_AGENT_API_ERROR',\n  AgentYaraViolation: 'PHW_AGENT_YARA_VIOLATION',\n  AgentNoProgress: 'PHW_AGENT_NO_PROGRESS',\n  AgentIncompleteTasks: 'PHW_AGENT_INCOMPLETE_TASKS',\n  AgentOrchestratorSkillVariantMissing:\n    'PHW_AGENT_ORCHESTRATOR_SKILL_VARIANT_MISSING',\n  AgentOrchestratorTasksFailed: 'PHW_AGENT_ORCHESTRATOR_TASKS_FAILED',\n  AgentOrchestratorHollowRun: 'PHW_AGENT_ORCHESTRATOR_HOLLOW_RUN',\n  AgentOrchestratorSinkInvariant: 'PHW_AGENT_ORCHESTRATOR_SINK_INVARIANT',\n  /** The backend answered the mint with a deliberate refusal. */\n  GatewayMintRefused: 'PHW_GATEWAY_MINT_REFUSED',\n  /** The mint was unreachable, errored, or returned an unusable token. */\n  GatewayMintFailed: 'PHW_GATEWAY_MINT_FAILED',\n  SettingsUnfixableConflict: 'PHW_SETTINGS_UNFIXABLE_CONFLICT',\n  InternalUnhandled: 'PHW_INTERNAL_UNHANDLED',\n} as const;\n\nexport type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];\n\nexport const ERROR_CODE_PATTERN = /^PHW_[A-Z][A-Z0-9_]*$/;\n\nexport function isErrorCode(value: string): value is ErrorCode {\n  return (Object.values(ErrorCodes) as string[]).includes(value);\n}\n","import type { ErrorCode } from './codes';\n\nexport const PHW_ERROR_PREFIX = 'phw-error:';\n\nexport interface WizardErrorLine {\n  code: ErrorCode;\n  message: string;\n  detail?: Record<string, unknown>;\n}\n\nexport function formatWizardErrorLine(line: WizardErrorLine): string {\n  return `${PHW_ERROR_PREFIX} ${JSON.stringify(line)}`;\n}\n\nexport function emitWizardError(line: WizardErrorLine): void {\n  process.stderr.write(`${formatWizardErrorLine(line)}\\n`);\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\nimport type { ErrorCatalogEntry } from './types';\n\nexport const ERROR_CATALOG: Record<ErrorCode, ErrorCatalogEntry> = {\n  [ErrorCodes.CliNodeVersion]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Node.js runtime is older than the required range.',\n  },\n  [ErrorCodes.CliBadArgs]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Unrecognized command or option.',\n  },\n  [ErrorCodes.CliFlagUnavailable]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'A dev-only flag or env var was passed to a published build.',\n  },\n  [ErrorCodes.CliInteractiveRequired]: {\n    group: 'cli',\n    retry: 'no',\n    description:\n      'The command requires an interactive terminal and has no non-interactive fallback.',\n  },\n  [ErrorCodes.ArgsMissingApiKey]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --api-key.',\n  },\n  [ErrorCodes.ArgsMissingInstallDir]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --install-dir.',\n  },\n  [ErrorCodes.ArgsMissingEmail]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Signup run without --email.',\n  },\n  [ErrorCodes.ArgsSignupProvisionFailed]: {\n    group: 'args',\n    retry: 'yes',\n    description: 'Account provisioning for --signup failed.',\n  },\n  [ErrorCodes.AuthKeyType]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The API key has the wrong type or prefix for this mode.',\n  },\n  [ErrorCodes.AuthInvalidOrExpired]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The credential was rejected by the LLM gateway or API.',\n  },\n  [ErrorCodes.AuthSessionExpired]: {\n    group: 'auth',\n    // Retryable, unlike its neighbours: a new run means a new login.\n    retry: 'yes',\n    description: 'The OAuth grant expired or was revoked mid-run.',\n  },\n  [ErrorCodes.AuthMissingScope]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The personal API key lacks a scope the run requires.',\n  },\n  [ErrorCodes.AuthRegionMismatch]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The resolved region does not match the credential.',\n  },\n  [ErrorCodes.AuthSettingsConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'A Claude settings file overrides the gateway credential.',\n  },\n  [ErrorCodes.AuthStoredLoginConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description:\n      'The agent SDK used a stored Claude login instead of the gateway token.',\n  },\n  [ErrorCodes.AuthProjectFetchFailed]: {\n    group: 'auth',\n    retry: 'yes',\n    description: 'Fetching user or project data from the PostHog API failed.',\n  },\n  [ErrorCodes.EnvLocalServicesDown]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'A local dev target service is not running.',\n  },\n  [ErrorCodes.EnvServiceOutage]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'Blocking external services are down.',\n  },\n  [ErrorCodes.DetectBadDirectory]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The install directory is missing, not a directory, or unreadable.',\n  },\n  [ErrorCodes.DetectNoFramework]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Framework auto-detection found no supported framework.',\n  },\n  [ErrorCodes.DetectUnsupportedVersion]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The detected framework version is below the supported minimum.',\n  },\n  [ErrorCodes.DetectUnsupportedPlatform]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project platform has no matching skill variant.',\n  },\n  [ErrorCodes.DetectNoPosthogSdk]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The program requires an installed PostHog SDK and none was found.',\n  },\n  [ErrorCodes.DetectNoProjectFiles]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no files for the program to work on.',\n  },\n  [ErrorCodes.DetectNoSources]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'No data warehouse sources were found.',\n  },\n  [ErrorCodes.DetectNoPackageJson]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no package.json for the program to scan.',\n  },\n  [ErrorCodes.DetectNoSdks]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'None of the SDKs the program needs are installed.',\n  },\n  [ErrorCodes.DetectMissingStripe]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Revenue analytics requires a Stripe SDK and none was found.',\n  },\n  [ErrorCodes.DetectUnclassified]: {\n    group: 'detect',\n    // A detect step reported a precondition failure we have no code for yet.\n    // Every known cause is a property of the user's project, so retrying can\n    // only burn budget — fail closed rather than inheriting `internal`'s 'yes'.\n    retry: 'no',\n    description: 'A detect step failed with a kind absent from the catalog.',\n  },\n  [ErrorCodes.SkillMenuFetchFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The context-mill skill menu could not be fetched.',\n  },\n  [ErrorCodes.SkillNotFound]: {\n    group: 'skill',\n    retry: 'no',\n    description: 'The skill id is absent from the context-mill menu.',\n  },\n  [ErrorCodes.SkillDownloadFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The skill download or extraction failed.',\n  },\n  [ErrorCodes.AgentAbort]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent emitted an [ABORT] signal with a reason.',\n  },\n  [ErrorCodes.AgentMcpMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not reach the PostHog MCP server.',\n  },\n  [ErrorCodes.AgentResourceMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not access a setup resource.',\n  },\n  [ErrorCodes.AgentRateLimit]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The LLM gateway rate-limited the run.',\n  },\n  [ErrorCodes.AgentApiError]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent hit an API error other than a rate limit.',\n  },\n  [ErrorCodes.AgentYaraViolation]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The security scanner terminated the run.',\n  },\n  [ErrorCodes.AgentNoProgress]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent ended without a single tool call.',\n  },\n  [ErrorCodes.AgentIncompleteTasks]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent stopped with planned tasks still open.',\n  },\n  [ErrorCodes.AgentOrchestratorSkillVariantMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The orchestrator could not download a needed skill variant.',\n  },\n  [ErrorCodes.AgentOrchestratorTasksFailed]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The orchestrator queue drained with failed or blocked tasks.',\n  },\n  [ErrorCodes.AgentOrchestratorHollowRun]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The orchestrator drained with zero tasks — the seed step got no usable model output.',\n  },\n  [ErrorCodes.AgentOrchestratorSinkInvariant]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The orchestrator plan failed the sink coverage invariant.',\n  },\n  [ErrorCodes.GatewayMintRefused]: {\n    group: 'gateway',\n    // 429 clears with the daily window, 401 with a fresh login, 403 never.\n    retry: 'case-by-case',\n    description:\n      'The PostHog backend refused to mint a gateway token for this run.',\n  },\n  [ErrorCodes.GatewayMintFailed]: {\n    group: 'gateway',\n    retry: 'yes',\n    description:\n      'The PostHog backend could not mint a gateway token: unreachable, a 5xx, or an unusable response.',\n  },\n  [ErrorCodes.SettingsUnfixableConflict]: {\n    group: 'settings',\n    retry: 'no',\n    description:\n      'A Claude settings conflict cannot be neutralized automatically.',\n  },\n  [ErrorCodes.InternalUnhandled]: {\n    group: 'internal',\n    retry: 'yes',\n    description: 'An unexpected error escaped the pipeline.',\n  },\n};\n","import { ErrorCodes, type ErrorCode } from './codes';\n\nexport interface AuthFailureInput {\n  hasSettingsConflict?: boolean;\n  usingManagedLogin?: boolean;\n  /** A pre-run token refresh already failed on a dead grant this run. */\n  sessionExpired?: boolean;\n  apiKey?: string;\n  missingScopes?: readonly string[];\n  gatewayRegion?: 'us' | 'eu' | 'local';\n  sessionRegion?: 'us' | 'eu';\n}\n\nexport function classifyAuthFailure(input: AuthFailureInput): ErrorCode {\n  // First: the only branch backed by a server verdict rather than inference.\n  // The token endpoint already told us the grant is dead, so every heuristic\n  // below would be guessing at a cause we know.\n  if (input.sessionExpired) return ErrorCodes.AuthSessionExpired;\n  if (input.usingManagedLogin) return ErrorCodes.AuthStoredLoginConflict;\n  if (input.hasSettingsConflict) return ErrorCodes.AuthSettingsConflict;\n  if (\n    input.apiKey &&\n    !input.apiKey.startsWith('phx_') &&\n    !input.apiKey.startsWith('pha_')\n  ) {\n    return ErrorCodes.AuthKeyType;\n  }\n  if (input.missingScopes && input.missingScopes.length > 0) {\n    return ErrorCodes.AuthMissingScope;\n  }\n  if (\n    input.gatewayRegion &&\n    input.sessionRegion &&\n    input.gatewayRegion !== 'local' &&\n    input.gatewayRegion !