@posthog/wizard 2.82.0 → 2.84.0

package/dist/bounded-fs-TRL6IsoU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-fs-TRL6IsoU.js","names":[],"sources":["../src/shared/utils/bounded-fs.ts"],"sourcesContent":["/**\n * Bounded filesystem primitives for scanning USER project trees. Every\n * detection-time glob, walk, and project-file read goes through here so the\n * worst case is a constant, never a function of the user's repo.\n */\nimport path from 'path';\nimport fs from 'fs';\nimport type { Dirent } from 'fs';\nimport fg from 'fast-glob';\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport type { WizardRunOptions } from './types';\n\n/**\n * Errno codes that are expected while walking an arbitrary tree and mean\n * \"skip this entry\", not \"something is broken\". Scanning from a broad dir\n * (e.g. `~`) routinely hits OS-protected paths (macOS `Library/Group\n * Containers/group.com.apple.*`) that throw EPERM/EACCES per entry — capturing\n * each as an exception buried real errors under thousands of noise events.\n */\nconst BENIGN_FS_ERROR_CODES = new Set<string>([\n  'EACCES', // permission denied\n  'EPERM', // operation not permitted (macOS-protected dirs)\n  'ENOENT', // entry vanished mid-walk\n  'ENOTDIR', // path component isn't a directory\n  'ELOOP', // symlink loop\n  'ENAMETOOLONG', // path too long\n  'EMFILE', // too many open files (environmental, not a wizard bug)\n  'ENFILE',\n  'EBUSY', // file locked by another process (Windows)\n  'UNKNOWN', // libuv could not map the OS error (Windows locked/placeholder files)\n]);\n\n/**\n * Report a swallowed filesystem error. Traversal stays best-effort — the caller\n * still skips the failing entry. Expected errno codes (permission denied, entry\n * vanished, symlink loops…) are logged to the debug file only; anything else is\n * genuinely unexpected and gets captured to error tracking. Preserves the\n * original Error (and its `code`, e.g. EACCES / ENOENT) when available.\n */\nfunction reportFsError(step: string, filePath: string, error: unknown): void {\n  const code = (error as NodeJS.ErrnoException | null)?.code;\n  if (code && BENIGN_FS_ERROR_CODES.has(code)) {\n    logToFile(`[bounded-fs] skipped ${step} (${code}): ${filePath}`);\n    return;\n  }\n  analytics.captureException(\n    error instanceof Error ? error : new Error(String(error)),\n    { step, path: filePath },\n  );\n}\n\nexport function getDotGitignore({\n  installDir,\n}: Pick<WizardRunOptions, 'installDir'>) {\n  const gitignorePath = path.join(installDir, '.gitignore');\n  const gitignoreExists = fs.existsSync(gitignorePath);\n\n  if (gitignoreExists) {\n    return gitignorePath;\n  }\n\n  return undefined;\n}\n\n/**\n * Directory names to skip when scanning a project tree — dependency\n * directories, build output, virtual environments, vendored trees.\n * Used verbatim by walkProjectFiles and as glob patterns by boundedGlob.\n */\nexport const IGNORED_DIRS = new Set<string>([\n  'node_modules',\n  '.git',\n  '.next',\n  '.nuxt',\n  '.svelte-kit',\n  '.turbo',\n  '.cache',\n  '.parcel-cache',\n  'dist',\n  'build',\n  'out',\n  'coverage',\n  '.coverage',\n  'venv',\n  '.venv',\n  '__pycache__',\n  '.pytest_cache',\n  'vendor',\n  'target',\n  '.gradle',\n  '.idea',\n  '.vscode',\n  'site-packages',\n  'DerivedData',\n  'Pods',\n]);\n\n/** IGNORED_DIRS as fast-glob ignore patterns. */\nexport const PROJECT_IGNORE_GLOBS: readonly string[] = [...IGNORED_DIRS].map(\n  (dir) => `**/${dir}/**`,\n);\n\n// Files larger than this are skipped, never materialized.\nexport const MAX_PROJECT_FILE_BYTES = 2 * 1024 * 1024;\n\n// A glob returns at most this many entries.\nexport const MAX_GLOB_MATCHES = 500;\n\n// A glob's traversal is destroyed after this long, even when abandoned.\nexport const GLOB_DEADLINE_MS = 8_000;\n\n// A directory contributes at most this many entries to a walk.\nexport const MAX_DIR_ENTRIES = 10_000;\n\n// A walk fires at most this many onFile callbacks.