@posthog/wizard 2.80.0 → 2.80.1

package/dist/endpoints-D-4KxZiB.js

@@ -1,108 +0,0 @@
-import { s as logToFile } from "./debug-DyARf5TF.js";
-import { g as GITHUB_SKILLS_BASE_URL, o as AWS_SKILLS_BASE_URL } from "./constants-DO4X70po.js";
-//#region src/shared/health-checks/endpoints.ts
-function noConnectionResult(error, attempts) {
-	return {
-		status: "no-connection",
-		error,
-		rawIndicator: attempts > 1 ? `attempts=${attempts}` : void 0
-	};
-}
-function downResult(error) {
-	return {
-		status: "down",
-		error
-	};
-}
-const RETRY_BACKOFFS_MS = [500, 2e3];
-async function attemptFetch(url, timeoutMs, redirect) {
-	const controller = new AbortController();
-	const tid = setTimeout(() => controller.abort(), timeoutMs);
-	try {
-		const res = await fetch(url, {
-			signal: controller.signal,
-			redirect
-		});
-		clearTimeout(tid);
-		return {
-			kind: "response",
-			res
-		};
-	} catch (e) {
-		clearTimeout(tid);
-		const err = e instanceof Error ? e : /* @__PURE__ */ new Error("Unknown error");
-		return {
-			kind: "error",
-			error: err,
-			timedOut: err.name === "AbortError"
-		};
-	}
-}
-async function fetchEndpointHealth(url, timeoutMs = 5e3, isExpectedStatus = (s) => s === 200, redirect = "follow") {
-	let lastHttpStatus = null;
-	let lastError = "Unknown error";
-	let attempts = 0;
-	for (let i = 0; i <= RETRY_BACKOFFS_MS.length; i++) {
-		if (i > 0) {
-			const wait = RETRY_BACKOFFS_MS[i - 1];
-			logToFile(`[health-checks] retry ${i}/${RETRY_BACKOFFS_MS.length} for ${url} in ${wait}ms (last: ${lastError})`);
-			await new Promise((r) => setTimeout(r, wait));
-		}
-		attempts++;
-		const outcome = await attemptFetch(url, timeoutMs, redirect);
-		if (outcome.kind === "response") {
-			const res = outcome.res;
-			if (isExpectedStatus(res.status)) {
-				const result = {
-					status: "healthy",
-					rawIndicator: attempts > 1 ? `HTTP ${res.status} (attempts=${attempts})` : `HTTP ${res.status}`
-				};
-				logToFile(`[health-checks] GET ${url} -> ${result.status} (${result.rawIndicator})`);
-				return result;
-			}
-			lastHttpStatus = res.status;
-			lastError = `HTTP ${res.status}`;
-			continue;
-		}
-		lastError = outcome.timedOut ? `Request timed out after ${timeoutMs}ms` : outcome.error.message;
-	}
-	const result = lastHttpStatus !== null ? downResult(`HTTP ${lastHttpStatus} (attempts=${attempts})`) : noConnectionResult(lastError, attempts);
-	logToFile(`[health-checks] GET ${url} -> ${result.status} (attempts=${attempts}, ${result.error})`);
-	return result;
-}
-const checkLlmGatewayHealth = (gatewayUrl) => fetchEndpointHealth(new URL("/readyz", gatewayUrl).href);
-/**
-* Skills are published to two origins under the same filenames and
-* `fetchWithRetry` fails over between them, so the run is only blocked when
-* neither answers. Probed in parallel — sequential probes would double the
-* worst case past `READINESS_TIMEOUT_MS`.
-*/
-const checkSkillsOriginHealth = async () => {
-	const [github, aws] = await Promise.all([fetchEndpointHealth(`${GITHUB_SKILLS_BASE_URL}/skill-menu.json`), fetchEndpointHealth(`${AWS_SKILLS_BASE_URL}/skill-menu.json`)]);
-	return combineOriginHealth(github, aws);
-};
-/**
-* Mirrors `fetchWithRetry`: a download tries GitHub, then AWS, so the run is
-* only blocked when neither origin answers. Whichever failure the probes saw,
-* one origin serving means skills are reachable.
-*/
-function combineOriginHealth(github, aws) {
-	if (github.status === "healthy") return aws.status === "healthy" ? github : withIndicatorSuffix(github, "aws unavailable");
-	if (aws.status === "healthy") return withIndicatorSuffix(aws, "via aws, github unavailable");
-	const error = `github: ${github.error ?? "unknown"} | aws: ${aws.error ?? "unknown"}`;
-	return {
-		status: github.status === "down" || aws.status === "down" ? "down" : "no-connection",
-		error,
-		rawIndicator: github.rawIndicator ?? aws.rawIndicator
-	};
-}
-function withIndicatorSuffix(result, suffix) {
-	return {
-		...result,
-		rawIndicator: result.rawIndicator ? `${result.rawIndicator} (${suffix})` : suffix
-	};
-}
-//#endregion
-export { checkSkillsOriginHealth as n, checkLlmGatewayHealth as t };
-
-//# sourceMappingURL=endpoints-D-4KxZiB.js.map

package/dist/endpoints-D-4KxZiB.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"endpoints-D-4KxZiB.js","names":[],"sources":["../src/shared/health-checks/endpoints.ts"],"sourcesContent":["import { AWS_SKILLS_BASE_URL, GITHUB_SKILLS_BASE_URL } from '@shared/constants';\nimport { logToFile } from '@utils/debug';\nimport { ServiceHealthStatus, type BaseHealthResult } from './types';\n\n// Direct gateway and skill-origin checks distinguish HTTP failures from connection failures.\n\nfunction noConnectionResult(error: string, attempts: number): BaseHealthResult {\n  return {\n    status: ServiceHealthStatus.NoConnection,\n    error,\n    rawIndicator: attempts > 1 ? `attempts=${attempts}` : undefined,\n  };\n}\n\nfunction downResult(error: string): BaseHealthResult {\n  return { status: ServiceHealthStatus.Down, error };\n}\n\n// Backoffs sized to cover typical wifi flakiness — a single dropped\n// packet recovers via the 500ms retry; a wifi access point reconnect\n// or wifi↔LTE handoff (2-5s) is caught by the 2000ms retry. Tighter\n// schedules miss multi-second blips because all retries land in the\n// same dead window.\nconst RETRY_BACKOFFS_MS = [500, 2000];\n\nasync function attemptFetch(\n  url: string,\n  timeoutMs: number,\n  redirect: 'follow' | 'manual' | 'error',\n): Promise<\n  | { kind: 'response'; res: Response }\n  | { kind: 'error'; error: Error; timedOut: boolean }\n> {\n  const controller = new AbortController();\n  const tid = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    const res = await fetch(url, { signal: controller.signal, redirect });\n    clearTimeout(tid);\n    return { kind: 'response', res };\n  } catch (e) {\n    clearTimeout(tid);\n    const err = e instanceof Error ? e : new Error('Unknown error');\n    return { kind: 'error', error: err, timedOut: err.name === 'AbortError' };\n  }\n}\n\n// Exported so tests can pin the retry/taxonomy machinery directly.\nexport async function fetchEndpointHealth(\n  url: string,\n  timeoutMs = 5000,\n  isExpectedStatus: (status: number) => boolean = (s) => s === 200,\n  redirect: 'follow' | 'manual' | 'error' = 'follow',\n): Promise<BaseHealthResult> {\n  // Total attempts = 1 initial + RETRY_BACKOFFS_MS.length retries. Both\n  // unexpected HTTP statuses (4xx/5xx) and network errors trigger a retry:\n  // transient 5xx and Cloudflare edge blips often recover on a retry, and\n  // even nominally deterministic 4xx can be transient (CDN propagation\n  // lag after a release, token rotation, rate-limit window resets). GETs\n  // are idempotent so retrying is safe.\n  //\n  // Final status if every attempt fails:\n  //   - At least one HTTP response observed → `Down` (server-side evidence)\n  //   - Only network errors observed         → `NoConnection`\n  let lastHttpStatus: number | null = null;\n  let lastError = 'Unknown error';\n  let attempts = 0;\n\n  for (let i = 0; i <= RETRY_BACKOFFS_MS.length; i++) {\n    if (i > 0) {\n      const wait = RETRY_BACKOFFS_MS[i - 1];\n      logToFile(\n        `[health-checks] retry ${i}/${RETRY_BACKOFFS_MS.length} for ${url} in ${wait}ms (last: ${lastError})`,\n      );\n      await new Promise((r) => setTimeout(r, wait));\n    }\n    attempts++;\n\n    const outcome = await attemptFetch(url, timeoutMs, redirect);\n\n    if (outcome.kind === 'response') {\n      const res = outcome.res;\n      if (isExpectedStatus(res.status)) {\n        const result: BaseHealthResult = {\n          status: ServiceHealthStatus.Healthy,\n          rawIndicator:\n            attempts > 1\n              ? `HTTP ${res.status} (attempts=${attempts})`\n              : `HTTP ${res.status}`,\n        };\n        logToFile(\n          `[health-checks] GET ${url} -> ${result.status}` +\n            ` (${result.rawIndicator})`,\n        );\n        return result;\n      }\n      lastHttpStatus = res.status;\n      lastError = `HTTP ${res.status}`;\n      continue;\n    }\n\n    lastError = outcome.timedOut\n      ? `Request timed out after ${timeoutMs}ms`\n      : outcome.error.message;\n  }\n\n  const result =\n    lastHttpStatus !== null\n      ? downResult(`HTTP ${lastHttpStatus} (attempts=${attempts})`)\n      : noConnectionResult(lastError, attempts);\n  logToFile(\n    `[health-checks] GET ${url} -> ${result.status}` +\n      ` (attempts=${attempts}, ${result.error})`,\n  );\n  return result;\n}\n\nexport const checkLlmGatewayHealth = (\n  gatewayUrl: string,\n): Promise<BaseHealthResult> =>\n  fetchEndpointHealth(new URL('/readyz', gatewayUrl).href);\n\n/**\n * Skills are published to two origins under the same filenames and\n * `fetchWithRetry` fails over between them, so the run is only blocked when\n * neither answers. Probed in parallel — sequential probes would double the\n * worst case past `READINESS_TIMEOUT_MS`.\n */\nexport const checkSkillsOriginHealth = async (): Promise<BaseHealthResult> => {\n  const [github, aws] = await Promise.all([\n    fetchEndpointHealth(`${GITHUB_SKILLS_BASE_URL}/skill-menu.json`),\n    fetchEndpointHealth(`${AWS_SKILLS_BASE_URL}/skill-menu.json`),\n  ]);\n  return combineOriginHealth(github, aws);\n};\n\n/**\n * Mirrors `fetchWithRetry`: a download tries GitHub, then AWS, so the run is\n * only blocked when neither origin answers. Whichever failure the probes saw,\n * one origin serving means skills are reachable.\n */\nfunction combineOriginHealth(\n  github: BaseHealthResult,\n  aws: BaseHealthResult,\n): BaseHealthResult {\n  if (github.status === ServiceHealthStatus.Healthy) {\n    // Naming the dead origin makes a one-sided outage legible in the log and\n    // in the readiness reasons, where the status alone reads as \"fine\".\n    return aws.status === ServiceHealthStatus.Healthy\n      ? github\n      : withIndicatorSuffix(github, 'aws unavailable');\n  }\n\n  if (aws.status === ServiceHealthStatus.Healthy) {\n    return withIndicatorSuffix(aws, 'via aws, github unavailable');\n  }\n\n  const error = `github: ${github.error ?? 'unknown'} | aws: ${\n    aws.error ?? 'unknown'\n  }`;\n  const confirmedDown =\n    github.status === ServiceHealthStatus.Down ||\n    aws.status === ServiceHealthStatus.Down;\n  return {\n    status: confirmedDown\n      ? ServiceHealthStatus.Down\n      : ServiceHealthStatus.NoConnection,\n    error,\n    // Keeps the `attempts=N` the blocked-readiness analytics parses.\n    rawIndicator: github.rawIndicator ?? aws.rawIndicator,\n  };\n}\n\nfunction withIndicatorSuffix(\n  result: BaseHealthResult,\n  suffix: string,\n): BaseHealthResult {\n  return {\n    ...result,\n    rawIndicator: result.rawIndicator\n      ? `${result.rawIndicator} (${suffix})`\n      : suffix,\n  };\n}\n"],"mappings":";;;AAMA,SAAS,mBAAmB,OAAe,UAAoC;AAC7E,QAAO;EACL,QAAA;EACA;EACA,cAAc,WAAW,IAAI,YAAY,aAAa,KAAA;EACvD;;AAGH,SAAS,WAAW,OAAiC;AACnD,QAAO;EAAE,QAAA;EAAkC;EAAO;;AAQpD,MAAM,oBAAoB,CAAC,KAAK,IAAK;AAErC,eAAe,aACb,KACA,WACA,UAIA;CACA,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,MAAM,iBAAiB,WAAW,OAAO,EAAE,UAAU;AAC3D,KAAI;EACF,MAAM,MAAM,MAAM,MAAM,KAAK;GAAE,QAAQ,WAAW;GAAQ;GAAU,CAAC;AACrE,eAAa,IAAI;AACjB,SAAO;GAAE,MAAM;GAAY;GAAK;UACzB,GAAG;AACV,eAAa,IAAI;EACjB,MAAM,MAAM,aAAa,QAAQ,oBAAI,IAAI,MAAM,gBAAgB;AAC/D,SAAO;GAAE,MAAM;GAAS,OAAO;GAAK,UAAU,IAAI,SAAS;GAAc;;;AAK7E,eAAsB,oBACpB,KACA,YAAY,KACZ,oBAAiD,MAAM,MAAM,KAC7D,WAA0C,UACf;CAW3B,IAAI,iBAAgC;CACpC,IAAI,YAAY;CAChB,IAAI,WAAW;AAEf,MAAK,IAAI,IAAI,GAAG,KAAK,kBAAkB,QAAQ,KAAK;AAClD,MAAI,IAAI,GAAG;GACT,MAAM,OAAO,kBAAkB,IAAI;AACnC,aACE,yBAAyB,EAAE,GAAG,kBAAkB,OAAO,OAAO,IAAI,MAAM,KAAK,YAAY,UAAU,GACpG;AACD,SAAM,IAAI,SAAS,MAAM,WAAW,GAAG,KAAK,CAAC;;AAE/C;EAEA,MAAM,UAAU,MAAM,aAAa,KAAK,WAAW,SAAS;AAE5D,MAAI,QAAQ,SAAS,YAAY;GAC/B,MAAM,MAAM,QAAQ;AACpB,OAAI,iBAAiB,IAAI,OAAO,EAAE;IAChC,MAAM,SAA2B;KAC/B,QAAA;KACA,cACE,WAAW,IACP,QAAQ,IAAI,OAAO,aAAa,SAAS,KACzC,QAAQ,IAAI;KACnB;AACD,cACE,uBAAuB,IAAI,MAAM,OAAO,OAAA,IACjC,OAAO,aAAa,GAC5B;AACD,WAAO;;AAET,oBAAiB,IAAI;AACrB,eAAY,QAAQ,IAAI;AACxB;;AAGF,cAAY,QAAQ,WAChB,2BAA2B,UAAU,MACrC,QAAQ,MAAM;;CAGpB,MAAM,SACJ,mBAAmB,OACf,WAAW,QAAQ,eAAe,aAAa,SAAS,GAAG,GAC3D,mBAAmB,WAAW,SAAS;AAC7C,WACE,uBAAuB,IAAI,MAAM,OAAO,OAAA,aACxB,SAAS,IAAI,OAAO,MAAM,GAC3C;AACD,QAAO;;AAGT,MAAa,yBACX,eAEA,oBAAoB,IAAI,IAAI,WAAW,WAAW,CAAC,KAAK;;;;;;;AAQ1D,MAAa,0BAA0B,YAAuC;CAC5E,MAAM,CAAC,QAAQ,OAAO,MAAM,QAAQ,IAAI,CACtC,oBAAoB,GAAG,uBAAuB,kBAAkB,EAChE,oBAAoB,GAAG,oBAAoB,kBAAkB,CAC9D,CAAC;AACF,QAAO,oBAAoB,QAAQ,IAAI;;;;;;;AAQzC,SAAS,oBACP,QACA,KACkB;AAClB,KAAI,OAAO,WAAA,UAGT,QAAO,IAAI,WAAA,YACP,SACA,oBAAoB,QAAQ,kBAAkB;AAGpD,KAAI,IAAI,WAAA,UACN,QAAO,oBAAoB,KAAK,8BAA8B;CAGhE,MAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,UACjD,IAAI,SAAS;AAKf,QAAO;EACL,QAHA,OAAO,WAAA,UACP,IAAI,WAAA,SAAA,SAAA;EAKJ;EAEA,cAAc,OAAO,gBAAgB,IAAI;EAC1C;;AAGH,SAAS,oBACP,QACA,QACkB;AAClB,QAAO;EACL,GAAG;EACH,cAAc,OAAO,eACjB,GAAG,OAAO,aAAa,IAAI,OAAO,KAClC;EACL"}