== input.sessionRegion\n  ) {\n    return ErrorCodes.AuthRegionMismatch;\n  }\n  return ErrorCodes.AuthInvalidOrExpired;\n}\n","/**\n * Agent signal vocabulary — the marker strings the agent emits and the error\n * taxonomy the runner returns. Kept as a dependency-free leaf module so both\n * `agent-interface.ts` and `output-signals.ts` can import it without a cycle.\n */\n\nexport const AgentSignals = {\n  /** Signal emitted when the agent reports progress to the user */\n  STATUS: '[STATUS]',\n  /** Signal emitted when the agent cannot access the PostHog MCP server */\n  ERROR_MCP_MISSING: '[ERROR-MCP-MISSING]',\n  /** Signal emitted when the agent cannot access the setup resource */\n  ERROR_RESOURCE_MISSING: '[ERROR-RESOURCE-MISSING]',\n  /**\n   * Signal emitted when `install_skill` failed and the agent is continuing\n   * the integration WITHOUT the skill (best-effort from its own knowledge).\n   * Format: \"[SKILL-INSTALL-FAILED] <skill id — reason>\". Non-fatal by\n   * design: a freestyled integration beats an outright failure, but the run\n   * must be measurable — the runner captures it as an analytics event.\n   */\n  SKILL_INSTALL_FAILED: '[SKILL-INSTALL-FAILED]',\n  /**\n   * Signal emitted when the agent cannot complete the program and is\n   * aborting intentionally (distinct from errors). Format: \"[ABORT] <reason>\".\n   * Programs can declare an onAbort handler to render a custom screen.\n   */\n  ABORT: '[ABORT]',\n  /** Signal emitted when the agent provides a remark about its run */\n  WIZARD_REMARK: '[WIZARD-REMARK]',\n  /** Signal prefix for benchmark logging */\n  BENCHMARK: '[BENCHMARK]',\n  /**\n   * Signal emitted when the agent has created a PostHog dashboard for the\n   * user. Format: `[DASHBOARD_URL] <full https url>`. The URL is captured\n   * onto `session.dashboardUrl` and surfaced by programs in their outro.\n   */\n  DASHBOARD_URL: '[DASHBOARD_URL]',\n  /**\n   * Signal emitted when the agent has uploaded a report to a PostHog\n   * notebook. Format: `[NOTEBOOK_URL] <full https url>`. The URL is captured\n   * onto `session.notebookUrl` and surfaced by programs in their outro.\n   */\n  NOTEBOOK_URL: '[NOTEBOOK_URL]',\n} as const;\n\nexport type AgentSignal = (typeof AgentSignals)[keyof typeof AgentSignals];\n\n/**\n * End-of-run reflection ask, shared by both harnesses so remarks are\n * comparable. The format clause comes FIRST and nothing trails the marker —\n * literal models (gpt-5-mini) echo whatever text follows it. The parser also\n * drops remarks that quote this instruction (see AgentOutputSignals.remark).\n */\nexport const REMARK_INSTRUCTION = `Reply with a single line that starts with ${AgentSignals.WIZARD_REMARK} and no other lines. In that line, state briefly what information or guidance would have been useful to have in the integration prompt or documentation for this run — specifically anything that would have prevented tool failures, erroneous edits, or other wasted turns.`;\n\n/**\n * First prompt of a session resumed after a mid-run re-mint. The transcript\n * carries the work so far; the model only needs to pick it up.\n */\nexport const RESUME_INSTRUCTION =\n  'Your previous request failed with a transient gateway authentication error that has since been fixed. Continue the task from where you left off.';\n\n/**\n * Error types that can be returned from agent execution.\n * These correspond to the error signals that the agent emits.\n */\nexport enum AgentErrorType {\n  /** Agent could not access the PostHog MCP server */\n  MCP_MISSING = 'WIZARD_MCP_MISSING',\n  /** Agent could not access the setup resource */\n  RESOURCE_MISSING = 'WIZARD_RESOURCE_MISSING',\n  /** API rate limit exceeded */\n  RATE_LIMIT = 'WIZARD_RATE_LIMIT',\n  /** Generic API error */\n  API_ERROR = 'WIZARD_API_ERROR',\n  /** YARA scanner detected a security violation */\n  YARA_VIOLATION = 'WIZARD_YARA_VIOLATION',\n  /** Agent intentionally aborted the program (emitted [ABORT] <reason>) */\n  ABORT = 'WIZARD_ABORT',\n  /** Agent ended without making a single tool call — a no-op run that did no work */\n  NO_PROGRESS = 'WIZARD_NO_PROGRESS',\n  /** Agent acted but stopped short — planned tasks left open and/or no skill installed */\n  INCOMPLETE_TASKS = 'WIZARD_INCOMPLETE_TASKS',\n}\n","import { AgentErrorType } from '../agent/signals';\nimport { ErrorCodes, type ErrorCode } from './codes';\n\nexport const AGENT_ERROR_CODE: Record<AgentErrorType, ErrorCode> = {\n  [AgentErrorType.MCP_MISSING]: ErrorCodes.AgentMcpMissing,\n  [AgentErrorType.RESOURCE_MISSING]: ErrorCodes.AgentResourceMissing,\n  [AgentErrorType.RATE_LIMIT]: ErrorCodes.AgentRateLimit,\n  [AgentErrorType.API_ERROR]: ErrorCodes.AgentApiError,\n  [AgentErrorType.YARA_VIOLATION]: ErrorCodes.AgentYaraViolation,\n  [AgentErrorType.ABORT]: ErrorCodes.AgentAbort,\n  [AgentErrorType.NO_PROGRESS]: ErrorCodes.AgentNoProgress,\n  [AgentErrorType.INCOMPLETE_TASKS]: ErrorCodes.AgentIncompleteTasks,\n};\n","import { ErrorCodes, type ErrorCode } from './codes';\nimport type { RevenueDetectError } from '@lib/programs/revenue-analytics/detect';\nimport type { SelfDrivingDetectError } from '@lib/programs/self-driving/detect';\nimport type { SourceMapsDetectError } from '@lib/programs/error-tracking-upload-source-maps/detect';\nimport type { WarehouseDetectError } from '@lib/programs/warehouse-source/detect';\nimport type { WebAnalyticsDetectError } from '@lib/programs/web-analytics-doctor/detect';\n\n/**\n * Every `kind` a program detect step can write into\n * `frameworkContext.detectError`, assembled from the programs' own unions.\n * Type-only imports, so this adds no runtime edge from the catalog to the\n * programs (same shape as `skill-map.ts` keying on `InstallSkillResult`).\n *\n * The point is the compile error: add a kind to any program's `DetectError`\n * and `DETECT_CODES` stops type-checking until it gets a code.\n */\nexport type DetectErrorKind =\n  | RevenueDetectError['kind']\n  | SelfDrivingDetectError['kind']\n  | SourceMapsDetectError['kind']\n  | WarehouseDetectError['kind']\n  | WebAnalyticsDetectError['kind'];\n\nconst DETECT_CODES: Record<DetectErrorKind, ErrorCode> = {\n  'bad-directory': ErrorCodes.DetectBadDirectory,\n  'unsupported-platform': ErrorCodes.DetectUnsupportedPlatform,\n  'no-project-files': ErrorCodes.DetectNoProjectFiles,\n  'no-sources': ErrorCodes.DetectNoSources,\n  'no-package-json': ErrorCodes.DetectNoPackageJson,\n  'no-sdks': ErrorCodes.DetectNoSdks,\n  'missing-stripe': ErrorCodes.DetectMissingStripe,\n  // Three kinds, one failure class: the program needs a PostHog SDK and the\n  // project has none. Hosts that care which program asked read `detail.kind`.\n  'no-posthog-sdk': ErrorCodes.DetectNoPosthogSdk,\n  'no-posthog': ErrorCodes.DetectNoPosthogSdk,\n  'missing-posthog': ErrorCodes.DetectNoPosthogSdk,\n};\n\n/**\n * `kind` arrives as a bare string — `frameworkContext.detectError` is untyped\n * storage — so the lookup can still miss. It falls back to a detect-group code\n * with `retry: 'no'`, never to `InternalUnhandled`: an unrecognized precondition\n * failure is still a precondition failure, and telling a sandbox to retry one\n * costs it the whole budget.\n */\nexport function detectErrorCode(kind: string): ErrorCode {\n  return DETECT_CODES[kind as DetectErrorKind] ?? ErrorCodes.DetectUnclassified;\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\nimport type { InstallSkillResult } from '@lib/wizard-tools';\n\nconst SKILL_CODES: Record<\n  Exclude<InstallSkillResult['kind'], 'ok'>,\n  ErrorCode\n> = {\n  'menu-fetch-failed': ErrorCodes.SkillMenuFetchFailed,\n  'skill-not-found': ErrorCodes.SkillNotFound,\n  'download-failed': ErrorCodes.SkillDownloadFailed,\n};\n\nexport function skillErrorCode(result: InstallSkillResult): ErrorCode | null {\n  if (result.kind === 'ok') return null;\n  return SKILL_CODES[result.kind];\n}\n","const DETAIL_ALLOWLIST = ['reason', 'detected', 'platform'] as const;\n\nexport function sanitizeErrorDetail(\n  detail: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!detail) return undefined;\n  const safe: Record<string, unknown> = {};\n  for (const key of DETAIL_ALLOWLIST) {\n    if (detail[key] !== undefined) safe[key] = detail[key];\n  }\n  return Object.keys(safe).length > 0 ? safe : undefined;\n}\n","import { ErrorCodes, isErrorCode, type ErrorCode } from './codes';\n\nexport interface RunFailure {\n  code: ErrorCode;\n  message: string;\n  /** True when the error carried its own code: a decision, not a crash. */\n  coded: boolean;\n}\n\n/**\n * How a run's terminal error is reported. A coded WizardError (a mint refusal,\n * say) keeps its own message and code; anything else is unhandled and gets the\n * generic framing. Duck-typed on `code` so callers need not load wizard-abort.\n */\nexport function classifyRunFailure(err: unknown): RunFailure {\n  const message = err instanceof Error ? err.message : String(err);\n  const code =\n    err instanceof Error ? (err as { code?: unknown }).code : undefined;\n  if (typeof code === 'string' && isErrorCode(code)) {\n    return { code, message, coded: true };\n  }\n  return { code: ErrorCodes.InternalUnhandled, message, coded: false };\n}\n"],"mappings":";AAAA,MAAa,aAAa;CACxB,gBAAgB;CAChB,YAAY;CACZ,oBAAoB;CACpB,wBAAwB;CACxB,mBAAmB;CACnB,uBAAuB;CACvB,kBAAkB;CAClB,2BAA2B;CAC3B,aAAa;CACb,kBAAkB;CAClB,oBAAoB;CACpB,sBAAsB;CAEtB,oBAAoB;CACpB,sBAAsB;CACtB,yBAAyB;CACzB,wBAAwB;CACxB,sBAAsB;CACtB,kBAAkB;CAClB,oBAAoB;CACpB,mBAAmB;CACnB,0BAA0B;CAC1B,2BAA2B;CAC3B,oBAAoB;CACpB,sBAAsB;CACtB,iBAAiB;CACjB,qBAAqB;CACrB,cAAc;CACd,qBAAqB;CACrB,oBAAoB;CACpB,sBAAsB;CACtB,eAAe;CACf,qBAAqB;CACrB,YAAY;CACZ,iBAAiB;CACjB,sBAAsB;CACtB,gBAAgB;CAChB,eAAe;CACf,oBAAoB;CACpB,iBAAiB;CACjB,sBAAsB;CACtB,sCACE;CACF,8BAA8B;CAC9B,4BAA4B;CAC5B,gCAAgC;CAEhC,oBAAoB;CAEpB,mBAAmB;CACnB,2BAA2B;CAC3B,mBAAmB;CACpB;AAMD,SAAgB,YAAY,OAAmC;AAC7D,QAAQ,OAAO,OAAO,WAAW,CAAc,SAAS,MAAM;;;;AC1DhE,MAAa,mBAAmB;AAQhC,SAAgB,sBAAsB,MAA+B;AACnE,QAAO,GAAG,iBAAiB,GAAG,KAAK,UAAU,KAAK;;AAGpD,SAAgB,gBAAgB,MAA6B;AAC3D,SAAQ,OAAO,MAAM,GAAG,sBAAsB,KAAK,CAAC,IAAI;;ACXvD,WAAW,gBAKX,WAAW,YAKX,WAAW,oBAKX,WAAW,wBAMX,WAAW,mBAKX,WAAW,uBAKX,WAAW,kBAKX,WAAW,2BAKX,WAAW,aAKX,WAAW,sBAKX,WAAW,oBAMX,WAAW,kBAKX,WAAW,oBAKX,WAAW,sBAKX,WAAW,yBAMX,WAAW,wBAKX,WAAW,sBAKX,WAAW,kBAKX,WAAW,oBAMX,WAAW,mBAKX,WAAW,0BAMX,WAAW,2BAKX,WAAW,oBAMX,WAAW,sBAKX,WAAW,iBAKX,WAAW,qBAKX,WAAW,cAKX,WAAW,qBAKX,WAAW,oBAQX,WAAW,sBAKX,WAAW,eAKX,WAAW,qBAKX,WAAW,YAKX,WAAW,iBAKX,WAAW,sBAKX,WAAW,gBAKX,WAAW,eAKX,WAAW,oBAKX,WAAW,iBAKX,WAAW,sBAKX,WAAW,sCAKX,WAAW,8BAKX,WAAW,4BAMX,WAAW,gCAKX,WAAW,oBAOX,WAAW,mBAMX,WAAW,2BAMX,WAAW;;;AChPd,SAAgB,oBAAoB,OAAoC;AAItE,KAAI,MAAM,eAAgB,QAAO,WAAW;AAC5C,KAAI,MAAM,kBAAmB,QAAO,WAAW;AAC/C,KAAI,MAAM,oBAAqB,QAAO,WAAW;AACjD,KACE,MAAM,UACN,CAAC,MAAM,OAAO,WAAW,OAAO,IAChC,CAAC,MAAM,OAAO,WAAW,OAAO,CAEhC,QAAO,WAAW;AAEpB,KAAI,MAAM,iBAAiB,MAAM,cAAc,SAAS,EACtD,QAAO,WAAW;AAEpB,KACE,MAAM,iBACN,MAAM,iBACN,MAAM,kBAAkB,WACxB,MAAM,kBAAkB,MAAM,cAE9B,QAAO,WAAW;AAEpB,QAAO,WAAW;;;;;;;;;AChCpB,MAAa,eAAe;CAE1B,QAAQ;CAER,mBAAmB;CAEnB,wBAAwB;CAQxB,sBAAsB;CAMtB,OAAO;CAEP,eAAe;CAEf,WAAW;CAMX,eAAe;CAMf,cAAc;CACf;;;;;;;AAUD,MAAa,qBAAqB,6CAA6C,aAAa,cAAc;;;;;AAM1G,MAAa,qBACX;;;ACzDF,MAAa,mBAAsD;yBACnC,WAAW;8BACN,WAAW;wBACjB,WAAW;uBACZ,WAAW;4BACN,WAAW;mBACpB,WAAW;yBACL,WAAW;8BACN,WAAW;CAC/C;;;ACWD,MAAM,eAAmD;CACvD,iBAAiB,WAAW;CAC5B,wBAAwB,WAAW;CACnC,oBAAoB,WAAW;CAC/B,cAAc,WAAW;CACzB,mBAAmB,WAAW;CAC9B,WAAW,WAAW;CACtB,kBAAkB,WAAW;CAG7B,kBAAkB,WAAW;CAC7B,cAAc,WAAW;CACzB,mBAAmB,WAAW;CAC/B;;;;;;;;AASD,SAAgB,gBAAgB,MAAyB;AACvD,QAAO,aAAa,SAA4B,WAAW;;;;AC3C7D,MAAM,cAGF;CACF,qBAAqB,WAAW;CAChC,mBAAmB,WAAW;CAC9B,mBAAmB,WAAW;CAC/B;AAED,SAAgB,eAAe,QAA8C;AAC3E,KAAI,OAAO,SAAS,KAAM,QAAO;AACjC,QAAO,YAAY,OAAO;;;;ACd5B,MAAM,mBAAmB;CAAC;CAAU;CAAY;CAAW;AAE3D,SAAgB,oBACd,QACqC;AACrC,KAAI,CAAC,OAAQ,QAAO,KAAA;CACpB,MAAM,OAAgC,EAAE;AACxC,MAAK,MAAM,OAAO,iBAChB,KAAI,OAAO,SAAS,KAAA,EAAW,MAAK,OAAO,OAAO;AAEpD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,KAAA;;;;;;;;;ACI/C,SAAgB,mBAAmB,KAA0B;CAC3D,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;CAChE,MAAM,OACJ,eAAe,QAAS,IAA2B,OAAO,KAAA;AAC5D,KAAI,OAAO,SAAS,YAAY,YAAY,KAAK,CAC/C,QAAO;EAAE;EAAM;EAAS,OAAO;EAAM;AAEvC,QAAO;EAAE,MAAM,WAAW;EAAmB;EAAS,OAAO;EAAO"}