\nexport const MAX_WALK_FILES = 100_000;\n\nexport interface BoundedGlobOptions {\n  cwd: string;\n  /** Appended to PROJECT_IGNORE_GLOBS. */\n  extraIgnore?: readonly string[];\n  /** Stop after this many matches. Defaults to MAX_GLOB_MATCHES. */\n  limit?: number;\n  /** Match dotfiles. Traversal of dot-DIRECTORIES stays blocked by the ignore set. */\n  dot?: boolean;\n  /** fast-glob `deep` — maximum directory depth. */\n  deep?: number;\n}\n\n/**\n * Streams matches, stops at `limit`, destroys the crawl at GLOB_DEADLINE_MS.\n * Returns paths relative to `cwd`, possibly truncated.\n */\nexport async function boundedGlob(\n  patterns: string | string[],\n  options: BoundedGlobOptions,\n): Promise<string[]> {\n  const limit = options.limit ?? MAX_GLOB_MATCHES;\n  const stream = fg.stream(patterns, {\n    cwd: options.cwd,\n    dot: options.dot ?? false,\n    onlyFiles: true,\n    deep: options.deep,\n    ignore: [...PROJECT_IGNORE_GLOBS, ...(options.extraIgnore ?? [])],\n    suppressErrors: true,\n    followSymbolicLinks: false,\n  }) as NodeJS.ReadableStream & { destroy(): void };\n\n  const matches: string[] = [];\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      resolve(matches);\n    };\n    const timer = setTimeout(() => {\n      stream.destroy();\n      finish();\n    }, GLOB_DEADLINE_MS);\n    stream.on('data', (entry: string | Buffer) => {\n      matches.push(String(entry));\n      if (matches.length >= limit) {\n        stream.destroy();\n        finish();\n      }\n    });\n    stream.once('error', finish);\n    stream.once('end', finish);\n    stream.once('close', finish);\n  });\n}\n\nexport interface WalkOptions {\n  /**\n   * Follow symlinked files and directories. Defaults to true. A caller that\n   * reports what it reads turns this off: a symlink can point anywhere on the\n   * machine, outside the project it is scanning.\n   */\n  followSymlinks?: boolean;\n}\n\n/**\n * Walk a project tree, invoking `onFile(name, fullPath)` for every regular\n * file — including dotfiles like `.env` (the caller decides what it cares\n * about). Skips `IGNORED_DIRS` and hidden directories, follows symlinks\n * (unless `followSymlinks` is false) with realpath-based loop protection,\n * descends at most `maxDepth` levels below `rootDir`, and stops at the\n * per-directory and whole-walk caps. Filesystem errors are reported and\n * skipped (best-effort).\n *\n * Returns whether the walk saw the whole tree within `maxDepth`: false when it\n * stopped at a cap or skipped a directory it could not read.\n */\nexport function walkProjectFiles(\n  rootDir: string,\n  onFile: (name: string, fullPath: string) => void,\n  maxDepth = 3,\n  { followSymlinks = true }: WalkOptions = {},\n): boolean {\n  const visited = new Set<string>();\n  let filesSeen = 0;\n  let complete = true;\n  // Explicit stack — no call-stack recursion.\n  const stack: Array<{ dir: string; depth: number }> = [\n    { dir: rootDir, depth: 0 },\n  ];\n\n  while (stack.length > 0) {\n    if (filesSeen >= MAX_WALK_FILES) {\n      complete = false;\n      break;\n    }\n    const { dir, depth } = stack.pop()!;\n\n    // realpath both resolves symlinked dirs and gives us a stable key to\n    // detect loops (symlink cycles, e.g. a -> ../a).\n    let realDir: string;\n    try {\n      realDir = fs.realpathSync(dir);\n    } catch (error) {\n      reportFsError('walkProjectFiles.realpath', dir, error);\n      complete = false;\n      continue;\n    }\n    if (visited.has(realDir)) continue;\n    visited.add(realDir);\n\n    let handle: fs.Dir;\n    try {\n      handle = fs.opendirSync(dir);\n    } catch (error) {\n      reportFsError('walkProjectFiles.opendir', dir, error);\n      complete = false;\n      continue;\n    }\n    try {\n      let entriesRead = 0;\n      let entry: Dirent | null;\n      while ((entry = handle.readSync()) !== null) {\n        if (++entriesRead > MAX_DIR_ENTRIES || filesSeen >= MAX_WALK_FILES) {\n          logToFile(\n            `[bounded-fs] walk capped in ${dir} (entries=${entriesRead}, files=${filesSeen})`,\n          );\n          complete = false;\n          break;\n        }\n        if (IGNORED_DIRS.has(entry.name)) continue;\n\n        const fullPath = path.join(dir, entry.name);\n\n        // Symlinks report isDirectory()/isFile() as false under withFileTypes,\n        // so resolve the target before deciding how to handle the entry.