package/dist/env-api-key-CHGLe0iz.js

@@ -1,2 +0,0 @@
-import { t as readApiKeyFromEnv } from "./env-api-key-COf0U-Au.js";
-export { readApiKeyFromEnv };

package/dist/env-api-key-COf0U-Au.js

@@ -1,17 +0,0 @@
-import { i as readProjectFile } from "./bounded-fs-CC_NDtoP.js";
-import * as path$1 from "path";
-//#region src/shared/utils/env-api-key.ts
-/**
-* Read POSTHOG_PERSONAL_API_KEY from .env.local or .env in the current
-* working directory. Returns undefined when no key is found.
-*/
-function readApiKeyFromEnv() {
-	for (const envFile of [".env.local", ".env"]) {
-		const match = readProjectFile(path$1.join(process.cwd(), envFile))?.match(/^POSTHOG_PERSONAL_API_KEY=(.+)$/m);
-		if (match) return match[1].trim();
-	}
-}
-//#endregion
-export { readApiKeyFromEnv as t };
-
-//# sourceMappingURL=env-api-key-COf0U-Au.js.map

package/dist/env-api-key-COf0U-Au.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env-api-key-COf0U-Au.js","names":["path"],"sources":["../src/shared/utils/env-api-key.ts"],"sourcesContent":["import * as path from 'path';\nimport { readProjectFile } from './bounded-fs';\n\n/**\n * Read POSTHOG_PERSONAL_API_KEY from .env.local or .env in the current\n * working directory. Returns undefined when no key is found.\n */\nexport function readApiKeyFromEnv(): string | undefined {\n  for (const envFile of ['.env.local', '.env']) {\n    // null when missing or unreadable, e.g. a `.env` directory (a Python virtualenv).\n    const content = readProjectFile(path.join(process.cwd(), envFile));\n    const match = content?.match(/^POSTHOG_PERSONAL_API_KEY=(.+)$/m);\n    if (match) return match[1].trim();\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;AAOA,SAAgB,oBAAwC;AACtD,MAAK,MAAM,WAAW,CAAC,cAAc,OAAO,EAAE;EAG5C,MAAM,QADU,gBAAgBA,OAAK,KAAK,QAAQ,KAAK,EAAE,QAAQ,CAAC,EAC3C,MAAM,mCAAmC;AAChE,MAAI,MAAO,QAAO,MAAM,GAAG,MAAM"}

package/dist/environment-DrLaSsA8.js

@@ -1,39 +0,0 @@
-import "./constants-DO4X70po.js";
-import "./bounded-fs-CC_NDtoP.js";
-import "./setup-utils-ChXXTi1m.js";
-import readEnvModule from "read-env";
-//#region src/shared/utils/environment.ts
-const readEnv = typeof readEnvModule === "function" ? readEnvModule : readEnvModule.default;
-function isNonInteractiveEnvironment() {
-	if (!process.stdout.isTTY || !process.stderr.isTTY) return true;
-	return false;
-}
-/**
-* Session fields the environment must never set, matched case-insensitively
-* against the camel-cased key `read-env` produces.
-*
-* `e2eAsk` re-wires the `wizard_ask` bridge in an otherwise non-interactive
-* run. Only the e2e TUI host may set it: a real `--ci` run has nobody to answer,
-* so every question would stall for the bridge timeout instead of failing fast
-* with an actionable error. See `shouldDisableAsk`.
-*/
-const NEVER_FROM_ENV = ["e2eAsk", "runId"];
-/**
-* Session args from the `POSTHOG_WIZARD_*` environment variables.
-*
-* `read-env` camel-cases every prefixed variable into a key, and the CI runner
-* spreads the whole bag into `buildSession` — so adding a field to the session
-* silently adds an environment variable that sets it. Most of them are meant to
-* work that way (`POSTHOG_WIZARD_DEBUG` → `debug`); the ones in
-* {@link NEVER_FROM_ENV} are not, and are dropped here rather than at the call
-* site, so a second caller cannot reopen the door.
-*/
-function readEnvironment() {
-	const result = readEnv("POSTHOG_WIZARD");
-	for (const key of Object.keys(result)) if (NEVER_FROM_ENV.some((k) => k.toLowerCase() === key.toLowerCase())) delete result[key];
-	return result;
-}
-//#endregion
-export { readEnvironment as n, isNonInteractiveEnvironment as t };
-
-//# sourceMappingURL=environment-DrLaSsA8.js.map

package/dist/environment-DrLaSsA8.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment-DrLaSsA8.js","names":[],"sources":["../src/shared/utils/environment.ts"],"sourcesContent":["import readEnvModule from 'read-env';\n\nconst readEnv =\n  typeof readEnvModule === 'function'\n    ? readEnvModule\n    : (readEnvModule as any).default;\nimport { tryGetPackageJson } from './setup-utils';\nimport type { WizardRunOptions } from './types';\nimport { boundedGlob } from './bounded-fs';\nimport { IS_DEV } from '@shared/constants';\n\nexport function isNonInteractiveEnvironment(): boolean {\n  if (IS_DEV) {\n    return false;\n  }\n\n  if (!process.stdout.isTTY || !process.stderr.isTTY) {\n    return true;\n  }\n\n  return false;\n}\n\n/**\n * Session fields the environment must never set, matched case-insensitively\n * against the camel-cased key `read-env` produces.\n *\n * `e2eAsk` re-wires the `wizard_ask` bridge in an otherwise non-interactive\n * run. Only the e2e TUI host may set it: a real `--ci` run has nobody to answer,\n * so every question would stall for the bridge timeout instead of failing fast\n * with an actionable error. See `shouldDisableAsk`.\n */\nconst NEVER_FROM_ENV = ['e2eAsk', 'runId'];\n\n/**\n * Session args from the `POSTHOG_WIZARD_*` environment variables.\n *\n * `read-env` camel-cases every prefixed variable into a key, and the CI runner\n * spreads the whole bag into `buildSession` — so adding a field to the session\n * silently adds an environment variable that sets it. Most of them are meant to\n * work that way (`POSTHOG_WIZARD_DEBUG` → `debug`); the ones in\n * {@link NEVER_FROM_ENV} are not, and are dropped here rather than at the call\n * site, so a second caller cannot reopen the door.\n */\nexport function readEnvironment(): Record<string, unknown> {\n  const result = readEnv('POSTHOG_WIZARD') as Record<string, unknown>;\n\n  for (const key of Object.keys(result)) {\n    if (NEVER_FROM_ENV.some((k) => k.toLowerCase() === key.toLowerCase())) {\n      delete result[key];\n    }\n  }\n\n  return result;\n}\n\nexport async function detectEnvVarPrefix(\n  options: WizardRunOptions,\n): Promise<string> {\n  const packageJson = await tryGetPackageJson(options);\n  if (!packageJson) return 'VITE_PUBLIC_';\n\n  const deps = { ...packageJson.dependencies, ...packageJson.devDependencies };\n  const has = (name: string) => name in deps;\n  // O(1) matches per probe: one config file existing anywhere answers it.\n  const hasAnyFile = async (patterns: string[]) => {\n    const matches = await boundedGlob(patterns, {\n      cwd: options.installDir,\n      limit: 1,\n    });\n    return matches.length > 0;\n  };\n\n  // --- Next.js\n  if (has('next') || (await hasAnyFile(['**/next.config.{js,ts,mjs,cjs}']))) {\n    return 'NEXT_PUBLIC_';\n  }\n\n  // --- Create React App\n  if (\n    has('react-scripts') ||\n    has('create-react-app') ||\n    (await hasAnyFile(['**/config-overrides.js']))\n  ) {\n    return 'REACT_APP_';\n  }\n\n  // --- Vite (vanilla, TanStack, Solid, etc.)\n  // Note: Vite does not need PUBLIC_ but we use it to follow the docs, to improve the chances of an LLM getting it right.\n  if (has('vite') || (await hasAnyFile(['**/vite.config.{js,ts,mjs,cjs}']))) {\n    return 'VITE_PUBLIC_';\n  }\n\n  // --- SvelteKit\n  if (\n    has('@sveltejs/kit') ||\n    (await hasAnyFile(['**/svelte.config.{js,ts}']))\n  ) {\n    return 'PUBLIC_';\n  }\n\n  // --- TanStack Start (uses Vite)\n  if (\n    has('@tanstack/start') ||\n    (await hasAnyFile(['**/tanstack.config.{js,ts}']))\n  ) {\n    return 'VITE_PUBLIC_';\n  }\n\n  // --- SolidStart (uses Vite)\n  if (has('solid-start') || (await hasAnyFile(['**/solid.config.{js,ts}']))) {\n    return 'VITE_PUBLIC_';\n  }\n\n  // --- Astro\n  if (has('astro') || (await hasAnyFile(['**/astro.config.{js,ts,mjs}']))) {\n    return 'PUBLIC_';\n  }\n\n  // We default to Vite if we can't detect a specific framework, since it's the most commonly used.\n  return 'VITE_PUBLIC_';\n}\n"],"mappings":";;;;;AAEA,MAAM,UACJ,OAAO,kBAAkB,aACrB,gBACC,cAAsB;AAM7B,SAAgB,8BAAuC;AAKrD,KAAI,CAAC,QAAQ,OAAO,SAAS,CAAC,QAAQ,OAAO,MAC3C,QAAO;AAGT,QAAO;;;;;;;;;;;AAYT,MAAM,iBAAiB,CAAC,UAAU,QAAQ;;;;;;;;;;;AAY1C,SAAgB,kBAA2C;CACzD,MAAM,SAAS,QAAQ,iBAAiB;AAExC,MAAK,MAAM,OAAO,OAAO,KAAK,OAAO,CACnC,KAAI,eAAe,MAAM,MAAM,EAAE,aAAa,KAAK,IAAI,aAAa,CAAC,CACnE,QAAO,OAAO;AAIlB,QAAO"}