package/dist/gateway-session-OqzCMpZ9.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gateway-session-OqzCMpZ9.js","names":[],"sources":["../src/lib/gateway-session.ts"],"sourcesContent":["/**\n * Gateway auth for a wizard run: a `phe_` scoped token the backend mints, with\n * pinned attribution, a spend cap and an expiry.\n *\n * Every mint failure throws: a silent downgrade would spend uncapped,\n * unattributed money to hide an outage.\n */\n\nimport { readFileSync } from 'node:fs';\nimport { logToFile } from '@utils/debug';\nimport { analytics } from '@utils/analytics';\nimport { WizardError } from '@utils/wizard-abort';\nimport { ErrorCodes } from '@lib/errors';\nimport type { HostResolution } from '@lib/host-resolution';\nimport { checkLlmGatewayHealth } from '@lib/health-checks/endpoints';\nimport { ServiceHealthStatus } from '@lib/health-checks/types';\nimport { IS_PRODUCTION_BUILD, runtimeEnv } from '@env';\nimport type { CloudRegion } from '@utils/types';\n\nexport interface GatewayAuth {\n  /** Base URL for model calls (no `/v1`; transports append their route). */\n  gatewayUrl: string;\n  /** Gateway bearer, minted normally or supplied directly by CI. */\n  token: string;\n  /** Team verified by the mint, or explicitly supplied for CI attribution. */\n  teamId?: number;\n  /**\n   * Instant past which a 401 on this bearer is age rather than a bad\n   * credential: the cache re-mints past it, and a session still holding the\n   * old bearer may re-mint once. Before it the mint has to be trusted.\n   */\n  refreshAtMs: number;\n}\n\ninterface CachedAuth {\n  key: string;\n  auth: GatewayAuth;\n  /** Re-resolve once past this instant. */\n  staleAtMs: number;\n}\n\nlet cached: CachedAuth | null = null;\n/**\n * Shared so concurrent callers mint once. The orchestrator starts every runnable\n * task at once, and each would otherwise take its own token and its own cap.\n */\nlet inFlight: { key: string; promise: Promise<GatewayAuth> } | null = null;\nlet ciAuth: GatewayAuth | null = null;\n\n// Snapshot CI supplies a gateway bearer without minting or re-minting.\nexport function configureGatewayCredentialsForCI(\n  token: string,\n  projectId: number,\n  gatewayUrl: string,\n): void {\n  if (IS_PRODUCTION_BUILD)\n    throw new Error('CI gateway auth requires a non-production build');\n  if (!token.trim() || !Number.isSafeInteger(projectId) || projectId <= 0) {\n    throw new Error('CI gateway auth requires a token and valid project ID');\n  }\n  if (\n    !/^https?:\\/\\//.test(gatewayUrl) ||\n    !isTrustedGatewayUrl(gatewayUrl, '')\n  ) {\n    throw new Error('CI gateway auth requires a trusted gateway origin');\n  }\n  resetGatewaySession();\n  ciAuth = {\n    token: token.trim(),\n    teamId: projectId,\n    gatewayUrl: gatewayUrl.replace(/\\/+$/, ''),\n    refreshAtMs: Infinity,\n  };\n}\n\nexport function configureGatewayFromCIEnvironment(\n  projectId: number,\n  region: CloudRegion,\n): void {\n  if (IS_PRODUCTION_BUILD)\n    throw new Error('CI gateway auth requires a non-production build');\n  const path = runtimeEnv('WIZARD_CI_GATEWAY_TOKEN_FILE');\n  if (!path) throw new Error('WIZARD_CI_GATEWAY_TOKEN_FILE is required for CI');\n  const token = readFileSync(path, 'utf8');\n  delete process.env.WIZARD_CI_GATEWAY_TOKEN_FILE;\n  configureGatewayCredentialsForCI(\n    token,\n    projectId,\n    runtimeEnv('WIZARD_CI_GATEWAY_URL') ||\n      `https://ai-gateway.${region}.posthog.com`,\n  );\n}\n\n/**\n * Adoption floor. The anthropic subprocess holds its credential until a 401\n * forces a re-mint, so a token below this would churn mints.\n */\nconst MIN_USABLE_TTL_MS = 2 * 60 * 1000;\n/** Re-resolve at this fraction of the token's life, leaving a usable remainder. */\nconst REFRESH_AT_FRACTION = 0.8;\n// Exceeds the backend's own 10s gateway timeout: a slow mint that lands after the\n// CLI hangs up spends a daily mint and orphans a live token.\nconst MINT_TIMEOUT_MS = 20_000;\n/** Longer than any refusal the mint writes; a body past this is not a message. */\nconst MAX_REFUSAL_DETAIL_LENGTH = 500;\n/** Outcomes are short snake_case labels; anything longer is not one. */\nconst MAX_REFUSAL_OUTCOME_LENGTH = 64;\n\n/** Resolve this run's gateway auth, minting and re-minting near expiry. */\nexport async function gatewayAuth(\n  host: HostResolution,\n  accessToken: string,\n  program: string | undefined,\n): Promise<GatewayAuth> {\n  if (ciAuth) return ciAuth;\n  // Keyed by program: a token pins `wizard:<program>`, so reusing one across\n  // programs bills the wrong budget.\n  const key = `${host.apiHost}\\n${accessToken}\\n${program ?? ''}`;\n  if (cached && cached.key === key && Date.now() < cached.staleAtMs) {\n    return cached.auth;\n  }\n  if (inFlight && inFlight.key === key) return inFlight.promise;\n  const promise = resolveGatewayAuth(host, accessToken, key, program);\n  inFlight = { key, promise };\n  try {\n    return await promise;\n  } finally {\n    if (inFlight?.promise === promise) inFlight = null;\n  }\n}\n\nasync function resolveGatewayAuth(\n  host: HostResolution,\n  accessToken: string,\n  key: string,\n  program: string | undefined,\n): Promise<GatewayAuth> {\n  if (!program) {\n    // Every run has one; absent means a caller was not wired, and the spend would\n    // be unattributable.\n    logToFile('[gateway] run has no program id; failing the run');\n    throw new GatewayMintFailed(\n      'this run has no program to attribute its spend to',\n    );\n  }\n  const minted = await mintGatewayToken(host, accessToken, program);\n  const health = await checkLlmGatewayHealth(minted.gatewayUrl);\n  if (health.status !== ServiceHealthStatus.Healthy) {\n    throw new WizardError(\n      'The PostHog AI gateway is unavailable. Please try again later.',\n      undefined,\n      ErrorCodes.EnvServiceOutage,\n    );\n  }\n  const expiresAtMs = Date.parse(minted.expiresAt);\n  const ttlMs = expiresAtMs - Date.now();\n  if (!Number.isFinite(expiresAtMs) || ttlMs < MIN_USABLE_TTL_MS) {\n    // Expired, unreadable, or too short to serve a session. Adopting it would\n    // 401 mid-run, and downgrading would spend the rest of the run uncapped.\n    logToFile(\n      `[gateway] mint returned a token with ${ttlMs}ms of life; failing the run`,\n    );\n    throw new GatewayMintFailed(\n      `the PostHog gateway issued a token with ${ttlMs}ms of life`,\n    );\n  }\n  const staleAtMs = Date.now() + ttlMs * REFRESH_AT_FRACTION;\n  // Only failures are logged otherwise, so a successful run leaves no\n  // local trace. Never log the token itself.\n  logToFile(\n    `[gateway] minted a scoped token: program=${program} team=${\n      minted.teamId ?? 'unknown'\n    } ttl=${Math.round(ttlMs / 1000)}s url=${minted.gatewayUrl}`,\n  );\n  const auth: GatewayAuth = {\n    gatewayUrl: minted.gatewayUrl,\n    token: minted.token,\n    teamId: minted.teamId,\n    refreshAtMs: staleAtMs,\n  };\n  cached = { key, auth, staleAtMs };\n  return auth;\n}\n\n/** Test hook: drop the cached auth so the next call re-resolves. */\nexport function resetGatewaySession(): void {\n  cached = null;\n  inFlight = null;\n  ciAuth = null;\n}\n\n/** Whether a 401 on this bearer may be age (past its refresh instant) rather than a bad credential. */\nexport function isPastRefresh(auth: GatewayAuth, now = Date.now()): boolean {\n  return now >= auth.refreshAtMs;\n}\n\n/**\n * Whether a server-supplied origin may receive a bearer and prompt content:\n * https (loopback excepted), and either a current cloud gateway or the host the run\n * authenticated against.\n */\nexport function isTrustedGatewayUrl(value: string, apiHost: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  // Consumers append routes to this value, so anything beyond an origin\n  // (path, query, fragment, userinfo) would build a malformed endpoint.\n  if (\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash ||\n    url.username ||\n    url.password\n  ) {\n    return false;\n  }\n  const localhost =\n    url.hostname === 'localhost' ||\n    url.hostname === '127.0.0.1' ||\n    url.hostname === 'host.docker.internal';\n  // Loopback is the dev gateway, and is the one case allowed over http.\n  if (localhost) return true;\n  if (url.protocol !== 'https:') return false;\n  if (url.hostname.endsWith('.posthog.com')) {\n    return (\n      url.origin === 'https://ai-gateway.us.posthog.com' ||\n      url.origin === 'https://ai-gateway.eu.posthog.com'\n    );\n  }\n  try {\n    return url.hostname === new URL(apiHost).hostname;\n  } catch {\n    return false;\n  }\n}\n\ninterface MintedToken {\n  token: string;\n  expiresAt: string;\n  gatewayUrl: string;\n  teamId?: number;\n}\n\n/**\n * A deliberate refusal from the mint endpoint, as opposed to the mint being\n * unavailable. Thrown so the run stops instead of proceeding without the\n * controls the refusal was enforcing. A WizardError, so the runners print its\n * message as-is and `wizardAbort` resolves its code.