\n        let isDir = entry.isDirectory();\n        let isFile = entry.isFile();\n        if (entry.isSymbolicLink()) {\n          if (!followSymlinks) continue;\n          try {\n            const st = fs.statSync(fullPath);\n            isDir = st.isDirectory();\n            isFile = st.isFile();\n          } catch (error) {\n            reportFsError('walkProjectFiles.stat', fullPath, error);\n            continue;\n          }\n        }\n\n        if (isDir) {\n          if (entry.name.startsWith('.')) continue; // skip hidden directories\n          if (depth < maxDepth) stack.push({ dir: fullPath, depth: depth + 1 });\n        } else if (isFile) {\n          filesSeen += 1;\n          onFile(entry.name, fullPath);\n        }\n      }\n    } finally {\n      try {\n        handle.closeSync();\n      } catch {\n        /* already closed */\n      }\n    }\n  }\n  return complete;\n}\n\n/**\n * Read a project file as UTF-8, or null when missing, unreadable, or over\n * `maxBytes` (stat-gated: an oversized file is never materialized).\n */\nexport function readProjectFile(\n  filePath: string,\n  maxBytes = MAX_PROJECT_FILE_BYTES,\n): string | null {\n  try {\n    if (fs.statSync(filePath).size > maxBytes) return null;\n    return fs.readFileSync(filePath, 'utf-8');\n  } catch {\n    return null;\n  }\n}\n\n/**\n * `readProjectFile` that also reports unexpected errors to error tracking.\n * For walk callbacks where a failing read is worth a telemetry breadcrumb.\n */\nexport function safeReadFile(fullPath: string): string | null {\n  try {\n    if (fs.statSync(fullPath).size > MAX_PROJECT_FILE_BYTES) {\n      logToFile(`[bounded-fs] skipped oversized file: ${fullPath}`);\n      return null;\n    }\n    return fs.readFileSync(fullPath, 'utf-8');\n  } catch (error) {\n    reportFsError('safeReadFile', fullPath, error);\n    return null;\n  }\n}\n\n/**\n * The first `bytes` of a file without materializing the rest.\n */\nexport function readFileHead(filePath: string, bytes: number): string | null {\n  try {\n    const fd = fs.openSync(filePath, 'r');\n    try {\n      const buffer = Buffer.alloc(bytes);\n      const read = fs.readSync(fd, buffer, 0, bytes, 0);\n      return buffer.toString('utf-8', 0, read);\n    } finally {\n      fs.closeSync(fd);\n    }\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,MAAM,wBAAwB,IAAI,IAAY;CAC5C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;;;;AASF,SAAS,cAAc,MAAc,UAAkB,OAAsB;CAC3E,MAAM,OAAQ,OAAwC;AACtD,KAAI,QAAQ,sBAAsB,IAAI,KAAK,EAAE;AAC3C,YAAU,wBAAwB,KAAK,IAAI,KAAK,KAAK,WAAW;AAChE;;AAEF,WAAU,iBACR,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD;EAAE;EAAM,MAAM;EAAU,CACzB;;;;;;;AAqBH,MAAa,eAAe,IAAI,IAAY;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;AAGF,MAAa,uBAA0C,CAAC,GAAG,aAAa,CAAC,KACtE,QAAQ,MAAM,IAAI,KACpB;AAGD,MAAa,yBAAyB,IAAI,OAAO;AAMjD,MAAa,mBAAmB;;;;;AAwBhC,eAAsB,YACpB,UACA,SACmB;CACnB,MAAM,QAAQ,QAAQ,SAAA;CACtB,MAAM,SAAS,GAAG,OAAO,UAAU;EACjC,KAAK,QAAQ;EACb,KAAK,QAAQ,OAAO;EACpB,WAAW;EACX,MAAM,QAAQ;EACd,QAAQ,CAAC,GAAG,sBAAsB,GAAI,QAAQ,eAAe,EAAE,CAAE;EACjE,gBAAgB;EAChB,qBAAqB;EACtB,CAAC;CAEF,MAAM,UAAoB,EAAE;AAC5B,QAAO,IAAI,SAAS,YAAY;EAC9B,IAAI,UAAU;EACd,MAAM,eAAqB;AACzB,OAAI,QAAS;AACb,aAAU;AACV,gBAAa,MAAM;AACnB,WAAQ,QAAQ;;EAElB,MAAM,QAAQ,iBAAiB;AAC7B,UAAO,SAAS;AAChB,WAAQ;KACP,iBAAiB;AACpB,SAAO,GAAG,SAAS,UAA2B;AAC5C,WAAQ,KAAK,OAAO,MAAM,CAAC;AAC3B,OAAI,QAAQ,UAAU,OAAO;AAC3B,WAAO,SAAS;AAChB,YAAQ;;IAEV;AACF,SAAO,KAAK,SAAS,OAAO;AAC5B,SAAO,KAAK,OAAO,OAAO;AAC1B,SAAO,KAAK,SAAS,OAAO;GAC5B;;;;;;;;;;;;;;AAwBJ,SAAgB,iBACd,SACA,QACA,WAAW,GACX,EAAE,iBAAiB,SAAsB,EAAE,EAClC;CACT,MAAM,0BAAU,IAAI,KAAa;CACjC,IAAI,YAAY;CAChB,IAAI,WAAW;CAEf,MAAM,QAA+C,CACnD;EAAE,KAAK;EAAS,OAAO;EAAG,CAC3B;AAED,QAAO,MAAM,SAAS,GAAG;AACvB,MAAI,aAAA,KAA6B;AAC/B,cAAW;AACX;;EAEF,MAAM,EAAE,KAAK,UAAU,MAAM,KAAK;EAIlC,IAAI;AACJ,MAAI;AACF,aAAU,GAAG,aAAa,IAAI;WACvB,OAAO;AACd,iBAAc,6BAA6B,KAAK,MAAM;AACtD,cAAW;AACX;;AAEF,MAAI,QAAQ,IAAI,QAAQ,CAAE;AAC1B,