package/dist/environment-hBj7ngmO.js

@@ -1,2 +0,0 @@
-import { n as readEnvironment } from "./environment-DrLaSsA8.js";
-export { readEnvironment };

package/dist/file-CVA9ocIC.js

@@ -1,60 +0,0 @@
-import { d as WIZARD_TASK_STREAM_FILE, s as logToFile } from "./debug-DyARf5TF.js";
-import { dirname, isAbsolute, resolve } from "node:path";
-import { appendFileSync, mkdirSync, writeFileSync } from "node:fs";
-//#region src/programs/session/task-stream/destinations/file.ts
-/**
-* Dumps every *attempted* sync to a local JSONL file, one line per push. A line
-* means the run published that payload, not that a backend accepted it — `--ci`
-* swaps the PostHog destination for this one, so a synthetic run never creates a
-* session row in a real project.
-*
-* Dev builds only: the payload holds the run's handoff report.
-*/
-var FileDestination = class {
-	name = "file";
-	path;
-	now;
-	disabled = false;
-	constructor(opts) {
-		this.path = opts.path;
-		this.now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-		this.write(() => writeFileSync(this.path, "", { mode: 384 }));
-	}
-	send(event, payload) {
-		if (!this.disabled) {
-			const line = `${JSON.stringify({
-				at: this.now(),
-				event,
-				payload
-			})}\n`;
-			this.write(() => appendFileSync(this.path, line, { mode: 384 }));
-		}
-		return Promise.resolve();
-	}
-	/** Never throws, never writes to stdio; the first failure ends the dump. */
-	write(op) {
-		try {
-			mkdirSync(dirname(this.path), { recursive: true });
-			op();
-		} catch (err) {
-			this.disabled = true;
-			logToFile(`[task-stream] file destination disabled (${err instanceof Error ? err.message : String(err)}): ${this.path}`);
-		}
-	}
-};
-/**
-* Resolve a `--task-stream-log` value, or null when the run did not ask for a
-* dump. `''` and `true` mean the default path — how `--ci` asks for one.
-*/
-function createFileDestination(value, opts = {}) {
-	if (opts.productionBuild ?? true) return null;
-	if (value === void 0 || value === null || value === false) return null;
-	const raw = typeof value === "string" ? value.trim() : "";
-	const path = raw === "" ? WIZARD_TASK_STREAM_FILE : isAbsolute(raw) ? raw : resolve(opts.cwd ?? process.cwd(), raw);
-	logToFile(`[task-stream] file destination enabled: ${path}`);
-	return new FileDestination({ path });
-}
-//#endregion
-export { createFileDestination as n, FileDestination as t };
-
-//# sourceMappingURL=file-CVA9ocIC.js.map

package/dist/file-CVA9ocIC.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-CVA9ocIC.js","names":[],"sources":["../src/programs/session/task-stream/destinations/file.ts"],"sourcesContent":["/**\n * Dumps every *attempted* sync to a local JSONL file, one line per push. A line\n * means the run published that payload, not that a backend accepted it — `--ci`\n * swaps the PostHog destination for this one, so a synthetic run never creates a\n * session row in a real project.\n *\n * Dev builds only: the payload holds the run's handoff report.\n */\n\nimport { appendFileSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { dirname, isAbsolute, resolve } from 'node:path';\nimport { IS_PRODUCTION_BUILD } from '@env';\nimport { WIZARD_TASK_STREAM_FILE } from '@utils/paths';\nimport { logToFile } from '@utils/debug';\nimport type {\n  StreamEvent,\n  TaskStreamDestination,\n  TaskStreamUpdate,\n} from '@programs/session/task-stream/types';\n\nexport interface FileDestinationOptions {\n  path: string;\n  /** Override for tests. */\n  now?: () => string;\n}\n\nexport class FileDestination implements TaskStreamDestination {\n  readonly name = 'file';\n  readonly path: string;\n\n  private readonly now: () => string;\n  private disabled = false;\n\n  constructor(opts: FileDestinationOptions) {\n    this.path = opts.path;\n    this.now = opts.now ?? (() => new Date().toISOString());\n    // Truncate up front: one run, one file.\n    this.write(() => writeFileSync(this.path, '', { mode: 0o600 }));\n  }\n\n  send(event: StreamEvent, payload: TaskStreamUpdate): Promise<void> {\n    if (!this.disabled) {\n      const line = `${JSON.stringify({ at: this.now(), event, payload })}\\n`;\n      this.write(() => appendFileSync(this.path, line, { mode: 0o600 }));\n    }\n    return Promise.resolve();\n  }\n\n  /** Never throws, never writes to stdio; the first failure ends the dump. */\n  private write(op: () => void): void {\n    try {\n      mkdirSync(dirname(this.path), { recursive: true });\n      op();\n    } catch (err) {\n      this.disabled = true;\n      logToFile(\n        `[task-stream] file destination disabled (${\n          err instanceof Error ? err.message : String(err)\n        }): ${this.path}`,\n      );\n    }\n  }\n}\n\n/**\n * Resolve a `--task-stream-log` value, or null when the run did not ask for a\n * dump. `''` and `true` mean the default path — how `--ci` asks for one.\n */\nexport function createFileDestination(\n  value: unknown,\n  opts: { productionBuild?: boolean; cwd?: string } = {},\n): FileDestination | null {\n  if (opts.productionBuild ?? IS_PRODUCTION_BUILD) return null;\n  if (value === undefined || value === null || value === false) return null;\n\n  const raw = typeof value === 'string' ? value.trim() : '';\n  const path =\n    raw === ''\n      ? WIZARD_TASK_STREAM_FILE\n      : isAbsolute(raw)\n      ? raw\n      : resolve(opts.cwd ?? process.cwd(), raw);\n\n  logToFile(`[task-stream] file destination enabled: ${path}`);\n  return new FileDestination({ path });\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAa,kBAAb,MAA8D;CAC5D,OAAgB;CAChB;CAEA;CACA,WAAmB;CAEnB,YAAY,MAA8B;AACxC,OAAK,OAAO,KAAK;AACjB,OAAK,MAAM,KAAK,+BAAc,IAAI,MAAM,EAAC,aAAa;AAEtD,OAAK,YAAY,cAAc,KAAK,MAAM,IAAI,EAAE,MAAM,KAAO,CAAC,CAAC;;CAGjE,KAAK,OAAoB,SAA0C;AACjE,MAAI,CAAC,KAAK,UAAU;GAClB,MAAM,OAAO,GAAG,KAAK,UAAU;IAAE,IAAI,KAAK,KAAK;IAAE;IAAO;IAAS,CAAC,CAAC;AACnE,QAAK,YAAY,eAAe,KAAK,MAAM,MAAM,EAAE,MAAM,KAAO,CAAC,CAAC;;AAEpE,SAAO,QAAQ,SAAS;;;CAI1B,MAAc,IAAsB;AAClC,MAAI;AACF,aAAU,QAAQ,KAAK,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAClD,OAAI;WACG,KAAK;AACZ,QAAK,WAAW;AAChB,aACE,4CACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CACjD,KAAK,KAAK,OACZ;;;;;;;;AASP,SAAgB,sBACd,OACA,OAAoD,EAAE,EAC9B;AACxB,KAAI,KAAK,mBAAA,KAAwC,QAAO;AACxD,KAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,MAAO,QAAO;CAErE,MAAM,MAAM,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG;CACvD,MAAM,OACJ,QAAQ,KACJ,0BACA,WAAW,IAAI,GACf,MACA,QAAQ,KAAK,OAAO,QAAQ,KAAK,EAAE,IAAI;AAE7C,WAAU,2CAA2C,OAAO;AAC5D,QAAO,IAAI,gBAAgB,EAAE,MAAM,CAAC"}

package/dist/file-CmoKK_Pp.js

@@ -1,2 +0,0 @@
-import { n as createFileDestination } from "./file-CVA9ocIC.js";
-export { createFileDestination };

package/dist/file-watcher-C3Su8vXm.js

@@ -1,123 +0,0 @@
-import { s as logToFile } from "./debug-DyARf5TF.js";
-import * as fs$1 from "fs";
-import { basename, dirname } from "node:path";
-//#region src/shared/utils/file-watcher.ts
-/**
-* JSON file watcher shared by runner and UI machinery.
-*
-* `fs.watch` alone is unreliable for atomic-rename writes, so the watcher
-* pairs it with a continuous mtime-polled re-read. The poll catches missed
-* events; the watch keeps latency low when it does fire.
-*/
-const DEFAULT_POLL_INTERVAL_MS = 5e3;
-const DEFAULT_ATTACH_RETRY_INTERVAL_MS = 1e3;
-const DEFAULT_WATCH_DEBOUNCE_MS = 25;
-/** Watch `path` for JSON updates and call `onUpdate(parsed)` whenever the
-* file's mtime changes and the contents are valid JSON. Caller must invoke
-* `handle.stop()` to release the watcher. */
-function startFileWatcher(path, onUpdate, options = {}) {
-	const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-	const attachRetryIntervalMs = options.attachRetryIntervalMs ?? DEFAULT_ATTACH_RETRY_INTERVAL_MS;
-	const watchDebounceMs = options.watchDebounceMs ?? DEFAULT_WATCH_DEBOUNCE_MS;
-	const watchers = [];
-	const intervals = [];
-	const targetDir = dirname(path);
-	const targetName = basename(path);
-	let lastMtimeMs = 0;
-	let ignoredInitialSignature = null;
-	let watchDebounceTimer = null;
-	let lastReadErrorSignature = null;
-	let stopped = false;
-	const signature = (stat) => `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
-	if (options.ignoreInitialFile) try {
-		const stat = fs$1.lstatSync(path);
-		if (stat.isFile() && !stat.isSymbolicLink()) ignoredInitialSignature = signature(stat);
-	} catch {}
-	const logReadError = (errorSignature, message) => {
-		if (lastReadErrorSignature === errorSignature) return;
-		lastReadErrorSignature = errorSignature;
-		logToFile(`[file-watcher] ${message}: ${path}`);
-	};
-	const read = (force = false) => {
-		let stat;
-		try {
-			stat = fs$1.lstatSync(path);
-		} catch {
-			return;
-		}
-		if (!stat.isFile() || stat.isSymbolicLink()) return;
-		const fileSignature = signature(stat);
-		try {
-			if (ignoredInitialSignature) {
-				if (fileSignature === ignoredInitialSignature) return;
-				ignoredInitialSignature = null;
-			}
-			if (options.maxFileSizeBytes !== void 0 && stat.size > options.maxFileSizeBytes) {
-				logReadError(`oversized:${fileSignature}`, `refusing oversized JSON file (${stat.size} bytes, limit ${options.maxFileSizeBytes} bytes)`);
-				return;
-			}
-			if (!force && stat.mtimeMs === lastMtimeMs) return;
-			lastMtimeMs = stat.mtimeMs;
-			const parsed = JSON.parse(fs$1.readFileSync(path, "utf-8"));
-			lastReadErrorSignature = null;
-			onUpdate(parsed);
-		} catch (error) {
-			logReadError(`invalid:${fileSignature}:${String(error)}`, `could not read valid JSON (${String(error)})`);
-		}
-	};
-	const scheduleRead = () => {
-		if (stopped) return;
-		if (watchDebounceTimer) clearTimeout(watchDebounceTimer);
-		watchDebounceTimer = setTimeout(() => {
-			watchDebounceTimer = null;
-			read(true);
-		}, watchDebounceMs);
-	};
-	const attachWatch = () => {
-		watchers.push(fs$1.watch(targetDir, (_eventType, filename) => {
-			if (filename == null || filename.toString() === targetName) scheduleRead();
-		}));
-	};
-	intervals.push(setInterval(() => read(), pollIntervalMs));
-	try {
-		attachWatch();
-		queueMicrotask(() => {
-			if (!stopped) read(true);
-		});
-	} catch {
-		const attachInterval = setInterval(() => {
-			try {
-				fs$1.accessSync(targetDir);
-				clearInterval(attachInterval);
-				const idx = intervals.indexOf(attachInterval);
-				if (idx >= 0) intervals.splice(idx, 1);
-				attachWatch();
-				read(true);
-			} catch {}
-		}, attachRetryIntervalMs);
-		intervals.push(attachInterval);
-	}
-	return {
-		refresh() {
-			if (stopped) return;
-			if (watchDebounceTimer) {
-				clearTimeout(watchDebounceTimer);
-				watchDebounceTimer = null;
-			}
-			read(true);
-		},
-		stop() {
-			stopped = true;
-			if (watchDebounceTimer) {
-				clearTimeout(watchDebounceTimer);
-				watchDebounceTimer = null;
-			}
-			for (const watcher of watchers) watcher.close();
-			for (const interval of intervals) clearInterval(interval);
-		}
-	};
-}
-//#endregion
-export { startFileWatcher as t };
-
-//# sourceMappingURL=file-watcher-C3Su8vXm.js.map