\n */\nexport class GatewayMintRefused extends WizardError {\n  readonly status: number;\n  /** The backend's refusal outcome (`blocked`, `throttled`, ...), when it sent one. */\n  readonly outcome?: string;\n\n  constructor(status: number, message: string, outcome?: string) {\n    super(message, { status, outcome }, ErrorCodes.GatewayMintRefused);\n    this.name = 'GatewayMintRefused';\n    this.status = status;\n    this.outcome = outcome;\n  }\n}\n\n/**\n * The mint could not produce a usable credential: unreachable, a 5xx, or a\n * response the client cannot use.\n */\nexport class GatewayMintFailed extends WizardError {\n  constructor(message: string) {\n    super(message, undefined, ErrorCodes.GatewayMintFailed);\n    this.name = 'GatewayMintFailed';\n  }\n}\n\n/**\n * Whether a mint status means \"refused this run\" rather than \"not available\".\n * 429 the daily run limit, 403 revoked project access, 400 a login covering\n * more than one project, 401 a credential the mint does not accept, 404 an\n * instance without the mint endpoint.\n */\nfunction isMintRefusal(status: number): boolean {\n  return (\n    status === 400 ||\n    status === 401 ||\n    status === 403 ||\n    status === 404 ||\n    status === 429\n  );\n}\n\ninterface MintRefusal {\n  detail?: string;\n  outcome?: string;\n}\n\n/**\n * The server's own reason for a refusal, when it sent one. DRF answers every\n * refusal as `{\"detail\": \"...\", \"code\": \"<outcome>\"}`; the blocklist's detail\n * names the contact address, which the fixed messages below cannot. `code` is\n * the backend's own label for the refusal (`outcome` on older backends) and\n * rides the client event.\n */\nfunction cleanRefusalText(value: unknown): string {\n  if (typeof value !== 'string') return '';\n  // Not because the server sends escapes, but because this string is printed\n  // straight to a terminal: sanitizing at the boundary means no later message\n  // can move the cursor or repaint the screen.\n  // eslint-disable-next-line no-control-regex\n  return value.replace(/[\\u0000-\\u001f\\u007f-\\u009f]/g, ' ').trim();\n}\n\nasync function readRefusal(resp: Response): Promise<MintRefusal> {\n  try {\n    const body = (await resp.json()) as {\n      detail?: unknown;\n      code?: unknown;\n      outcome?: unknown;\n    };\n    const detail = cleanRefusalText(body?.detail);\n    // The DRF handler flattens a dict detail, so the outcome rides as `code`.\n    // A `code` that cleans to nothing does not shadow a usable `outcome`.\n    const outcome =\n      cleanRefusalText(body?.code) || cleanRefusalText(body?.outcome);\n    return {\n      detail:\n        detail.length > 0 && detail.length <= MAX_REFUSAL_DETAIL_LENGTH\n          ? detail\n          : undefined,\n      outcome:\n        outcome.length > 0 && outcome.length <= MAX_REFUSAL_OUTCOME_LENGTH\n          ? outcome\n          : undefined,\n    };\n  } catch {\n    return {};\n  }\n}\n\nfunction mintRefusalMessage(status: number, detail?: string): string {\n  if (detail) return detail;\n  switch (status) {\n    case 429:\n      return 'This wizard program has used its daily run limit. Try again tomorrow.';\n    case 403:\n      return 'Your access to this project has changed. Re-authenticate and try again.';\n    case 400:\n      // The only 400 the mint answers is the exactly-one-project check.\n      return 'Your PostHog login must cover exactly one project. Re-authenticate and try again.';\n    case 401:\n      return 'PostHog did not accept this login. Re-authenticate with `npx @posthog/wizard@latest`.';\n    case 404:\n      return 'This PostHog instance does not issue gateway tokens. Upgrade with `npx @posthog/wizard@latest` and try again.';\n    default:\n      return 'The PostHog gateway refused this run.';\n  }\n}\n\nasync function mintGatewayToken(\n  host: HostResolution,\n  accessToken: string,\n  program: string,\n): Promise<MintedToken> {\n  try {\n    const resp = await fetch(`${host.apiHost}/api/wizard/gateway_token/`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'Content-Type': 'application/json',\n      },\n      // The flag tells the server this build reads a refusal, so it may answer\n      // with the reason. A build that omits it gets a 404, which is its signal\n      // to fall back to the legacy gateway.\n      body: JSON.stringify({ program, reads_refusal_reason: true }),\n      signal: AbortSignal.timeout(MINT_TIMEOUT_MS),\n    });\n    if (!resp.ok) {\n      if (isMintRefusal(resp.status)) {\n        const refusal = await readRefusal(resp);\n        logToFile(\n          `[gateway] mint refused with HTTP ${resp.status} (${\n            refusal.outcome ?? 'no outcome'\n          }); failing the run`,\n        );\n        // The terminal denial event for this run. The backend's own event has\n        // no run id, so this is what joins a refusal to the session.\n        analytics.wizardCapture('gateway mint refused', {\n          status: resp.status,\n          outcome: refusal.outcome,\n          program,\n        });\n        throw new GatewayMintRefused(\n          resp.status,\n          mintRefusalMessage(resp.status, refusal.detail),\n          refusal.outcome,\n        );\n      }\n      logToFile(\n        `[gateway] mint failed with HTTP ${resp.status}; failing the run`,\n      );\n      throw new GatewayMintFailed(\n        `the PostHog gateway could not issue a token (HTTP ${resp.status})`,\n      );\n    }\n    const body = (await resp.json()) as {\n      token?: string;\n      expires_at?: string;\n      gateway_url?: string;\n      team_id?: number;\n    };\n    // Checked one at a time, not in a loop, so each clause narrows the optional\n    // field for the return below and each names itself in the failure.\n    if (!body.token) {\n      logToFile('[gateway] mint response omitted token; failing the run');\n      throw new GatewayMintFailed('mint response omitted token');\n    }\n    if (!body.expires_at) {\n      logToFile('[gateway] mint response omitted expires_at; failing the run');\n      throw new GatewayMintFailed('mint response omitted expires_at');\n    }\n    if (!body.gateway_url) {\n      logToFile('[gateway] mint response omitted gateway_url; failing the run');\n      throw new GatewayMintFailed('mint response omitted gateway_url');\n    }\n    if (!isTrustedGatewayUrl(body.gateway_url, host.apiHost)) {\n      logToFile(\n        '[gateway] mint returned an untrusted gateway url; failing the run',\n      );\n      throw new GatewayMintFailed('mint returned an untrusted gateway url');\n    }\n    return {\n      token: body.token,\n      expiresAt: body.expires_at,\n      gatewayUrl: body.gateway_url.replace(/\\/+$/, ''),\n      teamId: body.team_id,\n    };\n  } catch (e) {\n    // Decisions and failures both pass through: this catch exists for transport\n    // errors, and folding the others into it would lose the reason.\n    if (e instanceof GatewayMintRefused || e instanceof GatewayMintFailed)\n      throw e;\n    logToFile(\n      `[gateway] mint transport failure (${String(e)}); failing the run`,\n    );\n    throw new GatewayMintFailed(\n      `could not reach the PostHog gateway (${String(e)})`,\n    );\n  }\n}\n\n/**\n * The v2 run-metadata carrier: one JSON blob for the `X-PostHog-Properties`\n * header. Plain keys only, since the gateway strips `$`-prefixed keys as reserved,\n * so feature-flag variants land as `wizard_flag_<key>` instead of the legacy\n * `$feature/<key>` (dashboards keying on `$feature/wizard-*` read the new key\n * post-cutover).\n */\nexport function buildWizardPropertiesBlob(\n  wizardMetadata: Record<string, string>,\n  wizardFlags: Record<string, string>,\n  teamId?: number,\n): string {\n  // The gateway pins `$ai_product` to `wizard:<program>`, and rejects a legacy\n  // product override on a scoped token, so the unprefixed key every cost and\n  // error consumer reads is only present if this blob declares it.\n  const props: Record<string, string | number> = { ai_product: 'wizard' };\n  if (teamId !== undefined) props.team_id = teamId;\n  for (const [key, value] of Object.entries(wizardMetadata)) {\n    props[stripPropertyPrefix(key)] = value;\n  }\n  for (const [flagKey, variant] of Object.entries(wizardFlags)) {\n    if (!flagKey.toLowerCase().startsWith('wizard')) continue;\n    props[`wizard_flag_${flagKey.toLowerCase()}`] = variant;\n  }\n  return JSON.stringify(props);\n}\n\nconst LEGACY_PROPERTY_PREFIX = 'X-POSTHOG-PROPERTY-';\n\nfunction stripPropertyPrefix(key: string): string {\n  return key.toUpperCase().startsWith(LEGACY_PROPERTY_PREFIX)\n    ? key.slice(LEGACY_PROPERTY_PREFIX.length).toLowerCase()\n    : key;\n}\n"],"mappings":";;;;;;;;;;;;;AAyCA,IAAI,SAA4B;;;;;AAKhC,IAAI,WAAkE;AACtE,IAAI,SAA6B;AAGjC,SAAgB,iCACd,OACA,WACA,YACM;AAEJ,OAAM,IAAI,MAAM,kDAAkD;;AAmBtE,SAAgB,kCACd,WACA,QACM;AAEJ,OAAM,IAAI,MAAM,kDAAkD;;;;;;AAiBtE,MAAM,oBAAoB,MAAS;;AAEnC,MAAM,sBAAsB;AAG5B,MAAM,kBAAkB;;AAExB,MAAM,4BAA4B;;AAElC,MAAM,6BAA6B;;AAGnC,eAAsB,YACpB,MACA,aACA,SACsB;AACtB,KAAI,OAAQ,QAAO;CAGnB,MAAM,MAAM,GAAG,KAAK,QAAQ,IAAI,YAAY,IAAI,WAAW;AAC3D,KAAI,UAAU,OAAO,QAAQ,OAAO,KAAK,KAAK,GAAG,OAAO,UACtD,QAAO,OAAO;AAEhB,KAAI,YAAY,SAAS,QAAQ,IAAK,QAAO,SAAS;CACtD,MAAM,UAAU,mBAAmB,MAAM,aAAa,KAAK,QAAQ;AACnE,YAAW;EAAE;EAAK;EAAS;AAC3B,KAAI;AACF,SAAO,MAAM;WACL;AACR,MAAI,UAAU,YAAY,QAAS,YAAW;;;AAIlD,eAAe,mBACb,MACA,aACA,KACA,SACsB;AACtB,KAAI,CAAC,SAAS;AAGZ,YAAU,mDAAmD;AAC7D,QAAM,IAAI,kBACR,oDACD;;CAEH,MAAM,SAAS,MAAM,iBAAiB,MAAM,aAAa,QAAQ;AAEjE,MADe,MAAM,sBAAsB,OAAO,WAAW,EAClD,WAAA,UACT,OAAM,IAAI,YACR,kEACA,KAAA,GACA,WAAW,iBACZ;CAEH,MAAM,cAAc,KAAK,MAAM,OAAO,UAAU;CAChD,MAAM,QAAQ,cAAc,KAAK,KAAK;AACtC,KAAI,CAAC,OAAO,SAAS,YAAY,IAAI,QAAQ,mBAAmB;AAG9D,YACE,wCAAwC,MAAM,6BAC/C;AACD,QAAM,IAAI,kBACR,2CAA2C,MAAM,YAClD;;CAEH,MAAM,YAAY,KAAK,KAAK,GAAG,QAAQ;AAGvC,WACE,4CAA4C,QAAQ,QAClD,OAAO,UAAU,UAClB,OAAO,KAAK,MAAM,QAAQ,IAAK,CAAC,QAAQ,OAAO,aACjD;CACD,MAAM,OAAoB;EACxB,YAAY,OAAO;EACnB,OAAO,OAAO;EACd,QAAQ,OAAO;EACf,aAAa;EACd;AACD,UAAS;EAAE;EAAK;EAAM;EAAW;AACjC,QAAO;;;AAIT,SAAgB,sBAA4B;AAC1C,UAAS;AACT,YAAW;AACX,UAAS;;;AAIX,SAAgB,cAAc,MAAmB,MAAM,KAAK,KAAK,EAAW;AAC1E,QAAO,OAAO,KAAK;;;;;;;AAQrB,SAAgB,oBAAoB,OAAe,SAA0B;CAC3E,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,MAAM;SACd;AACN,SAAO;;AAIT,KACE,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,QACJ,IAAI,YACJ,IAAI,SAEJ,QAAO;AAOT,KAJE,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa,uBAEJ,QAAO;AACtB,KAAI,IAAI,aAAa,SAAU,QAAO;AACtC,KAAI,IAAI,SAAS,SAAS,eAAe,CACvC,QACE,IAAI,WAAW,uCACf,IAAI,WAAW;AAGnB,KAAI;AACF,SAAO,IAAI,aAAa,IAAI,IAAI,QAAQ,CAAC;SACnC;AACN,SAAO;;;;;;;;;AAiBX,IAAa,qBAAb,cAAwC,YAAY;CAClD;;CAEA;CAEA,YAAY,QAAgB,SAAiB,SAAkB;AAC7D,QAAM,SAAS;GAAE;GAAQ;GAAS,EAAE,WAAW,mBAAmB;AAClE,OAAK,OAAO;AACZ,OAAK,SAAS;AACd,OAAK,UAAU;;;;;;;AAQnB,IAAa,oBAAb,cAAuC,YAAY;CACjD,YAAY,SAAiB;AAC3B,QAAM,SAAS,KAAA,GAAW,WAAW,kBAAkB;AACvD,OAAK,OAAO;;;;;;;;;AAUhB,SAAS,cAAc,QAAyB;AAC9C,QACE,WAAW,OACX,WAAW,OACX,WAAW,OACX,WAAW,OACX,WAAW;;;;;;;;;AAgBf,SAAS,iBAAiB,OAAwB;AAChD,KAAI,OAAO,UAAU,SAAU,QAAO;AAKtC,QAAO,MAAM,QAAQ,iCAAiC,IAAI,CAAC,MAAM;;AAGnE,eAAe,YAAY,MAAsC;AAC/D,KAAI;EACF,MAAM,OAAQ,MAAM,KAAK,MAAM;EAK/B,MAAM,SAAS,iBAAiB,MAAM,OAAO;EAG7C,MAAM,UACJ,iBAAiB,MAAM,KAAK,IAAI,iBAAiB,MAAM,QAAQ;AACjE,SAAO;GACL,QACE,OAAO,SAAS,KAAK,OAAO,UAAU,4BAClC,SACA,KAAA;GACN,SACE,QAAQ,SAAS,KAAK,QAAQ,UAAU,6BACpC,UACA,KAAA;GACP;SACK;AACN,SAAO,EAAE;;;AAIb,SAAS,mBAAmB,QAAgB,QAAyB;AACnE,KAAI,OAAQ,QAAO;AACnB,SAAQ,QAAR;EACE,KAAK,IACH,QAAO;EACT,KAAK,IACH,QAAO;EACT,KAAK,IAEH,QAAO;EACT,KAAK,IACH,QAAO;EACT,KAAK,IACH,QAAO;EACT,QACE,QAAO;;;AAIb,eAAe,iBACb,MACA,aACA,SACsB;AACtB,KAAI;EACF,MAAM,OAAO,MAAM,MAAM,GAAG,KAAK,QAAQ,6BAA6B;GACpE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IACjB;GAID,MAAM,KAAK,UAAU;IAAE;IAAS,sBAAsB;IAAM,CAAC;GAC7D,QAAQ,YAAY,QAAQ,gBAAgB;GAC7C,CAAC;AACF,MAAI,CAAC,KAAK,IAAI;AACZ,OAAI,cAAc,KAAK,OAAO,EAAE;IAC9B,MAAM,UAAU,MAAM,YAAY,KAAK;AACvC,cACE,oCAAoC,KAAK,OAAO,IAC9C,QAAQ,WAAW,aACpB,oBACF;AAGD,cAAU,cAAc,wBAAwB;KAC9C,QAAQ,KAAK;KACb,SAAS,QAAQ;KACjB;KACD,CAAC;AACF,UAAM,IAAI,mBACR,KAAK,QACL,mBAAmB,KAAK,QAAQ,QAAQ,OAAO,EAC/C,QAAQ,QACT;;AAEH,aACE,mCAAmC,KAAK,OAAO,mBAChD;AACD,SAAM,IAAI,kBACR,qDAAqD,KAAK,OAAO,GAClE;;EAEH,MAAM,OAAQ,MAAM,KAAK,MAAM;AAQ/B,MAAI,CAAC,KAAK,OAAO;AACf,aAAU,yDAAyD;AACnE,SAAM,IAAI,kBAAkB,8BAA8B;;AAE5D,MAAI,CAAC,KAAK,YAAY;AACpB,aAAU,8DAA8D;AACxE,SAAM,IAAI,kBAAkB,mCAAmC;;AAEjE,MAAI,CAAC,KAAK,aAAa;AACrB,aAAU,+DAA+D;AACzE,SAAM,IAAI,kBAAkB,oCAAoC;;AAElE,MAAI,CAAC,oBAAoB,KAAK,aAAa,KAAK,QAAQ,EAAE;AACxD,aACE,oEACD;AACD,SAAM,IAAI,kBAAkB,yCAAyC;;AAEvE,SAAO;GACL,OAAO,KAAK;GACZ,WAAW,KAAK;GAChB,YAAY,KAAK,YAAY,QAAQ,QAAQ,GAAG;GAChD,QAAQ,KAAK;GACd;UACM,GAAG;AAGV,MAAI,aAAa,sBAAsB,aAAa,kBAClD,OAAM;AACR,YACE,qCAAqC,OAAO,EAAE,CAAC,oBAChD;AACD,QAAM,IAAI,kBACR,wCAAwC,OAAO,EAAE,CAAC,GACnD;;;;;;;;;;AAWL,SAAgB,0BACd,gBACA,aACA,QACQ;CAIR,MAAM,QAAyC,EAAE,YAAY,UAAU;AACvE,KAAI,WAAW,KAAA,EAAW,OAAM,UAAU;AAC1C,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,eAAe,CACvD,OAAM,oBAAoB,IAAI,IAAI;AAEpC,MAAK,MAAM,CAAC,SAAS,YAAY,OAAO,QAAQ,YAAY,EAAE;AAC5D,MAAI,CAAC,QAAQ,aAAa,CAAC,WAAW,SAAS,CAAE;AACjD,QAAM,eAAe,QAAQ,aAAa,MAAM;;AAElD,QAAO,KAAK,UAAU,MAAM;;AAG9B,MAAM,yBAAyB;AAE/B,SAAS,oBAAoB,KAAqB;AAChD,QAAO,IAAI,aAAa,CAAC,WAAW,uBAAuB,GACvD,IAAI,MAAM,GAA8B,CAAC,aAAa,GACtD"}

package/dist/gateway-session-s1xr8b48.js

@@ -1,2 +0,0 @@
-import { a as configureGatewayFromCIEnvironment } from "./gateway-session-OqzCMpZ9.js";
-export { configureGatewayFromCIEnvironment };

package/dist/headless-ui-DRGWDg9Z.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"headless-ui-DRGWDg9Z.js","names":[],"sources":["../src/ui/headless-ui.ts"],"sourcesContent":["import { LoggingUI } from './logging-ui';\nimport type { WizardStore } from './tui/store';\n\n/**\n * `LoggingUI` plus it feeds run state into a `WizardStore` so the background\n * wizard-session sync (`TaskStreamPush`) can observe a headless run. We extend\n * `LoggingUI` (not `InkUI`) because its blocking/gate methods would wait on a\n * TUI that never renders; the runner drives phase transitions on the store\n * directly, so only UI-originated per-run updates tee through here. The audit\n * ledger arrives through `setFrameworkContext`, the seam every UI implements.\n */\nexport class HeadlessUI extends LoggingUI {\n  constructor(private readonly store: WizardStore) {\n    super();\n  }\n\n  syncTodos(\n    todos: Array<{ content: string; status: string; activeForm?: string }>,\n  ): void {\n    super.syncTodos(todos);\n    this.store.syncTodos(todos);\n  }\n\n  setHandoffText(text: string): void {\n    this.store.setHandoffText(text);\n  }\n\n  setFrameworkContext(key: string, value: unknown): void {\n    this.store.setFrameworkContext(key, value);\n  }\n\n  getFrameworkContext(key: string): unknown {\n    return this.store.session.frameworkContext[key];\n  }\n}\n"],"mappings":";;;;;;;;;;AAWA,IAAa,aAAb,cAAgC,UAAU;CACxC,YAAY,OAAqC;AAC/C,SAAO;AADoB,OAAA,QAAA;;CAI7B,UACE,OACM;AACN,QAAM,UAAU,MAAM;AACtB,OAAK,MAAM,UAAU,MAAM;;CAG7B,eAAe,MAAoB;AACjC,OAAK,MAAM,eAAe,KAAK;;CAGjC,oBAAoB,KAAa,OAAsB;AACrD,OAAK,MAAM,oBAAoB,KAAK,MAAM;;CAG5C,oBAAoB,KAAsB;AACxC,SAAO,KAAK,MAAM,QAAQ,iBAAiB"}

package/dist/local-dev-DPZiIPCK.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"local-dev-DPZiIPCK.js","names":[],"sources":["../src/lib/local-dev.ts"],"sourcesContent":["/**\n * Local development targets: context-mill (skills), MCP, and PostHog. Each is\n * independently switchable — CI runs local skills against the *production* MCP\n * — with `--local-dev` as a shorthand for all three.\n *\n * `wizard mcp add --local` is unrelated: it writes a `posthog-local` entry into\n * the user's editor config rather than retargeting this run. Hence no\n * `--local` here.\n */\n\nexport const CONTEXT_MILL_LOCAL_URL = 'http://localhost:8765';\nexport const MCP_LOCAL_URL = 'http://localhost:8787/mcp';\n/** Pins the API, app, OAuth, and the LLM gateway derived from them. */\nexport const POSTHOG_LOCAL_URL = 'http://localhost:8010';\n\n/**\n * Raw yargs values. The three specific flags are declared without a `default`\n * so they stay `undefined` when absent — see `resolveLocalDev`.\n */\nexport type LocalDevFlags = {\n  localDev?: boolean;\n  localMcp?: boolean;\n  localContextMill?: boolean;\n  localPosthog?: boolean;\n};\n\nexport type ResolvedLocalDev = {\n  localMcp: boolean;\n  localContextMill: boolean;\n  localPosthog: boolean;\n};\n\n/**\n * A specific flag beats `--local-dev` in both directions. `??` is load-bearing:\n * it falls through only on `undefined`, so giving the specific flags a yargs\n * `default: false` would silently break both the umbrella and `--no-local-mcp`.\n */\nexport function resolveLocalDev(flags: LocalDevFlags): ResolvedLocalDev {\n  const umbrella = flags.localDev ?? false;\n  return {\n    localMcp: flags.localMcp ?? umbrella,\n    localContextMill: flags.localContextMill ?? umbrella,\n    localPosthog: flags.localPosthog ?? umbrella,\n  };\n}\n\n/** yargs populates both spellings, so read either. */\nexport function localDevFromArgv(\n  argv: Record<string, unknown>,\n): ResolvedLocalDev {\n  const read = (kebab: string, camel: string): boolean | undefined => {\n    const value = argv[camel] ?? argv[kebab];\n    return typeof value === 'boolean' ? value : undefined;\n  };\n  return resolveLocalDev({\n    localDev: read('local-dev', 'localDev'),\n    localMcp: read('local-mcp', 'localMcp'),\n    localContextMill: read('local-context-mill', 'localContextMill'),\n    localPosthog: read('local-posthog', 'localPosthog'),\n  });\n}\n\nconst PRODUCTION_TARGETS: ResolvedLocalDev = {\n  localMcp: false,\n  localContextMill: false,\n  localPosthog: false,\n};\n\nlet resolved: ResolvedLocalDev | null = null;\n\n/**\n * Resolve this process's targets. Called once from the yargs middleware, which\n * covers every command and the env-var spellings alike.\n */\nexport function initLocalDev(argv: Record<string, unknown>): ResolvedLocalDev {\n  resolved = localDevFromArgv(argv);\n  return resolved;\n}\n\n/**\n * Where this run points. Resolved once because the flags are parsed at startup\n * and never change; threading them through state let call sites read whichever\n * field they happened to have, which is how the intro screens ended up asking\n * the MCP flag where to fetch skills.\n *\n * Uninitialized means no CLI parse ran (a direct-call test) — production.\n */\nexport function getLocalDev(): ResolvedLocalDev {\n  return resolved ?? PRODUCTION_TARGETS;\n}\n\n/** Tests only. */\nexport function resetLocalDev(): void {\n  resolved = null;\n}\n\ntype LocalService = {\n  key: keyof ResolvedLocalDev;\n  label: string;\n  flag: string;\n  /** Probed for reachability — any HTTP reply proves the port is bound. */\n  url: string;\n  startHint: string;\n};\n\nconst LOCAL_SERVICES: readonly LocalService[] = [\n  {\n    key: 'localContextMill',\n    label: 'context-mill',\n    flag: '--local-context-mill',\n    url: `${CONTEXT_MILL_LOCAL_URL}/skill-menu.json`,\n    startHint: 'npm run dev  (in the context-mill repo)',\n  },\n  {\n    key: 'localMcp',\n    label: 'MCP server',\n    flag: '--local-mcp',\n    url: MCP_LOCAL_URL,\n    startHint:\n      'hogli start  (or pnpm dev:local-resources in posthog/services/mcp)',\n  },\n  {\n    key: 'localPosthog',\n    label: 'PostHog',\n    flag: '--local-posthog',\n    url: POSTHOG_LOCAL_URL,\n    startHint: './bin/start  (in the posthog repo)',\n  },\n] as const;\n\n// Retries because this gate gates `fetchWithRetry` (see fetch-retry.ts) — a\n// blip it would ride out must not abort the run instead. A missing server\n// refuses instantly, so the retries only cost time when one is slow to answer,\n// which is exactly when they're worth paying for.\nconst PROBE_TIMEOUT_MS = 2_000;\nconst PROBE_ATTEMPTS = 3;\nconst PROBE_BACKOFF_MS = 250;\n\nasync function isReachable(url: string): Promise<boolean> {\n  for (let attempt = 1; attempt <= PROBE_ATTEMPTS; attempt++) {\n    try {\n      // Any reply — including 404 or 405 — proves something is listening, which\n      // is the only question here. Deliberately not `fetchWithRetry`: that\n      // treats a non-ok status as failure, and here it is a pass.\n      await fetch(url, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });\n      return true;\n    } catch {\n      if (attempt < PROBE_ATTEMPTS) {\n        await new Promise((r) =>\n          setTimeout(r, PROBE_BACKOFF_MS * 2 ** (attempt - 1)),\n        );\n      }\n    }\n  }\n  return false;\n}\n\n/**\n * Probe every service the flags asked to be local. Returns one message naming\n * each unreachable one, or undefined if all are up (or none were requested).\n *\n * Without this a dead local server surfaces late and badly: a missing\n * context-mill looks like a registry outage, a missing MCP fails mid-run after\n * the agent has already edited files.\n */\nexport async function checkLocalServices(\n  resolved: ResolvedLocalDev,\n): Promise<string | undefined> {\n  const requested = LOCAL_SERVICES.filter((s) => resolved[s.key]);\n  if (requested.length === 0) return undefined;\n\n  const reachable = await Promise.all(requested.map((s) => isReachable(s.url)));\n  const dead = requested.filter((_, i) => !reachable[i]);\n  if (dead.length === 0) return undefined;\n\n  return [\n    `Local ${dead.length === 1 ? 'service is' : 'services are'} not running:`,\n    '',\n    ...dead.map(\n      (s) =>\n        `  ${s.label} — nothing listening at ${new URL(s.url).origin}\\n` +\n        `    requested by ${s.flag}\\n` +\n        `    start it with: ${s.startHint}`,\n    ),\n    '',\n    'Start the missing services, or drop the flag to use production.',\n  ].join('\\n');\n}\n\n/**\n * `--local-mcp` used to select local skills too; anyone still relying on that\n * would silently get production skills. Temporary — drop after a release or two.