UAAQ,IAAI,QAAQ;EAEpB,IAAI;AACJ,MAAI;AACF,YAAS,GAAG,YAAY,IAAI;WACrB,OAAO;AACd,iBAAc,4BAA4B,KAAK,MAAM;AACrD,cAAW;AACX;;AAEF,MAAI;GACF,IAAI,cAAc;GAClB,IAAI;AACJ,WAAQ,QAAQ,OAAO,UAAU,MAAM,MAAM;AAC3C,QAAI,EAAE,cAAA,OAAiC,aAAA,KAA6B;AAClE,eACE,+BAA+B,IAAI,YAAY,YAAY,UAAU,UAAU,GAChF;AACD,gBAAW;AACX;;AAEF,QAAI,aAAa,IAAI,MAAM,KAAK,CAAE;IAElC,MAAM,WAAW,KAAK,KAAK,KAAK,MAAM,KAAK;IAI3C,IAAI,QAAQ,MAAM,aAAa;IAC/B,IAAI,SAAS,MAAM,QAAQ;AAC3B,QAAI,MAAM,gBAAgB,EAAE;AAC1B,SAAI,CAAC,eAAgB;AACrB,SAAI;MACF,MAAM,KAAK,GAAG,SAAS,SAAS;AAChC,cAAQ,GAAG,aAAa;AACxB,eAAS,GAAG,QAAQ;cACb,OAAO;AACd,oBAAc,yBAAyB,UAAU,MAAM;AACvD;;;AAIJ,QAAI,OAAO;AACT,SAAI,MAAM,KAAK,WAAW,IAAI,CAAE;AAChC,SAAI,QAAQ,SAAU,OAAM,KAAK;MAAE,KAAK;MAAU,OAAO,QAAQ;MAAG,CAAC;eAC5D,QAAQ;AACjB,kBAAa;AACb,YAAO,MAAM,MAAM,SAAS;;;YAGxB;AACR,OAAI;AACF,WAAO,WAAW;WACZ;;;AAKZ,QAAO;;;;;;AAOT,SAAgB,gBACd,UACA,WAAW,wBACI;AACf,KAAI;AACF,MAAI,GAAG,SAAS,SAAS,CAAC,OAAO,SAAU,QAAO;AAClD,SAAO,GAAG,aAAa,UAAU,QAAQ;SACnC;AACN,SAAO;;;;;;;AAQX,SAAgB,aAAa,UAAiC;AAC5D,KAAI;AACF,MAAI,GAAG,SAAS,SAAS,CAAC,OAAA,SAA+B;AACvD,aAAU,wCAAwC,WAAW;AAC7D,UAAO;;AAET,SAAO,GAAG,aAAa,UAAU,QAAQ;UAClC,OAAO;AACd,gBAAc,gBAAgB,UAAU,MAAM;AAC9C,SAAO;;;;;;AAOX,SAAgB,aAAa,UAAkB,OAA8B;AAC3E,KAAI;EACF,MAAM,KAAK,GAAG,SAAS,UAAU,IAAI;AACrC,MAAI;GACF,MAAM,SAAS,OAAO,MAAM,MAAM;GAClC,MAAM,OAAO,GAAG,SAAS,IAAI,QAAQ,GAAG,OAAO,EAAE;AACjD,UAAO,OAAO,SAAS,SAAS,GAAG,KAAK;YAChC;AACR,MAAG,UAAU,GAAG;;SAEZ;AACN,SAAO"}

package/dist/{ci-install-BGlijoTo.js → ci-install-nc1IKuX2.js}

@@ -1,9 +1,9 @@
 import { n as ErrorCodes, t as emitWizardError } from "./emit-BqLCdV8Y.js";
-import "./errors-DhFeR8Sp.js";
-import { n as runWizardCI, r as API_KEY_HINT, t as runWizardHeadless } from "./runners-Cvnk9BcA.js";
-import { t as consoleLog } from "./console-log-DJiTqYT2.js";
-import { t as config } from "./posthog-integration-CpinLWNO.js";
-import { n as provisionNewAccount } from "./provisioning-D-AM_7DG.js";
+import "./errors-BXlWujEw.js";
+import { n as runWizardCI, r as API_KEY_HINT, t as runWizardHeadless } from "./runners-B_84kPyf.js";
+import { t as consoleLog } from "./console-log-BMhBoX-o.js";
+import { t as config } from "./posthog-integration-mIQGBc1f.js";
+import { n as provisionNewAccount } from "./provisioning-CHUjae9V.js";
 //#region src/cli/commands/basic-integration/ci-install.ts
 /**
 * CI-mode install entry point (`--ci`, dev/test builds). Thin shell over the
@@ -114,4 +114,4 @@ async function provisionForSignup(options) {
 //#endregion
 export { runCIInstall, runHeadlessInstall };
 
-//# sourceMappingURL=ci-install-BGlijoTo.js.map
+//# sourceMappingURL=ci-install-nc1IKuX2.js.map

package/dist/{ci-install-BGlijoTo.js.map → ci-install-nc1IKuX2.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ci-install-BGlijoTo.js","names":["posthogIntegrationConfig"],"sources":["../src/cli/commands/basic-integration/ci-install.ts"],"sourcesContent":["import type { Arguments } from 'yargs';\nimport { consoleLog } from '@shared/console-log';\nimport { API_KEY_HINT, runWizardCI, runWizardHeadless } from '@cli/runners';\nimport type { NonInteractiveMode } from '@headless';\nimport { provisionNewAccount } from '@utils/provisioning';\nimport { config as posthogIntegrationConfig } from '@programs/posthog-integration';\nimport { ErrorCodes, type ErrorCode } from '@shared/errors';\nimport { emitWizardError } from '@shared/errors';\n\ntype Options = Arguments & {\n  region?: string;\n  baseUrl?: string;\n  installDir?: string;\n  apiKey?: string;\n  signup?: boolean;\n  email?: string;\n  name?: string;\n  projectId?: string;\n};\n\n/**\n * CI-mode install entry point (`--ci`, dev/test builds). Thin shell over the\n * shared non-interactive install — see `runNonInteractiveInstall`.\n */\nexport function runCIInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'ci');\n}\n\n/**\n * Headless install entry point (the experimental published-build run path; see\n * @shared/headless-mode). Thin shell over the shared non-interactive install.\n * Today it behaves exactly like `runCIInstall`; it is a separate function so\n * headless can diverge later (auth, prompts, …) without touching the CI path.