package/dist/file-watcher-C3Su8vXm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-watcher-C3Su8vXm.js","names":["fs"],"sources":["../src/shared/utils/file-watcher.ts"],"sourcesContent":["/**\n * JSON file watcher shared by runner and UI machinery.\n *\n * `fs.watch` alone is unreliable for atomic-rename writes, so the watcher\n * pairs it with a continuous mtime-polled re-read. The poll catches missed\n * events; the watch keeps latency low when it does fire.\n */\n\nimport * as fs from 'fs';\nimport { basename, dirname } from 'node:path';\nimport { logToFile } from '@utils/debug';\n\nconst DEFAULT_POLL_INTERVAL_MS = 5000;\nconst DEFAULT_ATTACH_RETRY_INTERVAL_MS = 1000;\nconst DEFAULT_WATCH_DEBOUNCE_MS = 25;\n\nexport interface FileWatcherHandle {\n  refresh(): void;\n  stop(): void;\n}\n\nexport interface FileWatcherOptions {\n  /** ms between mtime checks once the file exists. */\n  pollIntervalMs?: number;\n  /** ms between attach attempts while waiting for the file to appear. */\n  attachRetryIntervalMs?: number;\n  /** ms to coalesce duplicate filesystem events. */\n  watchDebounceMs?: number;\n  /** Ignore the file that exists when the watcher starts until it changes. */\n  ignoreInitialFile?: boolean;\n  /** Refuse to read files larger than this many bytes. */\n  maxFileSizeBytes?: number;\n}\n\n/** Watch `path` for JSON updates and call `onUpdate(parsed)` whenever the\n * file's mtime changes and the contents are valid JSON. Caller must invoke\n * `handle.stop()` to release the watcher. */\nexport function startFileWatcher(\n  path: string,\n  onUpdate: (parsed: unknown) => void,\n  options: FileWatcherOptions = {},\n): FileWatcherHandle {\n  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n  const attachRetryIntervalMs =\n    options.attachRetryIntervalMs ?? DEFAULT_ATTACH_RETRY_INTERVAL_MS;\n  const watchDebounceMs = options.watchDebounceMs ?? DEFAULT_WATCH_DEBOUNCE_MS;\n\n  const watchers: fs.FSWatcher[] = [];\n  const intervals: Array<ReturnType<typeof setInterval>> = [];\n  const targetDir = dirname(path);\n  const targetName = basename(path);\n  let lastMtimeMs = 0;\n  let ignoredInitialSignature: string | null = null;\n  let watchDebounceTimer: ReturnType<typeof setTimeout> | null = null;\n  let lastReadErrorSignature: string | null = null;\n  let stopped = false;\n\n  const signature = (stat: fs.Stats): string =>\n    `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;\n\n  if (options.ignoreInitialFile) {\n    try {\n      const stat = fs.lstatSync(path);\n      if (stat.isFile() && !stat.isSymbolicLink()) {\n        ignoredInitialSignature = signature(stat);\n      }\n    } catch {\n      // No initial file to ignore.\n    }\n  }\n\n  const logReadError = (errorSignature: string, message: string) => {\n    if (lastReadErrorSignature === errorSignature) return;\n    lastReadErrorSignature = errorSignature;\n    logToFile(`[file-watcher] ${message}: ${path}`);\n  };\n\n  const read = (force = false) => {\n    let stat: fs.Stats;\n    try {\n      stat = fs.lstatSync(path);\n    } catch {\n      return;\n    }\n\n    if (!stat.isFile() || stat.isSymbolicLink()) return;\n    const fileSignature = signature(stat);\n\n    try {\n      if (ignoredInitialSignature) {\n        if (fileSignature === ignoredInitialSignature) return;\n        ignoredInitialSignature = null;\n      }\n      if (\n        options.maxFileSizeBytes !== undefined &&\n        stat.size > options.maxFileSizeBytes\n      ) {\n        logReadError(\n          `oversized:${fileSignature}`,\n          `refusing oversized JSON file (${stat.size} bytes, limit ${options.maxFileSizeBytes} bytes)`,\n        );\n        return;\n      }\n      if (!force && stat.mtimeMs === lastMtimeMs) return;\n      lastMtimeMs = stat.mtimeMs;\n      const parsed: unknown = JSON.parse(fs.readFileSync(path, 'utf-8'));\n      lastReadErrorSignature = null;\n      onUpdate(parsed);\n    } catch (error) {\n      logReadError(\n        `invalid:${fileSignature}:${String(error)}`,\n        `could not read valid JSON (${String(error)})`,\n      );\n    }\n  };\n\n  const scheduleRead = () => {\n    if (stopped) return;\n    if (watchDebounceTimer) clearTimeout(watchDebounceTimer);\n    watchDebounceTimer = setTimeout(() => {\n      watchDebounceTimer = null;\n      read(true);\n    }, watchDebounceMs);\n  };\n\n  const attachWatch = () => {\n    watchers.push(\n      fs.watch(targetDir, (_eventType, filename) => {\n        if (filename == null || filename.toString() === targetName) {\n          scheduleRead();\n        }\n      }),\n    );\n  };\n\n  intervals.push(setInterval(() => read(), pollIntervalMs));\n\n  try {\n    attachWatch();\n    // Defer the initial callback until the caller has received the handle, so\n    // callbacks that stop their watcher cannot race handle assignment.\n    queueMicrotask(() => {\n      if (!stopped) read(true);\n    });\n  } catch {\n    // Parent directory does not exist yet. Polling still covers a later file;\n    // retry attaching the low-latency directory watcher until it appears.\n    const attachInterval = setInterval(() => {\n      try {\n        fs.accessSync(targetDir);\n        clearInterval(attachInterval);\n        const idx = intervals.indexOf(attachInterval);\n        if (idx >= 0) intervals.splice(idx, 1);\n        attachWatch();\n        read(true);\n      } catch {\n        // Still waiting.\n      }\n    }, attachRetryIntervalMs);\n    intervals.push(attachInterval);\n  }\n\n  return {\n    refresh() {\n      if (stopped) return;\n      if (watchDebounceTimer) {\n        clearTimeout(watchDebounceTimer);\n        watchDebounceTimer = null;\n      }\n      read(true);\n    },\n    stop() {\n      stopped = true;\n      if (watchDebounceTimer) {\n        clearTimeout(watchDebounceTimer);\n        watchDebounceTimer = null;\n      }\n      for (const watcher of watchers) watcher.close();\n      for (const interval of intervals) clearInterval(interval);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,2BAA2B;AACjC,MAAM,mCAAmC;AACzC,MAAM,4BAA4B;;;;AAuBlC,SAAgB,iBACd,MACA,UACA,UAA8B,EAAE,EACb;CACnB,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,wBACJ,QAAQ,yBAAyB;CACnC,MAAM,kBAAkB,QAAQ,mBAAmB;CAEnD,MAAM,WAA2B,EAAE;CACnC,MAAM,YAAmD,EAAE;CAC3D,MAAM,YAAY,QAAQ,KAAK;CAC/B,MAAM,aAAa,SAAS,KAAK;CACjC,IAAI,cAAc;CAClB,IAAI,0BAAyC;CAC7C,IAAI,qBAA2D;CAC/D,IAAI,yBAAwC;CAC5C,IAAI,UAAU;CAEd,MAAM,aAAa,SACjB,GAAG,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,KAAK,KAAK,GAAG,KAAK,QAAQ,GAAG,KAAK;AAE/D,KAAI,QAAQ,kBACV,KAAI;EACF,MAAM,OAAOA,KAAG,UAAU,KAAK;AAC/B,MAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,gBAAgB,CACzC,2BAA0B,UAAU,KAAK;SAErC;CAKV,MAAM,gBAAgB,gBAAwB,YAAoB;AAChE,MAAI,2BAA2B,eAAgB;AAC/C,2BAAyB;AACzB,YAAU,kBAAkB,QAAQ,IAAI,OAAO;;CAGjD,MAAM,QAAQ,QAAQ,UAAU;EAC9B,IAAI;AACJ,MAAI;AACF,UAAOA,KAAG,UAAU,KAAK;UACnB;AACN;;AAGF,MAAI,CAAC,KAAK,QAAQ,IAAI,KAAK,gBAAgB,CAAE;EAC7C,MAAM,gBAAgB,UAAU,KAAK;AAErC,MAAI;AACF,OAAI,yBAAyB;AAC3B,QAAI,kBAAkB,wBAAyB;AAC/C,8BAA0B;;AAE5B,OACE,QAAQ,qBAAqB,KAAA,KAC7B,KAAK,OAAO,QAAQ,kBACpB;AACA,iBACE,aAAa,iBACb,iCAAiC,KAAK,KAAK,gBAAgB,QAAQ,iBAAiB,SACrF;AACD;;AAEF,OAAI,CAAC,SAAS,KAAK,YAAY,YAAa;AAC5C,iBAAc,KAAK;GACnB,MAAM,SAAkB,KAAK,MAAMA,KAAG,aAAa,MAAM,QAAQ,CAAC;AAClE,4BAAyB;AACzB,YAAS,OAAO;WACT,OAAO;AACd,gBACE,WAAW,cAAc,GAAG,OAAO,MAAM,IACzC,8BAA8B,OAAO,MAAM,CAAC,GAC7C;;;CAIL,MAAM,qBAAqB;AACzB,MAAI,QAAS;AACb,MAAI,mBAAoB,cAAa,mBAAmB;AACxD,uBAAqB,iBAAiB;AACpC,wBAAqB;AACrB,QAAK,KAAK;KACT,gBAAgB;;CAGrB,MAAM,oBAAoB;AACxB,WAAS,KACPA,KAAG,MAAM,YAAY,YAAY,aAAa;AAC5C,OAAI,YAAY,QAAQ,SAAS,UAAU,KAAK,WAC9C,eAAc;IAEhB,CACH;;AAGH,WAAU,KAAK,kBAAkB,MAAM,EAAE,eAAe,CAAC;AAEzD,KAAI;AACF,eAAa;AAGb,uBAAqB;AACnB,OAAI,CAAC,QAAS,MAAK,KAAK;IACxB;SACI;EAGN,MAAM,iBAAiB,kBAAkB;AACvC,OAAI;AACF,SAAG,WAAW,UAAU;AACxB,kBAAc,eAAe;IAC7B,MAAM,MAAM,UAAU,QAAQ,eAAe;AAC7C,QAAI,OAAO,EAAG,WAAU,OAAO,KAAK,EAAE;AACtC,iBAAa;AACb,SAAK,KAAK;WACJ;KAGP,sBAAsB;AACzB,YAAU,KAAK,eAAe;;AAGhC,QAAO;EACL,UAAU;AACR,OAAI,QAAS;AACb,OAAI,oBAAoB;AACtB,iBAAa,mBAAmB;AAChC,yBAAqB;;AAEvB,QAAK,KAAK;;EAEZ,OAAO;AACL,aAAU;AACV,OAAI,oBAAoB;AACtB,iBAAa,mBAAmB;AAChC,yBAAqB;;AAEvB,QAAK,MAAM,WAAW,SAAU,SAAQ,OAAO;AAC/C,QAAK,MAAM,YAAY,UAAW,eAAc,SAAS;;EAE5D"}