\n */\nexport function localMcpSkillsNotice(flags: LocalDevFlags): string | undefined {\n  if (flags.localMcp !== true) return undefined;\n  if (flags.localContextMill !== undefined || flags.localDev === true) {\n    return undefined;\n  }\n  return (\n    '--local-mcp now points only at the local MCP server. ' +\n    'For local skills, add --local-context-mill (or use --local-dev for both).'\n  );\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAa,yBAAyB;AACtC,MAAa,gBAAgB;;AAE7B,MAAa,oBAAoB;;;;;;AAwBjC,SAAgB,gBAAgB,OAAwC;CACtE,MAAM,WAAW,MAAM,YAAY;AACnC,QAAO;EACL,UAAU,MAAM,YAAY;EAC5B,kBAAkB,MAAM,oBAAoB;EAC5C,cAAc,MAAM,gBAAgB;EACrC;;;AAIH,SAAgB,iBACd,MACkB;CAClB,MAAM,QAAQ,OAAe,UAAuC;EAClE,MAAM,QAAQ,KAAK,UAAU,KAAK;AAClC,SAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;;AAE9C,QAAO,gBAAgB;EACrB,UAAU,KAAK,aAAa,WAAW;EACvC,UAAU,KAAK,aAAa,WAAW;EACvC,kBAAkB,KAAK,sBAAsB,mBAAmB;EAChE,cAAc,KAAK,iBAAiB,eAAe;EACpD,CAAC;;AAGJ,MAAM,qBAAuC;CAC3C,UAAU;CACV,kBAAkB;CAClB,cAAc;CACf;AAED,IAAI,WAAoC;;;;;AAMxC,SAAgB,aAAa,MAAiD;AAC5E,YAAW,iBAAiB,KAAK;AACjC,QAAO;;;;;;;;;;AAWT,SAAgB,cAAgC;AAC9C,QAAO,YAAY;;AAiBrB,MAAM,iBAA0C;CAC9C;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,KAAK,GAAG,uBAAuB;EAC/B,WAAW;EACZ;CACD;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,KAAK;EACL,WACE;EACH;CACD;EACE,KAAK;EACL,OAAO;EACP,MAAM;EACN,KAAK;EACL,WAAW;EACZ;CACF;AAMD,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,mBAAmB;AAEzB,eAAe,YAAY,KAA+B;AACxD,MAAK,IAAI,UAAU,GAAG,WAAW,gBAAgB,UAC/C,KAAI;AAIF,QAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,iBAAiB,EAAE,CAAC;AACnE,SAAO;SACD;AACN,MAAI,UAAU,eACZ,OAAM,IAAI,SAAS,MACjB,WAAW,GAAG,mBAAmB,MAAM,UAAU,GAAG,CACrD;;AAIP,QAAO;;;;;;;;;;AAWT,eAAsB,mBACpB,UAC6B;CAC7B,MAAM,YAAY,eAAe,QAAQ,MAAM,SAAS,EAAE,KAAK;AAC/D,KAAI,UAAU,WAAW,EAAG,QAAO,KAAA;CAEnC,MAAM,YAAY,MAAM,QAAQ,IAAI,UAAU,KAAK,MAAM,YAAY,EAAE,IAAI,CAAC,CAAC;CAC7E,MAAM,OAAO,UAAU,QAAQ,GAAG,MAAM,CAAC,UAAU,GAAG;AACtD,KAAI,KAAK,WAAW,EAAG,QAAO,KAAA;AAE9B,QAAO;EACL,SAAS,KAAK,WAAW,IAAI,eAAe,eAAe;EAC3D;EACA,GAAG,KAAK,KACL,MACC,KAAK,EAAE,MAAM,0BAA0B,IAAI,IAAI,EAAE,IAAI,CAAC,OAAO,qBACzC,EAAE,KAAK,uBACL,EAAE,YAC3B;EACD;EACA;EACD,CAAC,KAAK,KAAK;;;;;;AAOd,SAAgB,qBAAqB,OAA0C;AAC7E,KAAI,MAAM,aAAa,KAAM,QAAO,KAAA;AACpC,KAAI,MAAM,qBAAqB,KAAA,KAAa,MAAM,aAAa,KAC7D;AAEF,QACE"}

package/dist/mcp-BprhJJ2c.js

@@ -1,64 +0,0 @@
-import { gt as VERSION, s as logToFile } from "./debug-DWYDVp0B.js";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { createJiti } from "jiti";
-//#region src/lib/agent/runner/harness/pi/mcp.ts
-/**
-* pi has no built-in MCP; `pi-mcp-adapter` — pi's own MCP extension, built here
-* with its supported `createMcpAdapter` embedding API — bridges the same hosted
-* MCP the anthropic path uses into the agent.
-*/
-const MCP_TOKEN_ENV = "POSTHOG_MCP_TOKEN";
-/** Server `instructions` for the system prompt — the adapter exposes no accessor, so one standard-SDK handshake; best-effort. */
-async function fetchInstructions(mcpUrl, accessToken, userAgent) {
-	const client = new Client({
-		name: "posthog-wizard",
-		version: VERSION
-	});
-	try {
-		const transport = new StreamableHTTPClientTransport(new URL(mcpUrl), { requestInit: { headers: {
-			Authorization: `Bearer ${accessToken}`,
-			"User-Agent": userAgent
-		} } });
-		await client.connect(transport);
-		const instructions = client.getInstructions() || void 0;
-		logToFile(`[pi-mcp] instructions ${instructions?.length ?? 0} chars`);
-		return instructions;
-	} catch (err) {
-		logToFile(`[pi-mcp] instructions fetch skipped: ${String(err)}`);
-		return;
-	} finally {
-		await client.close().catch(() => void 0);
-	}
-}
-async function setupPostHogMcp(opts) {
-	const { mcpUrl, accessToken, userAgent } = opts;
-	process.env[MCP_TOKEN_ENV] = accessToken;
-	const extensionFactory = (await createJiti(import.meta.url).import("pi-mcp-adapter")).createMcpAdapter({ config: {
-		mcpServers: { posthog: {
-			url: mcpUrl,
-			auth: "bearer",
-			bearerTokenEnv: MCP_TOKEN_ENV,
-			headers: { "User-Agent": userAgent },
-			lifecycle: "eager",
-			directTools: ["exec"],
-			exposeResources: false
-		} },
-		settings: {
-			disableProxyTool: true,
-			toolPrefix: "posthog"
-		}
-	} });
-	logToFile(`[pi-mcp] adapter loaded; posthog MCP at ${mcpUrl}`);
-	const cleanup = () => {
-		delete process.env[MCP_TOKEN_ENV];
-	};
-	return {
-		extensionFactory,
-		cleanup
-	};
-}
-//#endregion
-export { fetchInstructions, setupPostHogMcp };
-
-//# sourceMappingURL=mcp-BprhJJ2c.js.map

package/dist/mcp-BprhJJ2c.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-BprhJJ2c.js","names":[],"sources":["../src/lib/agent/runner/harness/pi/mcp.ts"],"sourcesContent":["/**\n * pi has no built-in MCP; `pi-mcp-adapter` — pi's own MCP extension, built here\n * with its supported `createMcpAdapter` embedding API — bridges the same hosted\n * MCP the anthropic path uses into the agent.\n */\n\nimport { Client } from '@modelcontextprotocol/sdk/client/index.js';\nimport { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';\nimport { createJiti } from 'jiti';\nimport { VERSION } from '@lib/version';\nimport { logToFile } from '@utils/debug';\n\nconst MCP_TOKEN_ENV = 'POSTHOG_MCP_TOKEN';\n\nexport interface PostHogMcpSetup {\n  /** pi ExtensionFactory to add to the resource loader's `extensionFactories`. */\n  extensionFactory: (pi: unknown) => void;\n  /** Drop the token env var. Call after the run. */\n  cleanup: () => void;\n}\n\n/** Server `instructions` for the system prompt — the adapter exposes no accessor, so one standard-SDK handshake; best-effort. */\nexport async function fetchInstructions(\n  mcpUrl: string,\n  accessToken: string,\n  userAgent: string,\n): Promise<string | undefined> {\n  const client = new Client({ name: 'posthog-wizard', version: VERSION });\n  try {\n    const transport = new StreamableHTTPClientTransport(new URL(mcpUrl), {\n      requestInit: {\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          'User-Agent': userAgent,\n        },\n      },\n    });\n    await client.connect(transport);\n    const instructions = client.getInstructions() || undefined;\n    logToFile(`[pi-mcp] instructions ${instructions?.length ?? 0} chars`);\n    return instructions;\n  } catch (err) {\n    logToFile(`[pi-mcp] instructions fetch skipped: ${String(err)}`);\n    return undefined;\n  } finally {\n    await client.close().catch(() => undefined);\n  }\n}\n\nexport async function setupPostHogMcp(opts: {\n  mcpUrl: string;\n  accessToken: string;\n  userAgent: string;\n}): Promise<PostHogMcpSetup> {\n  const { mcpUrl, accessToken, userAgent } = opts;\n\n  // By env NAME: the token stays in this process, off disk, and never reaches pi's env-scrubbed tool subprocesses.\n  process.env[MCP_TOKEN_ENV] = accessToken;\n\n  // The adapter ships raw TypeScript; loading through jiti is its documented requirement.\n  const jiti = createJiti(import.meta.url);\n  const mod = await jiti.import('pi-mcp-adapter');\n  const extensionFactory = mod.createMcpAdapter({\n    config: {\n      mcpServers: {\n        posthog: {\n          url: mcpUrl,\n          auth: 'bearer',\n          bearerTokenEnv: MCP_TOKEN_ENV,\n          headers: { 'User-Agent': userAgent },\n          // Connect at extension load — direct tools register without a session_start.\n          lifecycle: 'eager',\n          // Register only `exec`: `directTools: true` also mints a `posthog_get_<name>` tool per MCP resource, whose sentence-length names overflow Anthropic's 128-char tool-name limit and 400 the whole request.\n          directTools: ['exec'],\n          exposeResources: false,\n        },\n      },\n      // Disable the proxy `mcp` tool (its search indirection pollutes context); the adapter re-enables it only if no direct tools resolve.\n      settings: { disableProxyTool: true, toolPrefix: 'posthog' },\n    },\n  });\n  logToFile(`[pi-mcp] adapter loaded; posthog MCP at ${mcpUrl}`);\n\n  const cleanup = (): void => {\n    delete process.env[MCP_TOKEN_ENV];\n  };\n\n  return { extensionFactory, cleanup };\n}\n"],"mappings":";;;;;;;;;;AAYA,MAAM,gBAAgB;;AAUtB,eAAsB,kBACpB,QACA,aACA,WAC6B;CAC7B,MAAM,SAAS,IAAI,OAAO;EAAE,MAAM;EAAkB,SAAS;EAAS,CAAC;AACvE,KAAI;EACF,MAAM,YAAY,IAAI,8BAA8B,IAAI,IAAI,OAAO,EAAE,EACnE,aAAa,EACX,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,EACF,CAAC;AACF,QAAM,OAAO,QAAQ,UAAU;EAC/B,MAAM,eAAe,OAAO,iBAAiB,IAAI,KAAA;AACjD,YAAU,yBAAyB,cAAc,UAAU,EAAE,QAAQ;AACrE,SAAO;UACA,KAAK;AACZ,YAAU,wCAAwC,OAAO,IAAI,GAAG;AAChE;WACQ;AACR,QAAM,OAAO,OAAO,CAAC,YAAY,KAAA,EAAU;;;AAI/C,eAAsB,gBAAgB,MAIT;CAC3B,MAAM,EAAE,QAAQ,aAAa,cAAc;AAG3C,SAAQ,IAAI,iBAAiB;CAK7B,MAAM,oBADM,MADC,WAAW,OAAO,KAAK,IAAI,CACjB,OAAO,iBAAiB,EAClB,iBAAiB,EAC5C,QAAQ;EACN,YAAY,EACV,SAAS;GACP,KAAK;GACL,MAAM;GACN,gBAAgB;GAChB,SAAS,EAAE,cAAc,WAAW;GAEpC,WAAW;GAEX,aAAa,CAAC,OAAO;GACrB,iBAAiB;GAClB,EACF;EAED,UAAU;GAAE,kBAAkB;GAAM,YAAY;GAAW;EAC5D,EACF,CAAC;AACF,WAAU,2CAA2C,SAAS;CAE9D,MAAM,gBAAsB;AAC1B,SAAO,QAAQ,IAAI;;AAGrB,QAAO;EAAE;EAAkB;EAAS"}