\n */\nexport function runHeadlessInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'headless');\n}\n\n/**\n * Non-interactive install shared by CI and headless. Validates signup flags,\n * optionally provisions an account, then installs. `mode` only changes\n * user-facing labels and which runner is invoked; the accepted keys and the\n * install itself are identical (see runNonInteractive).\n */\nfunction runNonInteractiveInstall(\n  argv: Arguments,\n  mode: NonInteractiveMode,\n): void {\n  const options = { ...argv } as Options;\n  const headless = mode === 'headless';\n  const label = headless ? 'Headless' : 'CI';\n  const runWizard = headless ? runWizardHeadless : runWizardCI;\n\n  // Base validation (region/install-dir/api-key) is owned by the runner.\n  // This layer only adds the signup branch on top.\n  if (!options.apiKey && !options.signup) {\n    return failCI(\n      `${label} mode requires --api-key (${API_KEY_HINT}). ` +\n        'To create a new account instead, use --signup --email you@example.com.',\n      ErrorCodes.ArgsMissingApiKey,\n    );\n  }\n  if (!options.apiKey && options.signup && !options.email) {\n    return failCI(\n      `${label} --signup requires --email to create a new account.`,\n      ErrorCodes.ArgsMissingEmail,\n    );\n  }\n  warnOnUnexpectedKeyPrefix(options.apiKey);\n\n  void (async () => {\n    if (!options.apiKey && options.signup) {\n      // Fail before the irreversible provisioning step rather than after it.\n      if (!options.installDir) {\n        return failCI(\n          `${label} mode requires --install-dir (directory to install in)`,\n          ErrorCodes.ArgsMissingInstallDir,\n        );\n      }\n      const provisioned = await provisionForSignup(options);\n      options.apiKey = provisioned.personalApiKey;\n      if (options.projectId == null) options.projectId = provisioned.projectId;\n    }\n    runWizard(posthogIntegrationConfig, options);\n  })().catch((error: unknown) => {\n    emitWizardError({\n      code: ErrorCodes.ArgsSignupProvisionFailed,\n      message: error instanceof Error ? error.message : String(error),\n    });\n    process.exit(1);\n  });\n}\n\nfunction failCI(message: string, code?: ErrorCode): void {\n  consoleLog.intro('PostHog Wizard');\n  consoleLog.log.error(message);\n  if (code) emitWizardError({ code, message });\n  process.exit(1);\n}\n\n/**\n * Decide whether to warn about an unexpected `--api-key` prefix, and with what\n * message. Returns `null` when the key is acceptable.\n *\n * CI and headless accept the same two credentials: a personal API key (`phx_`)\n * and a `pha_` OAuth access token minted under the wizard's own OAuth\n * application (cloud runs, and the CI bot). Both authenticate the mint the\n * same way. Anything else is unexpected and warns.\n *\n * Extracted as a pure predicate so it can be unit-tested without a UI.\n */\nexport function keyPrefixWarning(apiKey: string | undefined): string | null {\n  if (!apiKey || apiKey.startsWith('phx_') || apiKey.startsWith('pha_')) {\n    return null;\n  }\n  const hint = apiKey.startsWith('phc_')\n    ? ' (phc_ is a project/client key; expected a personal API key or a wizard-app token)'\n    : '';\n  return `--api-key does not start with \"phx_\" or \"pha_\"${hint}. Continuing anyway, but the LLM Gateway may reject it with a 401.`;\n}\n\nfunction warnOnUnexpectedKeyPrefix(apiKey: string | undefined): void {\n  const message = keyPrefixWarning(apiKey);\n  if (!message) return;\n  consoleLog.intro('PostHog Wizard');\n  consoleLog.log.warn(message);\n}\n\n/**\n * Provision a new account and return its credentials. Throws on any failure\n * (after logging a user-facing message); the caller's `.catch` turns that\n * into a non-zero exit. The return type carries no failure sentinel.\n */\nasync function provisionForSignup(\n  options: Options,\n): Promise<{ personalApiKey: string; projectId: string }> {\n  consoleLog.intro('PostHog Wizard');\n  const signupRegion = ((options.region as string) || 'us').toUpperCase() as\n    | 'US'\n    | 'EU';\n  consoleLog.log.info(\n    `Provisioning new PostHog account for ${String(\n      options.email,\n    )} in ${signupRegion}...