package/dist/gateway-BmjYUSua.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gateway-BmjYUSua.js","names":[],"sources":["../src/agent/gateway-session.ts","../src/agent/signals.ts","../src/agent/runner/harness/pi/gateway.ts"],"sourcesContent":["/**\n * Gateway auth for a wizard run: a `phe_` scoped token the backend mints, with\n * pinned attribution, a spend cap and an expiry.\n *\n * Every mint failure throws: a silent downgrade would spend uncapped,\n * unattributed money to hide an outage.\n */\n\nimport { readFileSync } from 'node:fs';\nimport { logToFile } from '@utils/debug';\nimport { analytics } from '@utils/analytics';\nimport { ErrorCodes, WizardError } from '@shared/errors';\nimport type { HostResolution } from '@shared/host-resolution';\nimport { oauthLoginKey } from '@shared/oauth-session';\nimport { checkLlmGatewayHealth } from '@shared/health-checks/endpoints';\nimport { ServiceHealthStatus } from '@shared/health-checks/types';\nimport { IS_PRODUCTION_BUILD, runtimeEnv } from '@env';\nimport type { CloudRegion } from '@utils/types';\n\nexport interface GatewayAuth {\n  /** Base URL for model calls (no `/v1`; transports append their route). */\n  gatewayUrl: string;\n  /** Gateway bearer, minted normally or supplied directly by CI. */\n  token: string;\n  /** Team verified by the mint, or explicitly supplied for CI attribution. */\n  teamId?: number;\n  /**\n   * Instant past which a 401 on this bearer is age rather than a bad\n   * credential: the cache re-mints past it, and a session still holding the\n   * old bearer may re-mint once. Before it the mint has to be trusted.\n   */\n  refreshAtMs: number;\n}\n\ninterface CachedAuth {\n  key: string;\n  auth: GatewayAuth;\n  /** Re-resolve once past this instant. */\n  staleAtMs: number;\n}\n\nlet cached: CachedAuth | null = null;\n/**\n * Shared so concurrent callers mint once. The orchestrator starts every runnable\n * task at once, and each would otherwise take its own token and its own cap.\n */\nlet inFlight: { key: string; promise: Promise<GatewayAuth> } | null = null;\nlet ciAuth: GatewayAuth | null = null;\n\n// Snapshot CI supplies a gateway bearer without minting or re-minting.\nexport function configureGatewayCredentialsForCI(\n  token: string,\n  projectId: number,\n  gatewayUrl: string,\n): void {\n  if (IS_PRODUCTION_BUILD)\n    throw new Error('CI gateway auth requires a non-production build');\n  if (!token.trim() || !Number.isSafeInteger(projectId) || projectId <= 0) {\n    throw new Error('CI gateway auth requires a token and valid project ID');\n  }\n  if (\n    !/^https?:\\/\\//.test(gatewayUrl) ||\n    !isTrustedGatewayUrl(gatewayUrl, '')\n  ) {\n    throw new Error('CI gateway auth requires a trusted gateway origin');\n  }\n  resetGatewaySession();\n  ciAuth = {\n    token: token.trim(),\n    teamId: projectId,\n    gatewayUrl: gatewayUrl.replace(/\\/+$/, ''),\n    refreshAtMs: Infinity,\n  };\n}\n\n// TODO: CI credential loading belongs outside the agent. It leaves with the rest\n// of this module once RunInput carries resolved inference auth, later in the\n// refactor.\nexport function configureGatewayFromCIEnvironment(\n  projectId: number,\n  region: CloudRegion,\n): void {\n  if (IS_PRODUCTION_BUILD)\n    throw new Error('CI gateway auth requires a non-production build');\n  const path = runtimeEnv('WIZARD_CI_GATEWAY_TOKEN_FILE');\n  if (!path) throw new Error('WIZARD_CI_GATEWAY_TOKEN_FILE is required for CI');\n  const token = readFileSync(path, 'utf8');\n  delete process.env.WIZARD_CI_GATEWAY_TOKEN_FILE;\n  configureGatewayCredentialsForCI(\n    token,\n    projectId,\n    runtimeEnv('WIZARD_CI_GATEWAY_URL') ||\n      `https://ai-gateway.${region}.posthog.com`,\n  );\n}\n\n/**\n * Adoption floor. The anthropic subprocess holds its credential until a 401\n * forces a re-mint, so a token below this would churn mints.\n */\nconst MIN_USABLE_TTL_MS = 2 * 60 * 1000;\n/** Re-resolve at this fraction of the token's life, leaving a usable remainder. */\nconst REFRESH_AT_FRACTION = 0.8;\n// Exceeds the backend's own 10s gateway timeout: a slow mint that lands after the\n// CLI hangs up spends a daily mint and orphans a live token.\nconst MINT_TIMEOUT_MS = 20_000;\n/** Longer than any refusal the mint writes; a body past this is not a message. */\nconst MAX_REFUSAL_DETAIL_LENGTH = 500;\n/** Outcomes are short snake_case labels; anything longer is not one. */\nconst MAX_REFUSAL_OUTCOME_LENGTH = 64;\n\n/** Resolve this run's gateway auth, minting and re-minting near expiry. */\nexport async function gatewayAuth(\n  host: HostResolution,\n  accessToken: string,\n  program: string | undefined,\n): Promise<GatewayAuth> {\n  if (ciAuth) return ciAuth;\n  // Keyed by program: a token pins `wizard:<program>`, so reusing one across\n  // programs bills the wrong budget. Keyed by login rather than OAuth token:\n  // the token rotates mid-run, and each new one would spend a weekly mint.\n  const key = `${host.apiHost}\\n${oauthLoginKey(accessToken)}\\n${\n    program ?? ''\n  }`;\n  if (cached && cached.key === key && Date.now() < cached.staleAtMs) {\n    return cached.auth;\n  }\n  if (inFlight && inFlight.key === key) return inFlight.promise;\n  const promise = resolveGatewayAuth(host, accessToken, key, program);\n  inFlight = { key, promise };\n  try {\n    return await promise;\n  } finally {\n    if (inFlight?.promise === promise) inFlight = null;\n  }\n}\n\nasync function resolveGatewayAuth(\n  host: HostResolution,\n  accessToken: string,\n  key: string,\n  program: string | undefined,\n): Promise<GatewayAuth> {\n  if (!program) {\n    // Every run has one; absent means a caller was not wired, and the spend would\n    // be unattributable.\n    logToFile('[gateway] run has no program id; failing the run');\n    throw new GatewayMintFailed(\n      'this run has no program to attribute its spend to',\n    );\n  }\n  const minted = await mintGatewayToken(host, accessToken, program);\n  const health = await checkLlmGatewayHealth(minted.gatewayUrl);\n  if (health.status !== ServiceHealthStatus.Healthy) {\n    throw new WizardError(\n      'The PostHog AI gateway is unavailable. Please try again later.',\n      undefined,\n      ErrorCodes.EnvServiceOutage,\n    );\n  }\n  const expiresAtMs = Date.parse(minted.expiresAt);\n  const ttlMs = expiresAtMs - Date.now();\n  if (!Number.isFinite(expiresAtMs) || ttlMs < MIN_USABLE_TTL_MS) {\n    // Expired, unreadable, or too short to serve a session. Adopting it would\n    // 401 mid-run, and downgrading would spend the rest of the run uncapped.\n    logToFile(\n      `[gateway] mint returned a token with ${ttlMs}ms of life; failing the run`,\n    );\n    throw new GatewayMintFailed(\n      `the PostHog gateway issued a token with ${ttlMs}ms of life`,\n    );\n  }\n  const staleAtMs = Date.now() + ttlMs * REFRESH_AT_FRACTION;\n  // Only failures are logged otherwise, so a successful run leaves no\n  // local trace. Never log the token itself.\n  logToFile(\n    `[gateway] minted a scoped token: program=${program} team=${\n      minted.teamId ?? 'unknown'\n    } ttl=${Math.round(ttlMs / 1000)}s url=${minted.gatewayUrl}`,\n  );\n  const auth: GatewayAuth = {\n    gatewayUrl: minted.gatewayUrl,\n    token: minted.token,\n    teamId: minted.teamId,\n    refreshAtMs: staleAtMs,\n  };\n  cached = { key, auth, staleAtMs };\n  return auth;\n}\n\n/** Test hook: drop the cached auth so the next call re-resolves. */\nexport function resetGatewaySession(): void {\n  cached = null;\n  inFlight = null;\n  ciAuth = null;\n}\n\n/** Whether a 401 on this bearer may be age (past its refresh instant) rather than a bad credential. */\nexport function isPastRefresh(auth: GatewayAuth, now = Date.now()): boolean {\n  return now >= auth.refreshAtMs;\n}\n\n/**\n * Whether a server-supplied origin may receive a bearer and prompt content:\n * https (loopback excepted), and either a current cloud gateway or the host the run\n * authenticated against.\n */\nexport function isTrustedGatewayUrl(value: string, apiHost: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  // Consumers append routes to this value, so anything beyond an origin\n  // (path, query, fragment, userinfo) would build a malformed endpoint.\n  if (\n    url.pathname !== '/' ||\n    url.search ||\n    url.hash ||\n    url.username ||\n    url.password\n  ) {\n    return false;\n  }\n  const localhost =\n    url.hostname === 'localhost' ||\n    url.hostname === '127.0.0.1' ||\n    url.hostname === 'host.docker.internal';\n  // Loopback is the dev gateway, and is the one case allowed over http.\n  if (localhost) return true;\n  if (url.protocol !== 'https:') return false;\n  if (url.hostname.endsWith('.posthog.com')) {\n    return (\n      url.origin === 'https://ai-gateway.us.posthog.com' ||\n      url.origin === 'https://ai-gateway.eu.posthog.com'\n    );\n  }\n  try {\n    return url.hostname === new URL(apiHost).hostname;\n  } catch {\n    return false;\n  }\n}\n\ninterface MintedToken {\n  token: string;\n  expiresAt: string;\n  gatewayUrl: string;\n  teamId?: number;\n}\n\n/**\n * A deliberate refusal from the mint endpoint, as opposed to the mint being\n * unavailable. Thrown so the run stops instead of proceeding without the\n * controls the refusal was enforcing. A WizardError, so the runners print its\n * message as-is and `wizardAbort` resolves its code.\n */\nexport class GatewayMintRefused extends WizardError {\n  readonly status: number;\n  /** The backend's refusal outcome (`blocked`, `throttled`, ...), when it sent one. */\n  readonly outcome?: string;\n\n  constructor(status: number, message: string, outcome?: string) {\n    super(message, { status, outcome }, ErrorCodes.GatewayMintRefused);\n    this.name = 'GatewayMintRefused';\n    this.status = status;\n    this.outcome = outcome;\n  }\n}\n\n/**\n * The mint could not produce a usable credential: unreachable, a 5xx, or a\n * response the client cannot use.\n */\nexport class GatewayMintFailed extends WizardError {\n  constructor(message: string) {\n    super(message, undefined, ErrorCodes.GatewayMintFailed);\n    this.name = 'GatewayMintFailed';\n  }\n}\n\n/**\n * Whether a mint status means \"refused this run\" rather than \"not available\".\n * 429 the daily run limit, 403 revoked project access, 400 a login covering\n * more than one project, 401 a credential the mint does not accept, 404 an\n * instance without the mint endpoint.\n */\nfunction isMintRefusal(status: number): boolean {\n  return (\n    status === 400 ||\n    status === 401 ||\n    status === 403 ||\n    status === 404 ||\n    status === 429\n  );\n}\n\ninterface MintRefusal {\n  detail?: string;\n  outcome?: string;\n}\n\n/**\n * The server's own reason for a refusal, when it sent one. DRF answers every\n * refusal as `{\"detail\": \"...\", \"code\": \"<outcome>\"}`; the blocklist's detail\n * names the contact address, which the fixed messages below cannot. `code` is\n * the backend's own label for the refusal (`outcome` on older backends) and\n * rides the client event.\n */\nfunction cleanRefusalText(value: unknown): string {\n  if (typeof value !== 'string') return '';\n  // Not because the server sends escapes, but because this string is printed\n  // straight to a terminal: sanitizing at the boundary means no later message\n  // can move the cursor or repaint the screen.\n  // eslint-disable-next-line no-control-regex\n  return value.replace(/[\\u0000-\\u001f\\u007f-\\u009f]/g, ' ').trim();\n}\n\nasync function readRefusal(resp: Response): Promise<MintRefusal> {\n  try {\n    const body = (await resp.json()) as {\n      detail?: unknown;\n      code?: unknown;\n      outcome?: unknown;\n    };\n    const detail = cleanRefusalText(body?.detail);\n    // The DRF handler flattens a dict detail, so the outcome rides as `code`.\n    // A `code` that cleans to nothing does not shadow a usable `outcome`.\n    const outcome =\n      cleanRefusalText(body?.code) || cleanRefusalText(body?.outcome);\n    return {\n      detail:\n        detail.length > 0 && detail.length <= MAX_REFUSAL_DETAIL_LENGTH\n          ? detail\n          : undefined,\n      outcome:\n        outcome.length > 0 && outcome.length <= MAX_REFUSAL_OUTCOME_LENGTH\n          ? outcome\n          : undefined,\n    };\n  } catch {\n    return {};\n  }\n}\n\nfunction mintRefusalMessage(status: number, detail?: string): string {\n  if (detail) return detail;\n  switch (status) {\n    case 429:\n      return 'This wizard program has used its daily run limit. Try again tomorrow.';\n    case 403:\n      return 'Your access to this project has changed. Re-authenticate and try again.';\n    case 400:\n      // The only 400 the mint answers is the exactly-one-project check.\n      return 'Your PostHog login must cover exactly one project. Re-authenticate and try again.';\n    case 401:\n      return 'PostHog did not accept this login. Re-authenticate with `npx @posthog/wizard@latest`.';\n    case 404:\n      return 'This PostHog instance does not issue gateway tokens. Upgrade with `npx @posthog/wizard@latest` and try again.';\n    default:\n      return 'The PostHog gateway refused this run.';\n  }\n}\n\nasync function mintGatewayToken(\n  host: HostResolution,\n  accessToken: string,\n  program: string,\n): Promise<MintedToken> {\n  try {\n    const resp = await fetch(`${host.apiHost}/api/wizard/gateway_token/`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'Content-Type': 'application/json',\n      },\n      // The flag tells the server this build reads a refusal, so it may answer\n      // with the reason. A build that omits it gets a 404, which is its signal\n      // to fall back to the legacy gateway.