package/dist/mcp-prompt-streaming-E1d8DJcX.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-prompt-streaming-E1d8DJcX.js","names":[],"sources":["../src/lib/agent/mcp-prompt-streaming.ts"],"sourcesContent":["/**\n * Streaming prompt runner for the McpSuggestedPromptsScreen.\n *\n * Calls the Claude Agent SDK's `query()` directly with just the PostHog\n * MCP server configured — no skills, no sandbox, no settings sources,\n * no wizard-tools. This is the lightweight cousin of `runAgent` in\n * `agent-interface.ts`: same SDK, much narrower surface, suitable for\n * \"user asked a question, show the answer\" interactions.\n *\n * The function is an async generator that yields `AgentChunk`s extracted\n * from the SDK's message stream. Callers (the screen) consume them via\n * `for await (...)` and render as they arrive.\n */\n\nimport type { AgentChunk } from '@ui/tui/services/mcp-suggested-prompts-services';\nimport type { Credentials } from '@lib/wizard-session';\nimport { DEFAULT_AGENT_MODEL, WIZARD_USER_AGENT } from '@lib/constants';\nimport { logToFile } from '@utils/debug';\nimport { gatewayAuth } from '@lib/gateway-session';\nimport { buildAgentEnv, buildRunTags } from '@lib/agent/agent-interface';\nimport { sanitizeAgentSubprocessEnv } from '@lib/agent/agent-env-isolation';\nimport { createIsolatedAgentConfigDir } from '@lib/agent/stored-login';\nimport { analytics } from '@utils/analytics';\n\n// Cached SDK module — first call pays the dynamic-import cost; later\n// calls reuse the same module.\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nlet _sdkModule: any | null = null;\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nasync function loadSdk(): Promise<any> {\n  if (!_sdkModule) {\n    _sdkModule = await import('@anthropic-ai/claude-agent-sdk');\n  }\n  return _sdkModule;\n}\n\nconst MODEL = DEFAULT_AGENT_MODEL;\n\n// Bounded turn count so a single prompt can't loop forever on the\n// user's nickel. 20 gives the agent room for non-trivial multi-step\n// chains (multi-tool reads → reason → write → verify → summarize) while\n// still capping runaway loops. Worth tuning down once we see real\n// telemetry on average turn counts per prompt.\nconst MAX_TURNS = 30;\n\n/**\n * Extract a short, single-line summary from an arbitrary value. Used\n * for tool-call args and tool-result bodies so the screen has something\n * compact to render.\n */\nfunction summarize(value: unknown, maxLen = 120): string {\n  if (value == null) return '';\n  let text: string;\n  if (typeof value === 'string') text = value;\n  else {\n    try {\n      text = JSON.stringify(value);\n    } catch {\n      text = String(value);\n    }\n  }\n  text = text.replace(/\\s+/g, ' ').trim();\n  if (text.length > maxLen) text = text.slice(0, maxLen - 1) + '…';\n  return text;\n}\n\n/**\n * Convert one SDK message into zero or more AgentChunks. Mirrors the\n * subset of message shapes the wizard's main runAgent middleware\n * handles, but narrowed to just the kinds the screen needs to render.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nfunction messageToChunks(message: any): AgentChunk[] {\n  const chunks: AgentChunk[] = [];\n\n  if (message?.type === 'assistant') {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n    const content = message.message?.content;\n    if (Array.isArray(content)) {\n      for (const block of content) {\n        if (!block || typeof block !== 'object') continue;\n        const type = (block as { type?: string }).type;\n        if (type === 'text') {\n          const text = (block as { text?: string }).text ?? '';\n          if (text) chunks.push({ kind: 'text', text });\n        } else if (type === 'tool_use') {\n          const name = (block as { name?: string }).name ?? 'tool';\n          const input = (block as { input?: unknown }).input;\n          // CLI mode's exec tool takes a `command` string; keep it verbatim so\n          // the screen can recover the inner tool name for follow-ups.\n          const command = (input as { command?: unknown })?.command;\n          chunks.push({\n            kind: 'tool-call',\n            toolName: name,\n            detail: summarize(input),\n            command: typeof command === 'string' ? command : undefined,\n          });\n        }\n      }\n    }\n  }\n\n  if (message?.type === 'user') {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n    const content = message.message?.content;\n    if (Array.isArray(content)) {\n      for (const block of content) {\n        if (!block || typeof block !== 'object') continue;\n        const type = (block as { type?: string }).type;\n        if (type === 'tool_result') {\n          const detail = summarize((block as { content?: unknown }).content);\n          chunks.push({ kind: 'tool-result', toolName: 'tool', detail });\n        }\n      }\n    }\n  }\n\n  if (message?.type === 'result') {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n    const sessionId = (message as { session_id?: string }).session_id;\n    chunks.push({ kind: 'done', sessionId });\n  }\n\n  return chunks;\n}\n\n/**\n * Build a system-prompt append that nudges the agent to fit its response\n * inside the current terminal window. We can't actually constrain Claude\n * — this is a soft cap that the model usually honors. The screen also\n * applies a hard truncation cap as a fallback for non-compliant runs.\n *\n * Core principle nudged at the model: TALL CONTENT IS BAD, WIDE CONTENT\n * IS GOOD. Default terminal is 120 columns × 24 rows — that's a lot of\n * horizontal space, not much vertical. Spread data across columns, never\n * stack it down rows when a horizontal layout would work.\n */\nfunction buildTerminalFitPrompt(): string {\n  const cols = process.stdout.columns ?? 120;\n  const rows = process.stdout.rows ?? 24;\n  // Reserve rows for wizard chrome (title, status, hint, margins).\n  const messageBudget = Math.max(8, rows - 10);\n\n  return [\n    `You are responding inside a CLI window that is exactly ${cols} columns wide and ${rows} rows tall. The user CAN'T SCROLL — your entire reply must fit on screen.`,\n    ``,\n    `LAYOUT PRINCIPLE: tall content is the enemy, wide content is your friend. You have ${cols} columns of horizontal space; use them. Spread data across columns instead of stacking it down rows.`,\n    ``,\n    `Tables:`,\n    `- Max 5 body rows. The prompts the user picks already constrain results to 5 or fewer — honor that and do not pad with extra rows.`,\n    `- If a tool result returns more than 5 items, show the top 5 and mention the rest count inline (e.g. \"...and 12 more\").`,\n    `- Prefer transposing wide-but-short data (items across columns, metrics down rows) when labels are short.`,\n    `- A two-column table with many rows is the tall layout to AVOID.`,\n    ``,\n    `Other limits:`,\n    `- Aim for 3-5 lines of prose. Maximum ${messageBudget} lines total.`,\n    `- DO NOT announce what you are about to do. Skip preamble like \"I'll query…\", \"Let me check…\", \"Now I'll…\", \"I'm going to…\". Go straight to running tools and then the answer.`,\n    `- Lists: if there are 6+ short items, format them inline (comma-separated), not as a vertical bullet list.`,\n    `- For tool results, summarize the 1-3 numbers that matter. Do NOT echo raw JSON or the full payload.`,\n    `- Code blocks: no language tag, no leading blank lines.`,\n    `- No closing pleasantries (\"let me know if…\", \"feel free to…\"). Stop when the answer is delivered.`,\n    `- No section headers unless the response actually has multiple sections.`,\n    ``,\n    `Naming saved artifacts:`,\n    `- Every dashboard, insight, notebook, or annotation you create MUST include \"(wizard MCP tutorial)\" at the end of its title or name field. Examples: \"Weekly signups (wizard MCP tutorial)\", \"Top errors this week (wizard MCP tutorial)\", \"Onboarding analysis (wizard MCP tutorial)\".`,\n    `- This applies on both create AND rename calls. If the user asks you to rename a saved artifact, preserve the \"(wizard MCP tutorial)\" suffix unless they explicitly ask you to drop it.`,\n    `- Reason: lets the user find / clean up everything this tutorial created from one search in PostHog. Don't skip it — it's the only signal they'll have that an artifact came from the wizard.`,\n    ``,\n    `Tone & framing:`,\n    `- This is a tutorial demoing PostHog (the product the user just installed). You are showing it off, not auditing it. Stay constructive and neutral about PostHog throughout.`,\n    `- Don't editorialize about PostHog's reliability, performance, or cost. Describe what the data shows; treat anomalies as the user's data, not a platform issue.`,\n    `- If a tool call fails or returns nothing, say \"the query didn't return data — try a different angle\" or similar. Do NOT speculate about outages, gateway issues, MCP problems, or service health.`,\n    `- Avoid value-laden phrases like \"worth investigating\", \"concerning\", \"red flag\", \"problematic\", \"suspicious\", \"alarming\" when describing the user's metrics. Stick to what the numbers show; the user draws conclusions.`,\n  ].join('\\n');\n}\n\n/**\n * Gateway trace tags for a tutorial prompt run — without them the gateway has\n * nothing to attribute its `$ai_generation` events to. Returns `{}` when no\n * program is supplied. Exported so the contract is testable without the SDK.\n */\nexport function buildTutorialRunTags(args: {\n  programId?: string;\n  integration?: string;\n}): Record<string, string> {\n  if (!args.programId) return {};\n  return buildRunTags({\n    programId: args.programId,\n    // The tutorial usually has no detected framework; fall back to the\n    // program so the axis is never an empty string.\n    integration: args.integration ?? args.programId,\n    runId: analytics.runId,\n    build: analytics.build,\n  });\n}\n\nexport async function* runMcpPromptViaSdk(args: {\n  prompt: string;\n  credentials: Credentials;\n  signal: AbortSignal;\n  /** When set, the SDK loads the named session's prior turns as\n   *  context so the follow-up prompt can reference what the agent\n   *  already showed. */\n  resumeSessionId?: string;\n  /** Program this run's gateway spend attributes to. Omitting it fails the run\n   *  rather than going unattributed, so every caller must supply one. */\n  programId?: string;\n  /** Integration label for the trace tags; the tutorial usually has none. */\n  integration?: string;\n}): AsyncIterable<AgentChunk> {\n  const { prompt, credentials, signal, resumeSessionId } = args;\n\n  // Assembled here rather than passed in so the TUI service layer doesn't\n  // have to import this module's dependencies.\n  const wizardMetadata = buildTutorialRunTags(args);\n\n  // Route the SDK's LLM calls through the PostHog AI gateway, authed\n  // with the run's minted token. Set BEFORE loading the SDK in\n  // case any in-process code reads env at module init (cached base\n  // URLs, OAuth setup, etc.) — same reason `initializeAgent` does this\n  // before its query() call. Without these the SDK tries to\n  // authenticate directly against Anthropic and 401s with \"Invalid\n  // authentication credentials\".\n  process.env.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS = 'true';\n\n  // The url and the bearer are one unit: a run must take both from the same\n  // mint.\n  const auth = await gatewayAuth(\n    credentials.host,\n    credentials.accessToken,\n    args.programId,\n  );\n  const gatewayUrl = auth.gatewayUrl;\n  process.env.ANTHROPIC_BASE_URL = gatewayUrl;\n  process.env.ANTHROPIC_AUTH_TOKEN = auth.token;\n  process.env.CLAUDE_CODE_OAUTH_TOKEN = auth.token;\n\n  logToFile(\n    `[runMcpPromptViaSdk] gatewayUrl=${gatewayUrl} tokenPrefix=${\n      auth.token ? auth.token.slice(0, 4) + '***' : '(missing)'\n    }`,\n  );\n\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const { query } = await loadSdk();\n\n  // Bridge external AbortSignal → SDK AbortController.