`,\n  );\n\n  let result;\n  try {\n    result = await provisionNewAccount(\n      options.email as string,\n      options.name ?? '',\n      signupRegion,\n      { baseUrl: options.baseUrl },\n    );\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    consoleLog.log.error(`Provisioning failed: ${msg}`);\n    throw error;\n  }\n\n  if (!result.personalApiKey) {\n    consoleLog.log.error(\n      'Provisioning succeeded but no personal API key was returned — cannot continue install.',\n    );\n    throw new Error('provisioning returned no personal API key');\n  }\n\n  consoleLog.log.success('Account ready.');\n  consoleLog.log.info(`  Project API Key:  ${result.projectApiKey}`);\n  consoleLog.log.info(`  Personal API Key: ${result.personalApiKey}`);\n  consoleLog.log.info(`  Host:             ${result.host}`);\n  return {\n    personalApiKey: result.personalApiKey,\n    projectId: result.projectId,\n  };\n}\n"],"mappings":";;;;;;;;;;;AAwBA,SAAgB,aAAa,MAAuB;AAClD,0BAAyB,MAAM,KAAK;;;;;;;;AAStC,SAAgB,mBAAmB,MAAuB;AACxD,0BAAyB,MAAM,WAAW;;;;;;;;AAS5C,SAAS,yBACP,MACA,MACM;CACN,MAAM,UAAU,EAAE,GAAG,MAAM;CAC3B,MAAM,WAAW,SAAS;CAC1B,MAAM,QAAQ,WAAW,aAAa;CACtC,MAAM,YAAY,WAAW,oBAAoB;AAIjD,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,OAC9B,QAAO,OACL,GAAG,MAAM,4BAA4B,aAAa,4EAElD,WAAW,kBACZ;AAEH,KAAI,CAAC,QAAQ,UAAU,QAAQ,UAAU,CAAC,QAAQ,MAChD,QAAO,OACL,GAAG,MAAM,sDACT,WAAW,iBACZ;AAEH,2BAA0B,QAAQ,OAAO;AAEzC,EAAM,YAAY;AAChB,MAAI,CAAC,QAAQ,UAAU,QAAQ,QAAQ;AAErC,OAAI,CAAC,QAAQ,WACX,QAAO,OACL,GAAG,MAAM,yDACT,WAAW,sBACZ;GAEH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,WAAQ,SAAS,YAAY;AAC7B,OAAI,QAAQ,aAAa,KAAM,SAAQ,YAAY,YAAY;;AAEjE,YAAUA,QAA0B,QAAQ;KAC1C,CAAC,OAAO,UAAmB;AAC7B,kBAAgB;GACd,MAAM,WAAW;GACjB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAChE,CAAC;AACF,UAAQ,KAAK,EAAE;GACf;;AAGJ,SAAS,OAAO,SAAiB,MAAwB;AACvD,YAAW,MAAM,iBAAiB;AAClC,YAAW,IAAI,MAAM,QAAQ;AAC7B,KAAI,KAAM,iBAAgB;EAAE;EAAM;EAAS,CAAC;AAC5C,SAAQ,KAAK,EAAE;;;;;;;;;;;;;AAcjB,SAAgB,iBAAiB,QAA2C;AAC1E,KAAI,CAAC,UAAU,OAAO,WAAW,OAAO,IAAI,OAAO,WAAW,OAAO,CACnE,QAAO;AAKT,QAAO,iDAHM,OAAO,WAAW,OAAO,GAClC,uFACA,GACyD;;AAG/D,SAAS,0BAA0B,QAAkC;CACnE,MAAM,UAAU,iBAAiB,OAAO;AACxC,KAAI,CAAC,QAAS;AACd,YAAW,MAAM,iBAAiB;AAClC,YAAW,IAAI,KAAK,QAAQ;;;;;;;AAQ9B,eAAe,mBACb,SACwD;AACxD,YAAW,MAAM,iBAAiB;CAClC,MAAM,gBAAiB,QAAQ,UAAqB,MAAM,aAAa;AAGvE,YAAW,IAAI,KACb,wCAAwC,OACtC,QAAQ,MACT,CAAC,MAAM,aAAa,KACtB;CAED,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,oBACb,QAAQ,OACR,QAAQ,QAAQ,IAChB,cACA,EAAE,SAAS,QAAQ,SAAS,CAC7B;UACM,OAAO;EACd,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAClE,aAAW,IAAI,MAAM,wBAAwB,MAAM;AACnD,QAAM;;AAGR,KAAI,CAAC,OAAO,gBAAgB;AAC1B,aAAW,IAAI,MACb,yFACD;AACD,QAAM,IAAI,MAAM,4CAA4C;;AAG9D,YAAW,IAAI,QAAQ,iBAAiB;AACxC,YAAW,IAAI,KAAK,uBAAuB,OAAO,gBAAgB;AAClE,YAAW,IAAI,KAAK,uBAAuB,OAAO,iBAAiB;AACnE,YAAW,IAAI,KAAK,uBAAuB,OAAO,OAAO;AACzD,QAAO;EACL,gBAAgB,OAAO;EACvB,WAAW,OAAO;EACnB"}
+{"version":3,"file":"ci-install-nc1IKuX2.js","names":["posthogIntegrationConfig"],"sources":["../src/cli/commands/basic-integration/ci-install.ts"],"sourcesContent":["import type { Arguments } from 'yargs';\nimport { consoleLog } from '@shared/console-log';\nimport { API_KEY_HINT, runWizardCI, runWizardHeadless } from '@cli/runners';\nimport type { NonInteractiveMode } from '@headless';\nimport { provisionNewAccount } from '@utils/provisioning';\nimport { config as posthogIntegrationConfig } from '@programs/posthog-integration';\nimport { ErrorCodes, type ErrorCode } from '@shared/errors';\nimport { emitWizardError } from '@shared/errors';\n\ntype Options = Arguments & {\n  region?: string;\n  baseUrl?: string;\n  installDir?: string;\n  apiKey?: string;\n  signup?: boolean;\n  email?: string;\n  name?: string;\n  projectId?: string;\n};\n\n/**\n * CI-mode install entry point (`--ci`, dev/test builds). Thin shell over the\n * shared non-interactive install — see `runNonInteractiveInstall`.