\n      body: JSON.stringify({ program, reads_refusal_reason: true }),\n      signal: AbortSignal.timeout(MINT_TIMEOUT_MS),\n    });\n    if (!resp.ok) {\n      if (isMintRefusal(resp.status)) {\n        const refusal = await readRefusal(resp);\n        logToFile(\n          `[gateway] mint refused with HTTP ${resp.status} (${\n            refusal.outcome ?? 'no outcome'\n          }); failing the run`,\n        );\n        // The terminal denial event for this run. The backend's own event has\n        // no run id, so this is what joins a refusal to the session.\n        analytics.wizardCapture('gateway mint refused', {\n          status: resp.status,\n          outcome: refusal.outcome,\n          program,\n        });\n        throw new GatewayMintRefused(\n          resp.status,\n          mintRefusalMessage(resp.status, refusal.detail),\n          refusal.outcome,\n        );\n      }\n      logToFile(\n        `[gateway] mint failed with HTTP ${resp.status}; failing the run`,\n      );\n      throw new GatewayMintFailed(\n        `the PostHog gateway could not issue a token (HTTP ${resp.status})`,\n      );\n    }\n    const body = (await resp.json()) as {\n      token?: string;\n      expires_at?: string;\n      gateway_url?: string;\n      team_id?: number;\n    };\n    // Checked one at a time, not in a loop, so each clause narrows the optional\n    // field for the return below and each names itself in the failure.\n    if (!body.token) {\n      logToFile('[gateway] mint response omitted token; failing the run');\n      throw new GatewayMintFailed('mint response omitted token');\n    }\n    if (!body.expires_at) {\n      logToFile('[gateway] mint response omitted expires_at; failing the run');\n      throw new GatewayMintFailed('mint response omitted expires_at');\n    }\n    if (!body.gateway_url) {\n      logToFile('[gateway] mint response omitted gateway_url; failing the run');\n      throw new GatewayMintFailed('mint response omitted gateway_url');\n    }\n    if (!isTrustedGatewayUrl(body.gateway_url, host.apiHost)) {\n      logToFile(\n        '[gateway] mint returned an untrusted gateway url; failing the run',\n      );\n      throw new GatewayMintFailed('mint returned an untrusted gateway url');\n    }\n    const gatewayUrl = new URL(body.gateway_url);\n    if (\n      ['localhost', '127.0.0.1'].includes(new URL(host.apiHost).hostname) &&\n      gatewayUrl.hostname === 'host.docker.internal'\n    ) {\n      gatewayUrl.hostname = 'localhost';\n    }\n    return {\n      token: body.token,\n      expiresAt: body.expires_at,\n      gatewayUrl: gatewayUrl.origin,\n      teamId: body.team_id,\n    };\n  } catch (e) {\n    // Decisions and failures both pass through: this catch exists for transport\n    // errors, and folding the others into it would lose the reason.\n    if (e instanceof GatewayMintRefused || e instanceof GatewayMintFailed)\n      throw e;\n    logToFile(\n      `[gateway] mint transport failure (${String(e)}); failing the run`,\n    );\n    throw new GatewayMintFailed(\n      `could not reach the PostHog gateway (${String(e)})`,\n    );\n  }\n}\n\n/**\n * The v2 run-metadata carrier: one JSON blob for the `X-PostHog-Properties`\n * header. Plain keys only, since the gateway strips `$`-prefixed keys as reserved,\n * so feature-flag variants land as `wizard_flag_<key>` instead of the legacy\n * `$feature/<key>` (dashboards keying on `$feature/wizard-*` read the new key\n * post-cutover).\n */\nexport function buildWizardPropertiesBlob(\n  wizardMetadata: Record<string, string>,\n  wizardFlags: Record<string, string>,\n  teamId?: number,\n): string {\n  // The gateway pins `$ai_product` to `wizard:<program>`, and rejects a legacy\n  // product override on a scoped token, so the unprefixed key every cost and\n  // error consumer reads is only present if this blob declares it.\n  const props: Record<string, string | number> = { ai_product: 'wizard' };\n  if (teamId !== undefined) props.team_id = teamId;\n  for (const [key, value] of Object.entries(wizardMetadata)) {\n    props[stripPropertyPrefix(key)] = value;\n  }\n  for (const [flagKey, variant] of Object.entries(wizardFlags)) {\n    if (!flagKey.toLowerCase().startsWith('wizard')) continue;\n    props[`wizard_flag_${flagKey.toLowerCase()}`] = variant;\n  }\n  return JSON.stringify(props);\n}\n\nconst LEGACY_PROPERTY_PREFIX = 'X-POSTHOG-PROPERTY-';\n\nfunction stripPropertyPrefix(key: string): string {\n  return key.toUpperCase().startsWith(LEGACY_PROPERTY_PREFIX)\n    ? key.slice(LEGACY_PROPERTY_PREFIX.length).toLowerCase()\n    : key;\n}\n","/**\n * Agent signal vocabulary — the marker strings the agent emits and the error\n * taxonomy the runner returns. Kept as a dependency-free leaf module so both\n * `agent-interface.ts` and `output-signals.ts` can import it without a cycle.\n */\n\nexport const AgentSignals = {\n  /** Signal emitted when the agent reports progress to the user */\n  STATUS: '[STATUS]',\n  /** Signal emitted when the agent cannot access the PostHog MCP server */\n  ERROR_MCP_MISSING: '[ERROR-MCP-MISSING]',\n  /** Signal emitted when the agent cannot access the setup resource */\n  ERROR_RESOURCE_MISSING: '[ERROR-RESOURCE-MISSING]',\n  /**\n   * Signal emitted when `install_skill` failed and the agent is continuing\n   * the integration WITHOUT the skill (best-effort from its own knowledge).\n   * Format: \"[SKILL-INSTALL-FAILED] <skill id — reason>\". Non-fatal by\n   * design: a freestyled integration beats an outright failure, but the run\n   * must be measurable — the runner captures it as an analytics event.\n   */\n  SKILL_INSTALL_FAILED: '[SKILL-INSTALL-FAILED]',\n  /**\n   * Signal emitted when the agent cannot complete the program and is\n   * aborting intentionally (distinct from errors). Format: \"[ABORT] <reason>\".\n   * Programs can declare an onAbort handler to render a custom screen.\n   */\n  ABORT: '[ABORT]',\n  /** Signal emitted when the agent provides a remark about its run */\n  WIZARD_REMARK: '[WIZARD-REMARK]',\n  /** Signal prefix for benchmark logging */\n  BENCHMARK: '[BENCHMARK]',\n  /**\n   * Signal emitted when the agent has created a PostHog dashboard for the\n   * user. Format: `[DASHBOARD_URL] <full https url>`. The URL is captured\n   * onto `session.dashboardUrl` and surfaced by programs in their outro.\n   */\n  DASHBOARD_URL: '[DASHBOARD_URL]',\n  /**\n   * Signal emitted when the agent has uploaded a report to a PostHog\n   * notebook. Format: `[NOTEBOOK_URL] <full https url>`. The URL is captured\n   * onto `session.notebookUrl` and surfaced by programs in their outro.\n   */\n  NOTEBOOK_URL: '[NOTEBOOK_URL]',\n} as const;\n\nexport type AgentSignal = (typeof AgentSignals)[keyof typeof AgentSignals];\n\n/**\n * End-of-run reflection ask, shared by both harnesses so remarks are\n * comparable. The format clause comes FIRST and nothing trails the marker —\n * literal models (gpt-5-mini) echo whatever text follows it. The parser also\n * drops remarks that quote this instruction (see AgentOutputSignals.remark).\n */\nexport const REMARK_INSTRUCTION = `Reply with a single line that starts with ${AgentSignals.WIZARD_REMARK} and no other lines. In that line, state briefly what information or guidance would have been useful to have in the integration prompt or documentation for this run — specifically anything that would have prevented tool failures, erroneous edits, or other wasted turns.`;\n\n/**\n * First prompt of a session resumed after a mid-run re-mint. The transcript\n * carries the work so far; the model only needs to pick it up.\n */\nexport const RESUME_INSTRUCTION =\n  'Your previous request failed with a transient gateway authentication error that has since been fixed. Continue the task from where you left off.';\n\n/**\n * Error types that can be returned from agent execution.\n * These correspond to the error signals that the agent emits.\n */\nexport enum AgentErrorType {\n  /** The configured run deadline elapsed and the SDK query was aborted */\n  AGENTIC_DETECTION_TIMEOUT = 'WIZARD_AGENTIC_DETECTION_TIMEOUT',\n  /** Agent could not access the PostHog MCP server */\n  MCP_MISSING = 'WIZARD_MCP_MISSING',\n  /** Agent could not access the setup resource */\n  RESOURCE_MISSING = 'WIZARD_RESOURCE_MISSING',\n  /** API rate limit exceeded */\n  RATE_LIMIT = 'WIZARD_RATE_LIMIT',\n  /** Generic API error */\n  API_ERROR = 'WIZARD_API_ERROR',\n  /** YARA scanner detected a security violation */\n  YARA_VIOLATION = 'WIZARD_YARA_VIOLATION',\n  /** Agent intentionally aborted the program (emitted [ABORT] <reason>) */\n  ABORT = 'WIZARD_ABORT',\n  /** Agent ended without making a single tool call — a no-op run that did no work */\n  NO_PROGRESS = 'WIZARD_NO_PROGRESS',\n  /** A schema-bound run ended without output matching its schema */\n  INVALID_STRUCTURED_OUTPUT = 'WIZARD_INVALID_STRUCTURED_OUTPUT',\n  /** Agent acted but stopped short — planned tasks left open and/or no skill installed */\n  INCOMPLETE_TASKS = 'WIZARD_INCOMPLETE_TASKS',\n}\n","/**\n * PostHog AI gateway provider spec for pi sessions, shared by the linear run\n * and the orchestrator's per-task runs so both speak to the gateway\n * identically: bearer auth, the wizard properties header, transport shape\n * inferred from the model id. The caller registers the spec on its own\n * (lazily imported, properly typed) pi ModelRegistry.\n */\n\nimport {\n  buildWizardPropertiesBlob,\n  isPastRefresh,\n  type GatewayAuth,\n} from '@agent/gateway-session';\nimport {\n  modelCapabilities,\n  type ThinkingLevel,\n} from '../../switchboard/models';\nimport { AgentErrorType } from '@agent/signals';\n\n/** Provider registered on the in-memory registry for this run. */\nexport const GATEWAY_PROVIDER = 'posthog-gateway';\n\n/** The pi transports the gateway serves. */\nexport type GatewayApi =\n  | 'anthropic-messages'\n  | 'openai-completions'\n  | 'openai-responses';\n\n/**\n * The gateway speaks two shapes on two endpoints: Anthropic models over\n * `anthropic-messages` (the SDK appends `/v1/messages`, so the base URL has no\n * `/v1`), and OpenAI-class models (`openai/gpt-5`, …) over an OpenAI shape at\n * `/v1/responses` or `/v1/chat/completions` (base URL keeps `/v1`). Infer the\n * shape from the model id so a pair's model selects the right transport.\n *\n * OpenAI models take the Responses API because OpenAI rejects function tools\n * combined with `reasoning_effort` on chat completions and every task sends both.\n */\nexport function gatewayApiFor(modelId: string): GatewayApi {\n  return modelId.startsWith('openai/')\n    ? 'openai-responses'\n    : 'anthropic-messages';\n}\n\n/**\n * Gateway HTTP headers, mirroring `buildAgentEnv` on the anthropic path: one\n * `X-PostHog-Properties` JSON blob (Bedrock fallback is native, so no opt-in)\n * plus the 1M context beta, since pi otherwise runs at 200k and overflows on\n * larger projects (the post-run compaction failures).\n */\nexport function buildGatewayHeaders(\n  wizardMetadata: Record<string, string>,\n  wizardFlags: Record<string, string>,\n  teamId?: number,\n): Record<string, string> {\n  return {\n    'anthropic-beta': 'context-1m-2025-08-07',\n    'X-PostHog-Properties': buildWizardPropertiesBlob(\n      wizardMetadata,\n      wizardFlags,\n      teamId,\n    ),\n  };\n}\n\nexport interface GatewayProviderInputs {\n  gatewayUrl: string;\n  accessToken: string;\n  /** Customer team for the properties blob (from the mint response). */\n  teamId?: number;\n  wizardMetadata: Record<string, string>;\n  wizardFlags: Record<string, string>;\n  modelId: string;\n  // Resolved effort override — the switchboard's flag/payload pick on linear\n  // runs, the prompt-frontmatter effort on per-task agents. Overrides the\n  // table default for a reasoning model when set.\n  effort?: ThinkingLevel;\n}\n\n/**\n * One gateway model spec — the single description of how to reach a model on\n * the gateway. The provider spec below wraps it for pi's registry; one-shot\n * callers (scan triage) hand it straight to `completeSimple`.\n */\nexport function buildGatewayModel(inputs: GatewayProviderInputs) {\n  const { gatewayUrl, wizardMetadata, wizardFlags, modelId, teamId } = inputs;\n  const api = gatewayApiFor(modelId);\n  return {\n    id: modelId,\n    name: `${modelId} (PostHog Gateway)`,\n    api,\n    provider: GATEWAY_PROVIDER,\n    // Anthropic drops /v1 (the SDK appends /v1/messages); the OpenAI shape keeps it.\n    baseUrl: api === 'anthropic-messages' ? gatewayUrl : `${gatewayUrl}/v1`,\n    // A model trait resolved by the switchboard, not a harness guess:\n    // non-reasoning openai models reject `reasoning_effort` (gpt-4o → gateway\n    // UnsupportedParamsError → the run no-ops).\n    reasoning: modelCapabilities(modelId).reasoning,\n    input: ['text' as const],\n    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n    contextWindow: 1_000_000,\n    maxTokens: 64_000,\n    headers: buildGatewayHeaders(wizardMetadata, wizardFlags, teamId),\n  };\n}\n\n/**\n * The provider object for `registry.registerProvider(GATEWAY_PROVIDER, …)`,\n * plus the derived traits the session setup needs (`caps.thinkingLevel`).