\n  const abortController = new AbortController();\n  if (signal.aborted) abortController.abort();\n  else\n    signal.addEventListener('abort', () => abortController.abort(), {\n      once: true,\n    });\n\n  const mcpUrl = credentials.host.mcpUrl;\n  logToFile(\n    `[runMcpPromptViaSdk] mcpUrl=${mcpUrl} model=${MODEL} resume=${\n      resumeSessionId ?? '(none)'\n    }`,\n  );\n\n  // The SDK expects an async generator for the prompt that stays open\n  // until the result is received. For a single-turn prompt we yield one\n  // user message and then await an abort (which fires when streaming\n  // completes or the caller cancels).\n  const createPromptStream = async function* () {\n    yield {\n      type: 'user' as const,\n      session_id: '',\n      message: { role: 'user' as const, content: prompt },\n      parent_tool_use_id: null,\n    };\n    // Hold the stream open until abort. The SDK closes its end when it\n    // sees a `result` message; we close ours via the abortController in\n    // the finally block below.\n    await new Promise<void>((resolve) => {\n      if (abortController.signal.aborted) {\n        resolve();\n        return;\n      }\n      abortController.signal.addEventListener('abort', () => resolve(), {\n        once: true,\n      });\n    });\n  };\n\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-call\n    const response = query({\n      prompt: createPromptStream(),\n      options: {\n        abortController,\n        model: MODEL,\n        cwd: process.cwd(),\n        permissionMode: 'acceptEdits',\n        maxTurns: MAX_TURNS,\n        // Match agent-interface.ts — the 1M context beta is what keeps\n        // resumed follow-up sessions from truncating after a few turns.\n        betas: ['context-1m-2025-08-07'],\n        // Only load project-level skills/settings. Without this the SDK\n        // defaults to ['user', 'project'] and a user's\n        // `~/.claude/settings.json` (apiKeyHelper / env block) can\n        // override the OAuth routing we set above.\n        settingSources: ['project'],\n        // When set, the SDK replays the named session's turns into the\n        // new query so the follow-up prompt has full conversation\n        // context. Omit on the first prompt for a fresh session.\n        ...(resumeSessionId ? { resume: resumeSessionId } : {}),\n        // Without `canUseTool` the SDK falls back to \"ask the user\" on\n        // every MCP tool call — `permissionMode: 'acceptEdits'` only\n        // relaxes Edit/Write, not MCP. Our Ink TUI has no surface to\n        // answer that prompt, so the agent would stall mid-stream\n        // saying things like \"needs your approval to create dashboard\".\n        // The tutorial's whole point is demoing the MCP tools against\n        // the user's project, so we auto-allow everything that matches\n        // the prefix and deny anything else (defense in depth — the\n        // `allowedTools` filter above already enforces this).\n        canUseTool: (toolName: string, input: unknown) => {\n          if (toolName.startsWith('mcp__posthog-wizard__')) {\n            return Promise.resolve({\n              behavior: 'allow' as const,\n              updatedInput: (input ?? {}) as Record<string, unknown>,\n            });\n          }\n          logToFile(`[runMcpPromptViaSdk] denying non-MCP tool: ${toolName}`);\n          return Promise.resolve({\n            behavior: 'deny' as const,\n            message: `${toolName} is not available in the MCP tutorial — only PostHog MCP tools are permitted.`,\n          });\n        },\n        systemPrompt: {\n          type: 'preset',\n          preset: 'claude_code',\n          append: buildTerminalFitPrompt(),\n        },\n        mcpServers: {\n          'posthog-wizard': {\n            type: 'http',\n            url: mcpUrl,\n            headers: {\n              // Env reference, not the token: the SDK puts this config on the\n              // spawned CLI's argv, where `ps` shows it to any local process.\n              Authorization: 'Bearer ${POSTHOG_MCP_TOKEN}',\n              'User-Agent': WIZARD_USER_AGENT,\n            },\n            // CLI mode's single `exec` tool carries the full command reference\n            // on its schema — keep it in context, never deferred behind tool\n            // search.\n            alwaysLoad: true,\n          },\n        },\n        // Only let the agent use MCP tools — no shell, no file I/O,\n        // no Read/Edit/Write. This is a chat-with-MCP run, not a\n        // wizard skill execution.\n        allowedTools: ['mcp__posthog-wizard__*'],\n        env: {\n          // Drop the ENTIRE ANTHROPIC_*/CLAUDE_CODE_* namespace from the\n          // inherited env so no shell/settings value can silently bypass the\n          // PostHog gateway and defeat quota tracking / the OAuth flow; the\n          // wizard's own gateway routing is injected fresh below. See\n          // agent-env-isolation.ts.\n          ...sanitizeAgentSubprocessEnv(process.env),\n          // Gateway routing from this run's own auth, not process.env: a\n          // concurrent run writes those globals too, and there is an await\n          // between the write above and this read.\n          ANTHROPIC_BASE_URL: auth.gatewayUrl,\n          ANTHROPIC_AUTH_TOKEN: auth.token,\n          CLAUDE_CODE_OAUTH_TOKEN: auth.token,\n          // Point the binary at an empty config dir so it cannot resolve a\n          // stored Claude login and send that to the gateway, which 401s it.\n          // See stored-login.ts.\n          CLAUDE_CONFIG_DIR: createIsolatedAgentConfigDir(),\n          CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: 'true',\n          // The MCP config resolves this in the child; sending the value would\n          // put it on the CLI's argv.\n          POSTHOG_MCP_TOKEN: credentials.accessToken,\n          // SDK 0.3.142+ connects MCP servers in the background by\n          // default; without this the agent may try to call tools\n          // before posthog-wizard is connected on turn 1.\n          MCP_CONNECTION_NONBLOCKING: '0',\n          // This run's trace tags, which the gateway reads to attribute its\n          // `$ai_generation` events. Flags stay empty: the tutorial doesn't\n          // fork on any.\n          ANTHROPIC_CUSTOM_HEADERS: buildAgentEnv(\n            wizardMetadata ?? {},\n            {},\n            auth.teamId,\n          ),\n        },\n      },\n    });\n\n    for await (const message of response as AsyncIterable<unknown>) {\n      if (signal.aborted) return;\n      for (const chunk of messageToChunks(message)) {\n        yield chunk;\n        if (chunk.kind === 'done') return;\n      }\n    }\n  } catch (err) {\n    const text = err instanceof Error ? err.message : String(err);\n    logToFile(`[runMcpPromptViaSdk] error: ${text}`);\n    yield { kind: 'error', text };\n  } finally {\n    // Closes the prompt stream so `query()` shuts down cleanly even if\n    // we never saw a 'result' message.\n    abortController.abort();\n  }\n}\n"],"mappings":";;;;;AA2BA,IAAI,aAAyB;AAG7B,eAAe,UAAwB;AACrC,KAAI,CAAC,WACH,cAAa,MAAM,OAAO;AAE5B,QAAO;;AAGT,MAAM,QAAQ;AAOd,MAAM,YAAY;;;;;;AAOlB,SAAS,UAAU,OAAgB,SAAS,KAAa;AACvD,KAAI,SAAS,KAAM,QAAO;CAC1B,IAAI;AACJ,KAAI,OAAO,UAAU,SAAU,QAAO;KAEpC,KAAI;AACF,SAAO,KAAK,UAAU,MAAM;SACtB;AACN,SAAO,OAAO,MAAM;;AAGxB,QAAO,KAAK,QAAQ,QAAQ,IAAI,CAAC,MAAM;AACvC,KAAI,KAAK,SAAS,OAAQ,QAAO,KAAK,MAAM,GAAG,SAAS,EAAE,GAAG;AAC7D,QAAO;;;;;;;AAST,SAAS,gBAAgB,SAA4B;CACnD,MAAM,SAAuB,EAAE;AAE/B,KAAI,SAAS,SAAS,aAAa;EAEjC,MAAM,UAAU,QAAQ,SAAS;AACjC,MAAI,MAAM,QAAQ,QAAQ,CACxB,MAAK,MAAM,SAAS,SAAS;AAC3B,OAAI,CAAC,SAAS,OAAO,UAAU,SAAU;GACzC,MAAM,OAAQ,MAA4B;AAC1C,OAAI,SAAS,QAAQ;IACnB,MAAM,OAAQ,MAA4B,QAAQ;AAClD,QAAI,KAAM,QAAO,KAAK;KAAE,MAAM;KAAQ;KAAM,CAAC;cACpC,SAAS,YAAY;IAC9B,MAAM,OAAQ,MAA4B,QAAQ;IAClD,MAAM,QAAS,MAA8B;IAG7C,MAAM,UAAW,OAAiC;AAClD,WAAO,KAAK;KACV,MAAM;KACN,UAAU;KACV,QAAQ,UAAU,MAAM;KACxB,SAAS,OAAO,YAAY,WAAW,UAAU,KAAA;KAClD,CAAC;;;;AAMV,KAAI,SAAS,SAAS,QAAQ;EAE5B,MAAM,UAAU,QAAQ,SAAS;AACjC,MAAI,MAAM,QAAQ,QAAQ,CACxB,MAAK,MAAM,SAAS,SAAS;AAC3B,OAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AAEzC,OADc,MAA4B,SAC7B,eAAe;IAC1B,MAAM,SAAS,UAAW,MAAgC,QAAQ;AAClE,WAAO,KAAK;KAAE,MAAM;KAAe,UAAU;KAAQ;KAAQ,CAAC;;;;AAMtE,KAAI,SAAS,SAAS,UAAU;EAE9B,MAAM,YAAa,QAAoC;AACvD,SAAO,KAAK;GAAE,MAAM;GAAQ;GAAW,CAAC;;AAG1C,QAAO;;;;;;;;;;;;;AAcT,SAAS,yBAAiC;CACxC,MAAM,OAAO,QAAQ,OAAO,WAAW;CACvC,MAAM,OAAO,QAAQ,OAAO,QAAQ;CAEpC,MAAM,gBAAgB,KAAK,IAAI,GAAG,OAAO,GAAG;AAE5C,QAAO;EACL,0DAA0D,KAAK,oBAAoB,KAAK;EACxF;EACA,sFAAsF,KAAK;EAC3F;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,yCAAyC,cAAc;EACvD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK;;;;;;;AAQd,SAAgB,qBAAqB,MAGV;AACzB,KAAI,CAAC,KAAK,UAAW,QAAO,EAAE;AAC9B,QAAO,aAAa;EAClB,WAAW,KAAK;EAGhB,aAAa,KAAK,eAAe,KAAK;EACtC,OAAO,UAAU;EACjB,OAAO,UAAU;EAClB,CAAC;;AAGJ,gBAAuB,mBAAmB,MAaZ;CAC5B,MAAM,EAAE,QAAQ,aAAa,QAAQ,oBAAoB;CAIzD,MAAM,iBAAiB,qBAAqB,KAAK;AASjD,SAAQ,IAAI,yCAAyC;CAIrD,MAAM,OAAO,MAAM,YACjB,YAAY,MACZ,YAAY,aACZ,KAAK,UACN;CACD,MAAM,aAAa,KAAK;AACxB,SAAQ,IAAI,qBAAqB;AACjC,SAAQ,IAAI,uBAAuB,KAAK;AACxC,SAAQ,IAAI,0BAA0B,KAAK;AAE3C,WACE,mCAAmC,WAAW,eAC5C,KAAK,QAAQ,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,cAEjD;CAGD,MAAM,EAAE,UAAU,MAAM,SAAS;CAGjC,MAAM,kBAAkB,IAAI,iBAAiB;AAC7C,KAAI,OAAO,QAAS,iBAAgB,OAAO;KAEzC,QAAO,iBAAiB,eAAe,gBAAgB,OAAO,EAAE,EAC9D,MAAM,MACP,CAAC;CAEJ,MAAM,SAAS,YAAY,KAAK;AAChC,WACE,+BAA+B,OAAO,SAAS,MAAM,UACnD,mBAAmB,WAEtB;CAMD,MAAM,qBAAqB,mBAAmB;AAC5C,QAAM;GACJ,MAAM;GACN,YAAY;GACZ,SAAS;IAAE,MAAM;IAAiB,SAAS;IAAQ;GACnD,oBAAoB;GACrB;AAID,QAAM,IAAI,SAAe,YAAY;AACnC,OAAI,gBAAgB,OAAO,SAAS;AAClC,aAAS;AACT;;AAEF,mBAAgB,OAAO,iBAAiB,eAAe,SAAS,EAAE,EAChE,MAAM,MACP,CAAC;IACF;;AAGJ,KAAI;EAEF,MAAM,WAAW,MAAM;GACrB,QAAQ,oBAAoB;GAC5B,SAAS;IACP;IACA,OAAO;IACP,KAAK,QAAQ,KAAK;IAClB,gBAAgB;IAChB,UAAU;IAGV,OAAO,CAAC,wBAAwB;IAKhC,gBAAgB,CAAC,UAAU;IAI3B,GAAI,kBAAkB,EAAE,QAAQ,iBAAiB,GAAG,EAAE;IAUtD,aAAa,UAAkB,UAAmB;AAChD,SAAI,SAAS,WAAW,wBAAwB,CAC9C,QAAO,QAAQ,QAAQ;MACrB,UAAU;MACV,cAAe,SAAS,EAAE;MAC3B,CAAC;AAEJ,eAAU,8CAA8C,WAAW;AACnE,YAAO,QAAQ,QAAQ;MACrB,UAAU;MACV,SAAS,GAAG,SAAS;MACtB,CAAC;;IAEJ,cAAc;KACZ,MAAM;KACN,QAAQ;KACR,QAAQ,wBAAwB;KACjC;IACD,YAAY,EACV,kBAAkB;KAChB,MAAM;KACN,KAAK;KACL,SAAS;MAGP,eAAe;MACf,cAAc;MACf;KAID,YAAY;KACb,EACF;IAID,cAAc,CAAC,yBAAyB;IACxC,KAAK;KAMH,GAAG,2BAA2B,QAAQ,IAAI;KAI1C,oBAAoB,KAAK;KACzB,sBAAsB,KAAK;KAC3B,yBAAyB,KAAK;KAI9B,mBAAmB,8BAA8B;KACjD,wCAAwC;KAGxC,mBAAmB,YAAY;KAI/B,4BAA4B;KAI5B,0BAA0B,cACxB,kBAAkB,EAAE,EACpB,EAAE,EACF,KAAK,OACN;KACF;IACF;GACF,CAAC;AAEF,aAAW,MAAM,WAAW,UAAoC;AAC9D,OAAI,OAAO,QAAS;AACpB,QAAK,MAAM,SAAS,gBAAgB,QAAQ,EAAE;AAC5C,UAAM;AACN,QAAI,MAAM,SAAS,OAAQ;;;UAGxB,KAAK;EACZ,MAAM,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC7D,YAAU,+BAA+B,OAAO;AAChD,QAAM;GAAE,MAAM;GAAS;GAAM;WACrB;AAGR,kBAAgB,OAAO"}