\n */\nexport function runCIInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'ci');\n}\n\n/**\n * Headless install entry point (the experimental published-build run path; see\n * @shared/headless-mode). Thin shell over the shared non-interactive install.\n * Today it behaves exactly like `runCIInstall`; it is a separate function so\n * headless can diverge later (auth, prompts, …) without touching the CI path.\n */\nexport function runHeadlessInstall(argv: Arguments): void {\n  runNonInteractiveInstall(argv, 'headless');\n}\n\n/**\n * Non-interactive install shared by CI and headless. Validates signup flags,\n * optionally provisions an account, then installs. `mode` only changes\n * user-facing labels and which runner is invoked; the accepted keys and the\n * install itself are identical (see runNonInteractive).\n */\nfunction runNonInteractiveInstall(\n  argv: Arguments,\n  mode: NonInteractiveMode,\n): void {\n  const options = { ...argv } as Options;\n  const headless = mode === 'headless';\n  const label = headless ? 'Headless' : 'CI';\n  const runWizard = headless ? runWizardHeadless : runWizardCI;\n\n  // Base validation (region/install-dir/api-key) is owned by the runner.\n  // This layer only adds the signup branch on top.\n  if (!options.apiKey && !options.signup) {\n    return failCI(\n      `${label} mode requires --api-key (${API_KEY_HINT}). ` +\n        'To create a new account instead, use --signup --email you@example.com.',\n      ErrorCodes.ArgsMissingApiKey,\n    );\n  }\n  if (!options.apiKey && options.signup && !options.email) {\n    return failCI(\n      `${label} --signup requires --email to create a new account.`,\n      ErrorCodes.ArgsMissingEmail,\n    );\n  }\n  warnOnUnexpectedKeyPrefix(options.apiKey);\n\n  void (async () => {\n    if (!options.apiKey && options.signup) {\n      // Fail before the irreversible provisioning step rather than after it.\n      if (!options.installDir) {\n        return failCI(\n          `${label} mode requires --install-dir (directory to install in)`,\n          ErrorCodes.ArgsMissingInstallDir,\n        );\n      }\n      const provisioned = await provisionForSignup(options);\n      options.apiKey = provisioned.personalApiKey;\n      if (options.projectId == null) options.projectId = provisioned.projectId;\n    }\n    runWizard(posthogIntegrationConfig, options);\n  })().catch((error: unknown) => {\n    emitWizardError({\n      code: ErrorCodes.ArgsSignupProvisionFailed,\n      message: error instanceof Error ? error.message : String(error),\n    });\n    process.exit(1);\n  });\n}\n\nfunction failCI(message: string, code?: ErrorCode): void {\n  consoleLog.intro('PostHog Wizard');\n  consoleLog.log.error(message);\n  if (code) emitWizardError({ code, message });\n  process.exit(1);\n}\n\n/**\n * Decide whether to warn about an unexpected `--api-key` prefix, and with what\n * message. Returns `null` when the key is acceptable.\n *\n * CI and headless accept the same two credentials: a personal API key (`phx_`)\n * and a `pha_` OAuth access token minted under the wizard's own OAuth\n * application (cloud runs, and the CI bot). Both authenticate the mint the\n * same way. Anything else is unexpected and warns.\n *\n * Extracted as a pure predicate so it can be unit-tested without a UI.\n */\nexport function keyPrefixWarning(apiKey: string | undefined): string | null {\n  if (!apiKey || apiKey.startsWith('phx_') || apiKey.startsWith('pha_')) {\n    return null;\n  }\n  const hint = apiKey.startsWith('phc_')\n    ? ' (phc_ is a project/client key; expected a personal API key or a wizard-app token)'\n    : '';\n  return `--api-key does not start with \"phx_\" or \"pha_\"${hint}. Continuing anyway, but the LLM Gateway may reject it with a 401.`;\n}\n\nfunction warnOnUnexpectedKeyPrefix(apiKey: string | undefined): void {\n  const message = keyPrefixWarning(apiKey);\n  if (!message) return;\n  consoleLog.intro('PostHog Wizard');\n  consoleLog.log.warn(message);\n}\n\n/**\n * Provision a new account and return its credentials. Throws on any failure\n * (after logging a user-facing message); the caller's `.catch` turns that\n * into a non-zero exit. The return type carries no failure sentinel.