\n */\nexport function buildGatewayProvider(inputs: GatewayProviderInputs): {\n  provider: Record<string, unknown>;\n  api: GatewayApi;\n  caps: ReturnType<typeof modelCapabilities>;\n  gatewayUrl: string;\n  baseUrl: string;\n} {\n  const { gatewayUrl, accessToken, modelId, effort } = inputs;\n  const api = gatewayApiFor(modelId);\n  // One resolution point for the model's traits and the run's effort override.\n  // pi clamps whatever comes out of here against the levels this spec declares,\n  // so a level the spec doesn't carry is silently reduced by the session.\n  const tableCaps = modelCapabilities(modelId);\n  const caps =\n    effort && effort !== 'off' && tableCaps.reasoning\n      ? modelCapabilities(modelId, effort)\n      : effort === 'off' && tableCaps.reasoning\n      ? { ...tableCaps, thinkingLevel: 'off' as const }\n      : tableCaps;\n\n  const model = buildGatewayModel(inputs);\n  const provider = {\n    name: 'PostHog Gateway',\n    baseUrl: model.baseUrl,\n    apiKey: accessToken,\n    authHeader: true,\n    api,\n    headers: model.headers,\n    models: [model],\n  };\n  return { provider, api, caps, gatewayUrl, baseUrl: model.baseUrl };\n}\n\n/** The part of a pi assistant turn that says why it failed. */\nexport interface GatewayTurnError {\n  errorMessage?: string;\n  diagnostics?: { error?: { name?: string; code?: string | number } }[];\n}\n\nexport type GatewayTerminalFailure = {\n  classification:\n    | AgentErrorType.API_ERROR\n    | AgentErrorType.RATE_LIMIT\n    | AgentErrorType.ABORT;\n  message: string;\n  status?: number;\n};\n\nexport function gatewayTerminalFailure(\n  turn: ({ stopReason?: string } & GatewayTurnError) | undefined,\n): GatewayTerminalFailure | undefined {\n  if (!turn || (turn.stopReason !== 'error' && turn.stopReason !== 'aborted'))\n    return undefined;\n  const message =\n    turn.errorMessage ||\n    (turn.stopReason === 'aborted'\n      ? 'Agent turn aborted'\n      : 'Gateway request failed');\n  if (turn.stopReason === 'aborted') {\n    return { classification: AgentErrorType.ABORT, message };\n  }\n  const codes =\n    turn.diagnostics\n      ?.map((d) => d.error?.code)\n      .filter((code) => code !== undefined) ?? [];\n  const structuredStatus = codes\n    .map(Number)\n    .find((code) => Number.isInteger(code) && code >= 400 && code < 600);\n  const rateLimited =\n    structuredStatus !== undefined\n      ? structuredStatus === 429\n      : /\\b429\\b|rate limit/i.test(message);\n  return {\n    classification: rateLimited\n      ? AgentErrorType.RATE_LIMIT\n      : AgentErrorType.API_ERROR,\n    message,\n    status:\n      structuredStatus ?? (isGatewayAuthRejection(turn) ? 401 : undefined),\n  };\n}\n\n/**\n * Whether a turn's error is the gateway rejecting the bearer. pi attaches the\n * SDK's own error to `diagnostics`, so its code decides when one is present.\n * The message match is the fallback for a turn that failed before pi built a\n * diagnostic, where the status survives only as prose.\n */\nexport function isGatewayAuthRejection(\n  turn: GatewayTurnError | string | undefined,\n): boolean {\n  const { errorMessage, diagnostics } =\n    typeof turn === 'string'\n      ? { errorMessage: turn, diagnostics: undefined }\n      : turn ?? {};\n  const structuredStatus = (diagnostics ?? [])\n    .map((diagnostic) => Number(diagnostic.error?.code))\n    .find((code) => Number.isInteger(code) && code >= 400 && code < 600);\n  if (structuredStatus !== undefined) return structuredStatus === 401;\n  for (const diagnostic of diagnostics ?? []) {\n    const code = diagnostic.error?.code;\n    if (code === 401 || code === '401') return true;\n    if (/^authentication_?error$/i.test(diagnostic.error?.name ?? ''))\n      return true;\n  }\n  return /\\b401\\b|authentication_error|unauthorized/i.test(errorMessage ?? '');\n}\n\nexport interface GatewayRemintOptions {\n  signal?: AbortSignal;\n  session: { prompt(text: string): Promise<void> };\n  registry: { registerProvider(providerName: string, config: never): void };\n  auth: GatewayAuth;\n  /** The cache: the same token while fresh, a new mint past the refresh point. */\n  refreshAuth: () => Promise<GatewayAuth>;\n  providerInputs: (auth: GatewayAuth) => GatewayProviderInputs;\n  /** The prompt that resumes the work after a re-mint. */\n  continueText: string | (() => string);\n  onRemint?: () => void;\n}\n\n/**\n * Wraps a pi session's prompt(): when a turn ends on a 401 from a bearer past\n * its refresh instant, mint once, re-register the provider with the new\n * bearer (pi resolves the apiKey per request), and continue. A 401 on a fresh\n * bearer, or a second one, is left to the harness's normal failure path.\n */\nexport function withGatewayRemint(opts: GatewayRemintOptions): {\n  prompt(text: string): Promise<void>;\n  /** Feed every assistant `message_end`; the last turn decides. */\n  noteAssistantTurn(message: unknown): void;\n  terminalFailure(): GatewayTerminalFailure | undefined;\n} {\n  let auth = opts.auth;\n  let rejected = false;\n  let reminted = false;\n  let lastTurn: ({ stopReason?: string } & GatewayTurnError) | undefined;\n  return {\n    noteAssistantTurn(message) {\n      lastTurn = message as\n        | ({ stopReason?: string } & GatewayTurnError)\n        | undefined;\n      rejected =\n        lastTurn?.stopReason === 'error' && isGatewayAuthRejection(lastTurn);\n    },\n    terminalFailure: () => gatewayTerminalFailure(lastTurn),\n    async prompt(text) {\n      if (opts.signal?.aborted) return;\n      rejected = false;\n      lastTurn = undefined;\n      await opts.session.prompt(text);\n      if (opts.signal?.aborted || !rejected || reminted || !isPastRefresh(auth))\n        return;\n      reminted = true;\n      auth = await opts.refreshAuth();\n      if (opts.signal?.aborted) return;\n      opts.registry.registerProvider(\n        GATEWAY_PROVIDER,\n        buildGatewayProvider(opts.providerInputs(auth)).provider as never,\n      );\n      opts.onRemint?.();\n      rejected = false;\n      lastTurn = undefined;\n      const next = opts.continueText;\n      if (opts.signal?.aborted) return;\n      await opts.session.prompt(typeof next === 'function' ? next() : next);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAyCA,IAAI,SAA4B;;;;;AAKhC,IAAI,WAAkE;AAgCtE,SAAgB,kCACd,WACA,QACM;AAEJ,OAAM,IAAI,MAAM,kDAAkD;;;;;;AAiBtE,MAAM,oBAAoB,MAAS;;AAEnC,MAAM,sBAAsB;AAG5B,MAAM,kBAAkB;;AAExB,MAAM,4BAA4B;;AAElC,MAAM,6BAA6B;;AAGnC,eAAsB,YACpB,MACA,aACA,SACsB;CAKtB,MAAM,MAAM,GAAG,KAAK,QAAQ,IAAI,cAAc,YAAY,CAAC,IACzD,WAAW;AAEb,KAAI,UAAU,OAAO,QAAQ,OAAO,KAAK,KAAK,GAAG,OAAO,UACtD,QAAO,OAAO;AAEhB,KAAI,YAAY,SAAS,QAAQ,IAAK,QAAO,SAAS;CACtD,MAAM,UAAU,mBAAmB,MAAM,aAAa,KAAK,QAAQ;AACnE,YAAW;EAAE;EAAK;EAAS;AAC3B,KAAI;AACF,SAAO,MAAM;WACL;AACR,MAAI,UAAU,YAAY,QAAS,YAAW;;;AAIlD,eAAe,mBACb,MACA,aACA,KACA,SACsB;AACtB,KAAI,CAAC,SAAS;AAGZ,YAAU,mDAAmD;AAC7D,QAAM,IAAI,kBACR,oDACD;;CAEH,MAAM,SAAS,MAAM,iBAAiB,MAAM,aAAa,QAAQ;AAEjE,MADe,MAAM,sBAAsB,OAAO,WAAW,EAClD,WAAA,UACT,OAAM,IAAI,YACR,kEACA,KAAA,GACA,WAAW,iBACZ;CAEH,MAAM,cAAc,KAAK,MAAM,OAAO,UAAU;CAChD,MAAM,QAAQ,cAAc,KAAK,KAAK;AACtC,KAAI,CAAC,OAAO,SAAS,YAAY,IAAI,QAAQ,mBAAmB;AAG9D,YACE,wCAAwC,MAAM,6BAC/C;AACD,QAAM,IAAI,kBACR,2CAA2C,MAAM,YAClD;;CAEH,MAAM,YAAY,KAAK,KAAK,GAAG,QAAQ;AAGvC,WACE,4CAA4C,QAAQ,QAClD,OAAO,UAAU,UAClB,OAAO,KAAK,MAAM,QAAQ,IAAK,CAAC,QAAQ,OAAO,aACjD;CACD,MAAM,OAAoB;EACxB,YAAY,OAAO;EACnB,OAAO,OAAO;EACd,QAAQ,OAAO;EACf,aAAa;EACd;AACD,UAAS;EAAE;EAAK;EAAM;EAAW;AACjC,QAAO;;;AAWT,SAAgB,cAAc,MAAmB,MAAM,KAAK,KAAK,EAAW;AAC1E,QAAO,OAAO,KAAK;;;;;;;AAQrB,SAAgB,oBAAoB,OAAe,SAA0B;CAC3E,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,MAAM;SACd;AACN,SAAO;;AAIT,KACE,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,QACJ,IAAI,YACJ,IAAI,SAEJ,QAAO;AAOT,KAJE,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa,uBAEJ,QAAO;AACtB,KAAI,IAAI,aAAa,SAAU,QAAO;AACtC,KAAI,IAAI,SAAS,SAAS,eAAe,CACvC,QACE,IAAI,WAAW,uCACf,IAAI,WAAW;AAGnB,KAAI;AACF,SAAO,IAAI,aAAa,IAAI,IAAI,QAAQ,CAAC;SACnC;AACN,SAAO;;;;;;;;;AAiBX,IAAa,qBAAb,cAAwC,YAAY;CAClD;;CAEA;CAEA,YAAY,QAAgB,SAAiB,SAAkB;AAC7D,QAAM,SAAS;GAAE;GAAQ;GAAS,EAAE,WAAW,mBAAmB;AAClE,OAAK,OAAO;AACZ,OAAK,SAAS;AACd,OAAK,UAAU;;;;;;;AAQnB,IAAa,oBAAb,cAAuC,YAAY;CACjD,YAAY,SAAiB;AAC3B,QAAM,SAAS,KAAA,GAAW,WAAW,kBAAkB;AACvD,OAAK,OAAO;;;;;;;;;AAUhB,SAAS,cAAc,QAAyB;AAC9C,QACE,WAAW,OACX,WAAW,OACX,WAAW,OACX,WAAW,OACX,WAAW;;;;;;;;;AAgBf,SAAS,iBAAiB,OAAwB;AAChD,KAAI,OAAO,UAAU,SAAU,QAAO;AAKtC,QAAO,MAAM,QAAQ,iCAAiC,IAAI,CAAC,MAAM;;AAGnE,eAAe,YAAY,MAAsC;AAC/D,KAAI;EACF,MAAM,OAAQ,MAAM,KAAK,MAAM;EAK/B,MAAM,SAAS,iBAAiB,MAAM,OAAO;EAG7C,MAAM,UACJ,iBAAiB,MAAM,KAAK,IAAI,iBAAiB,MAAM,QAAQ;AACjE,SAAO;GACL,QACE,OAAO,SAAS,KAAK,OAAO,UAAU,4BAClC,SACA,KAAA;GACN,SACE,QAAQ,SAAS,KAAK,QAAQ,UAAU,6BACpC,UACA,KAAA;GACP;SACK;AACN,SAAO,EAAE;;;AAIb,SAAS,mBAAmB,QAAgB,QAAyB;AACnE,KAAI,OAAQ,QAAO;AACnB,SAAQ,QAAR;EACE,KAAK,IACH,QAAO;EACT,KAAK,IACH,QAAO;EACT,KAAK,IAEH,QAAO;EACT,KAAK,IACH,QAAO;EACT,KAAK,IACH,QAAO;EACT,QACE,QAAO;;;AAIb,eAAe,iBACb,MACA,aACA,SACsB;AACtB,KAAI;EACF,MAAM,OAAO,MAAM,MAAM,GAAG,KAAK,QAAQ,6BAA6B;GACpE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IACjB;GAID,MAAM,KAAK,UAAU;IAAE;IAAS,sBAAsB;IAAM,CAAC;GAC7D,QAAQ,YAAY,QAAQ,gBAAgB;GAC7C,CAAC;AACF,MAAI,CAAC,KAAK,IAAI;AACZ,OAAI,cAAc,KAAK,OAAO,EAAE;IAC9B,MAAM,UAAU,MAAM,YAAY,KAAK;AACvC,cACE,oCAAoC,KAAK,OAAO,IAC9C,QAAQ,WAAW,aACpB,oBACF;AAGD,cAAU,cAAc,wBAAwB;KAC9C,QAAQ,KAAK;KACb,SAAS,QAAQ;KACjB;KACD,CAAC;AACF,UAAM,IAAI,mBACR,KAAK,QACL,mBAAmB,KAAK,QAAQ,QAAQ,OAAO,EAC/C,QAAQ,QACT;;AAEH,aACE,mCAAmC,KAAK,OAAO,mBAChD;AACD,SAAM,IAAI,kBACR,qDAAqD,KAAK,OAAO,GAClE;;EAEH,MAAM,OAAQ,MAAM,KAAK,MAAM;AAQ/B,MAAI,CAAC,KAAK,OAAO;AACf,aAAU,yDAAyD;AACnE,SAAM,IAAI,kBAAkB,8BAA8B;;AAE5D,MAAI,CAAC,KAAK,YAAY;AACpB,aAAU,8DAA8D;AACxE,SAAM,IAAI,kBAAkB,mCAAmC;;AAEjE,MAAI,CAAC,KAAK,aAAa;AACrB,aAAU,+DAA+D;AACzE,SAAM,IAAI,kBAAkB,oCAAoC;;AAElE,MAAI,CAAC,oBAAoB,KAAK,aAAa,KAAK,QAAQ,EAAE;AACxD,aACE,oEACD;AACD,SAAM,IAAI,kBAAkB,yCAAyC;;EAEvE,MAAM,aAAa,IAAI,IAAI,KAAK,YAAY;AAC5C,MACE,CAAC,aAAa,YAAY,CAAC,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC,SAAS,IACnE,WAAW,aAAa,uBAExB,YAAW,WAAW;AAExB,SAAO;GACL,OAAO,KAAK;GACZ,WAAW,KAAK;GAChB,YAAY,WAAW;GACvB,QAAQ,KAAK;GACd;UACM,GAAG;AAGV,MAAI,aAAa,sBAAsB,aAAa,kBAClD,OAAM;AACR,YACE,qCAAqC,OAAO,EAAE,CAAC,oBAChD;AACD,QAAM,IAAI,kBACR,wCAAwC,OAAO,EAAE,CAAC,GACnD;;;;;;;;;;AAWL,SAAgB,0BACd,gBACA,aACA,QACQ;CAIR,MAAM,QAAyC,EAAE,YAAY,UAAU;AACvE,KAAI,WAAW,KAAA,EAAW,OAAM,UAAU;AAC1C,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,eAAe,CACvD,OAAM,oBAAoB,IAAI,IAAI;AAEpC,MAAK,MAAM,CAAC,SAAS,YAAY,OAAO,QAAQ,YAAY,EAAE;AAC5D,MAAI,CAAC,QAAQ,aAAa,CAAC,WAAW,SAAS,CAAE;AACjD,QAAM,eAAe,QAAQ,aAAa,MAAM;;AAElD,QAAO,KAAK,UAAU,MAAM;;AAG9B,MAAM,yBAAyB;AAE/B,SAAS,oBAAoB,KAAqB;AAChD,QAAO,IAAI,aAAa,CAAC,WAAW,uBAAuB,GACvD,IAAI,MAAM,GAA8B,CAAC,aAAa,GACtD;;;;;;;;;AC1eN,MAAa,eAAe;CAE1B,QAAQ;CAER,mBAAmB;CAEnB,wBAAwB;CAQxB,sBAAsB;CAMtB,OAAO;CAEP,eAAe;CAEf,WAAW;CAMX,eAAe;CAMf,cAAc;CACf;;;;;;;AAUD,MAAa,qBAAqB,6CAA6C,aAAa,cAAc;;;;;AAM1G,MAAa,qBACX;;;;;;;;;;;ACxCF,MAAa,mBAAmB;;;;;;;;;;;AAkBhC,SAAgB,cAAc,SAA6B;AACzD,QAAO,QAAQ,WAAW,UAAU,GAChC,qBACA;;;;;;;;AASN,SAAgB,oBACd,gBACA,aACA,QACwB;AACxB,QAAO;EACL,kBAAkB;EAClB,wBAAwB,0BACtB,gBACA,aACA,OACD;EACF;;;;;;;AAsBH,SAAgB,kBAAkB,QAA+B;CAC/D,MAAM,EAAE,YAAY,gBAAgB,aAAa,SAAS,WAAW;CACrE,MAAM,MAAM,cAAc,QAAQ;AAClC,QAAO;EACL,IAAI;EACJ,MAAM,GAAG,QAAQ;EACjB;EACA,UAAU;EAEV,SAAS,QAAQ,uBAAuB,aAAa,GAAG,WAAW;EAInE,WAAW,kBAAkB,QAAQ,CAAC;EACtC,OAAO,CAAC,OAAgB;EACxB,MAAM;GAAE,OAAO;GAAG,QAAQ;GAAG,WAAW;GAAG,YAAY;GAAG;EAC1D,eAAe;EACf,WAAW;EACX,SAAS,oBAAoB,gBAAgB,aAAa,OAAO;EAClE;;;;;;AAOH,SAAgB,qBAAqB,QAMnC;CACA,MAAM,EAAE,YAAY,aAAa,SAAS,WAAW;CACrD,MAAM,MAAM,cAAc,QAAQ;CAIlC,MAAM,YAAY,kBAAkB,QAAQ;CAC5C,MAAM,OACJ,UAAU,WAAW,SAAS,UAAU,YACpC,kBAAkB,SAAS,OAAO,GAClC,WAAW,SAAS,UAAU,YAC9B;EAAE,GAAG;EAAW,eAAe;EAAgB,GAC/C;CAEN,MAAM,QAAQ,kBAAkB,OAAO;AAUvC,QAAO;EAAE,UATQ;GACf,MAAM;GACN,SAAS,MAAM;GACf,QAAQ;GACR,YAAY;GACZ;GACA,SAAS,MAAM;GACf,QAAQ,CAAC,MAAM;GAChB;EACkB;EAAK;EAAM;EAAY,SAAS,MAAM;EAAS;;AAkBpE,SAAgB,uBACd,MACoC;AACpC,KAAI,CAAC,QAAS,KAAK,eAAe,WAAW,KAAK,eAAe,UAC/D,QAAO,KAAA;CACT,MAAM,UACJ,KAAK,iBACJ,KAAK,eAAe,YACjB,uBACA;AACN,KAAI,KAAK,eAAe,UACtB,QAAO;EAAE,gBAAA;EAAsC;EAAS;CAM1D,MAAM,oBAHJ,KAAK,aACD,KAAK,MAAM,EAAE,OAAO,KAAK,CAC1B,QAAQ,SAAS,SAAS,KAAA,EAAU,IAAI,EAAE,EAE5C,IAAI,OAAO,CACX,MAAM,SAAS,OAAO,UAAU,KAAK,IAAI,QAAQ,OAAO,OAAO,IAAI;AAKtE,QAAO;EACL,iBAJA,qBAAqB,KAAA,IACjB,qBAAqB,MACrB,sBAAsB,KAAK,QAAQ,IAAA,sBAAA;EAKvC;EACA,QACE,qBAAqB,uBAAuB,KAAK,GAAG,MAAM,KAAA;EAC7D;;;;;;;;AASH,SAAgB,uBACd,MACS;CACT,MAAM,EAAE,cAAc,gBACpB,OAAO,SAAS,WACZ;EAAE,cAAc;EAAM,aAAa,KAAA;EAAW,GAC9C,QAAQ,EAAE;CAChB,MAAM,oBAAoB,eAAe,EAAE,EACxC,KAAK,eAAe,OAAO,WAAW,OAAO,KAAK,CAAC,CACnD,MAAM,SAAS,OAAO,UAAU,KAAK,IAAI,QAAQ,OAAO,OAAO,IAAI;AACtE,KAAI,qBAAqB,KAAA,EAAW,QAAO,qBAAqB;AAChE,MAAK,MAAM,cAAc,eAAe,EAAE,EAAE;EAC1C,MAAM,OAAO,WAAW,OAAO;AAC/B,MAAI,SAAS,OAAO,SAAS,MAAO,QAAO;AAC3C,MAAI,2BAA2B,KAAK,WAAW,OAAO,QAAQ,GAAG,CAC/D,QAAO;;AAEX,QAAO,6CAA6C,KAAK,gBAAgB,GAAG;;;;;;;;AAsB9E,SAAgB,kBAAkB,MAKhC;CACA,IAAI,OAAO,KAAK;CAChB,IAAI,WAAW;CACf,IAAI,WAAW;CACf,IAAI;AACJ,QAAO;EACL,kBAAkB,SAAS;AACzB,cAAW;AAGX,cACE,UAAU,eAAe,WAAW,uBAAuB,SAAS;;EAExE,uBAAuB,uBAAuB,SAAS;EACvD,MAAM,OAAO,MAAM;AACjB,OAAI,KAAK,QAAQ,QAAS;AAC1B,cAAW;AACX,cAAW,KAAA;AACX,SAAM,KAAK,QAAQ,OAAO,KAAK;AAC/B,OAAI,KAAK,QAAQ,WAAW,CAAC,YAAY,YAAY,CAAC,cAAc,KAAK,CACvE;AACF,cAAW;AACX,UAAO,MAAM,KAAK,aAAa;AAC/B,OAAI,KAAK,QAAQ,QAAS;AAC1B,QAAK,SAAS,iBACZ,kBACA,qBAAqB,KAAK,eAAe,KAAK,CAAC,CAAC,SACjD;AACD,QAAK,YAAY;AACjB,cAAW;AACX,cAAW,KAAA;GACX,MAAM,OAAO,KAAK;AAClB,OAAI,KAAK,QAAQ,QAAS;AAC1B,SAAM,KAAK,QAAQ,OAAO,OAAO,SAAS,aAAa,MAAM,GAAG,KAAK;;EAExE"}

package/dist/headless-ui-CUbv12Yx.js

@@ -1,44 +0,0 @@
-import "./wizard-session-BYw6LzpS.js";
-import { t as LoggingUI } from "./logging-ui-p6XKVmTx.js";
-//#region src/ui/headless-ui.ts
-/**
-* `LoggingUI` plus it feeds run state into a `WizardStore` so the background
-* wizard-session sync (`TaskStreamPush`) can observe a headless run. We extend
-* `LoggingUI` (not `InkUI`) because its blocking/gate methods would wait on a
-* TUI that never renders; the runner drives phase transitions on the store
-* directly, so only UI-originated per-run updates tee through here. The audit
-* ledger arrives through `setFrameworkContext`, the seam every UI implements.
-*/
-var HeadlessUI = class extends LoggingUI {
-	constructor(store) {
-		super();
-		this.store = store;
-	}
-	startRun() {
-		super.startRun();
-		this.store.setRunPhase("running");
-	}
-	setCredentials(credentials) {
-		this.store.setAccessToken(credentials);
-	}
-	setAccessToken(credentials) {
-		this.store.setAccessToken(credentials);
-	}
-	syncTodos(todos) {
-		super.syncTodos(todos);
-		this.store.syncTodos(todos);
-	}
-	setHandoffText(text) {
-		this.store.setHandoffText(text);
-	}
-	setFrameworkContext(key, value) {
-		this.store.setFrameworkContext(key, value);
-	}
-	getFrameworkContext(key) {
-		return this.store.session.frameworkContext[key];
-	}
-};
-//#endregion
-export { HeadlessUI };
-
-//# sourceMappingURL=headless-ui-CUbv12Yx.js.map

package/dist/headless-ui-CUbv12Yx.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"headless-ui-CUbv12Yx.js","names":[],"sources":["../src/ui/headless-ui.ts"],"sourcesContent":["import { RunPhase, type Credentials } from '@programs/session/wizard-session';\nimport { LoggingUI } from '../headless/renderers/logging-ui';\nimport type { WizardStore } from '../tui/store';\n\n/**\n * `LoggingUI` plus it feeds run state into a `WizardStore` so the background\n * wizard-session sync (`TaskStreamPush`) can observe a headless run. We extend\n * `LoggingUI` (not `InkUI`) because its blocking/gate methods would wait on a\n * TUI that never renders; the runner drives phase transitions on the store\n * directly, so only UI-originated per-run updates tee through here. The audit\n * ledger arrives through `setFrameworkContext`, the seam every UI implements.\n */\nexport class HeadlessUI extends LoggingUI {\n  constructor(private readonly store: WizardStore) {\n    super();\n  }\n\n  startRun(): void {\n    super.startRun();\n    this.store.setRunPhase(RunPhase.Running);\n  }\n\n  setCredentials(credentials: Credentials): void {\n    this.store.setAccessToken(credentials);\n  }\n\n  setAccessToken(credentials: Credentials): void {\n    this.store.setAccessToken(credentials);\n  }\n\n  syncTodos(\n    todos: Array<{\n      id?: string;\n      source?: string;\n      content: string;\n      status: string;\n      activeForm?: string;\n    }>,\n  ): void {\n    super.syncTodos(todos);\n    this.store.syncTodos(todos);\n  }\n\n  setHandoffText(text: string): void {\n    this.store.setHandoffText(text);\n  }\n\n  setFrameworkContext(key: string, value: unknown): void {\n    this.store.setFrameworkContext(key, value);\n  }\n\n  getFrameworkContext(key: string): unknown {\n    return this.store.session.frameworkContext[key];\n  }\n}\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,aAAb,cAAgC,UAAU;CACxC,YAAY,OAAqC;AAC/C,SAAO;AADoB,OAAA,QAAA;;CAI7B,WAAiB;AACf,QAAM,UAAU;AAChB,OAAK,MAAM,YAAA,UAA6B;;CAG1C,eAAe,aAAgC;AAC7C,OAAK,MAAM,eAAe,YAAY;;CAGxC,eAAe,aAAgC;AAC7C,OAAK,MAAM,eAAe,YAAY;;CAGxC,UACE,OAOM;AACN,QAAM,UAAU,MAAM;AACtB,OAAK,MAAM,UAAU,MAAM;;CAG7B,eAAe,MAAoB;AACjC,OAAK,MAAM,eAAe,KAAK;;CAGjC,oBAAoB,KAAa,OAAsB;AACrD,OAAK,MAAM,oBAAoB,KAAK,MAAM;;CAG5C,oBAAoB,KAAsB;AACxC,SAAO,KAAK,MAAM,QAAQ,iBAAiB"}