\n */\nasync function provisionForSignup(\n  options: Options,\n): Promise<{ personalApiKey: string; projectId: string }> {\n  consoleLog.intro('PostHog Wizard');\n  const signupRegion = ((options.region as string) || 'us').toUpperCase() as\n    | 'US'\n    | 'EU';\n  consoleLog.log.info(\n    `Provisioning new PostHog account for ${String(\n      options.email,\n    )} in ${signupRegion}...`,\n  );\n\n  let result;\n  try {\n    result = await provisionNewAccount(\n      options.email as string,\n      options.name ?? '',\n      signupRegion,\n      { baseUrl: options.baseUrl },\n    );\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    consoleLog.log.error(`Provisioning failed: ${msg}`);\n    throw error;\n  }\n\n  if (!result.personalApiKey) {\n    consoleLog.log.error(\n      'Provisioning succeeded but no personal API key was returned — cannot continue install.',\n    );\n    throw new Error('provisioning returned no personal API key');\n  }\n\n  consoleLog.log.success('Account ready.');\n  consoleLog.log.info(`  Project API Key:  ${result.projectApiKey}`);\n  consoleLog.log.info(`  Personal API Key: ${result.personalApiKey}`);\n  consoleLog.log.info(`  Host:             ${result.host}`);\n  return {\n    personalApiKey: result.personalApiKey,\n    projectId: result.projectId,\n  };\n}\n"],"mappings":";;;;;;;;;;;AAwBA,SAAgB,aAAa,MAAuB;AAClD,0BAAyB,MAAM,KAAK;;;;;;;;AAStC,SAAgB,mBAAmB,MAAuB;AACxD,0BAAyB,MAAM,WAAW;;;;;;;;AAS5C,SAAS,yBACP,MACA,MACM;CACN,MAAM,UAAU,EAAE,GAAG,MAAM;CAC3B,MAAM,WAAW,SAAS;CAC1B,MAAM,QAAQ,WAAW,aAAa;CACtC,MAAM,YAAY,WAAW,oBAAoB;AAIjD,KAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,OAC9B,QAAO,OACL,GAAG,MAAM,4BAA4B,aAAa,4EAElD,WAAW,kBACZ;AAEH,KAAI,CAAC,QAAQ,UAAU,QAAQ,UAAU,CAAC,QAAQ,MAChD,QAAO,OACL,GAAG,MAAM,sDACT,WAAW,iBACZ;AAEH,2BAA0B,QAAQ,OAAO;AAEzC,EAAM,YAAY;AAChB,MAAI,CAAC,QAAQ,UAAU,QAAQ,QAAQ;AAErC,OAAI,CAAC,QAAQ,WACX,QAAO,OACL,GAAG,MAAM,yDACT,WAAW,sBACZ;GAEH,MAAM,cAAc,MAAM,mBAAmB,QAAQ;AACrD,WAAQ,SAAS,YAAY;AAC7B,OAAI,QAAQ,aAAa,KAAM,SAAQ,YAAY,YAAY;;AAEjE,YAAUA,QAA0B,QAAQ;KAC1C,CAAC,OAAO,UAAmB;AAC7B,kBAAgB;GACd,MAAM,WAAW;GACjB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAChE,CAAC;AACF,UAAQ,KAAK,EAAE;GACf;;AAGJ,SAAS,OAAO,SAAiB,MAAwB;AACvD,YAAW,MAAM,iBAAiB;AAClC,YAAW,IAAI,MAAM,QAAQ;AAC7B,KAAI,KAAM,iBAAgB;EAAE;EAAM;EAAS,CAAC;AAC5C,SAAQ,KAAK,EAAE;;;;;;;;;;;;;AAcjB,SAAgB,iBAAiB,QAA2C;AAC1E,KAAI,CAAC,UAAU,OAAO,WAAW,OAAO,IAAI,OAAO,WAAW,OAAO,CACnE,QAAO;AAKT,QAAO,iDAHM,OAAO,WAAW,OAAO,GAClC,uFACA,GACyD;;AAG/D,SAAS,0BAA0B,QAAkC;CACnE,MAAM,UAAU,iBAAiB,OAAO;AACxC,KAAI,CAAC,QAAS;AACd,YAAW,MAAM,iBAAiB;AAClC,YAAW,IAAI,KAAK,QAAQ;;;;;;;AAQ9B,eAAe,mBACb,SACwD;AACxD,YAAW,MAAM,iBAAiB;CAClC,MAAM,gBAAiB,QAAQ,UAAqB,MAAM,aAAa;AAGvE,YAAW,IAAI,KACb,wCAAwC,OACtC,QAAQ,MACT,CAAC,MAAM,aAAa,KACtB;CAED,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,oBACb,QAAQ,OACR,QAAQ,QAAQ,IAChB,cACA,EAAE,SAAS,QAAQ,SAAS,CAC7B;UACM,OAAO;EACd,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAClE,aAAW,IAAI,MAAM,wBAAwB,MAAM;AACnD,QAAM;;AAGR,KAAI,CAAC,OAAO,gBAAgB;AAC1B,aAAW,IAAI,MACb,yFACD;AACD,QAAM,IAAI,MAAM,4CAA4C;;AAG9D,YAAW,IAAI,QAAQ,iBAAiB;AACxC,YAAW,IAAI,KAAK,uBAAuB,OAAO,gBAAgB;AAClE,YAAW,IAAI,KAAK,uBAAuB,OAAO,iBAAiB;AACnE,YAAW,IAAI,KAAK,uBAAuB,OAAO,OAAO;AACzD,QAAO;EACL,gBAAgB,OAAO;EACvB,WAAW,OAAO;EACnB"}

package/dist/{console-log-DJiTqYT2.js → console-log-BMhBoX-o.js}

@@ -1,5 +1,5 @@
 import { t as emitWizardError } from "./emit-BqLCdV8Y.js";
-import { n as sanitizeErrorDetail } from "./errors-DhFeR8Sp.js";
+import { n as sanitizeErrorDetail } from "./errors-BXlWujEw.js";
 //#region src/shared/console-log.ts
 /** Console output with the wizard's glyphs, for commands and runs that print instead of drawing screens. */
 /** The printer every console command and headless's log lines share. */
@@ -29,4 +29,4 @@ function printAbortOutro(outro, report) {
 //#endregion
 export { printAbortOutro as n, consoleLog as t };
 
-//# sourceMappingURL=console-log-DJiTqYT2.js.map
+//# sourceMappingURL=console-log-BMhBoX-o.js.map

package/dist/{console-log-DJiTqYT2.js.map → console-log-BMhBoX-o.js.map}

@@ -1 +1 @@
-{"version":3,"file":"console-log-DJiTqYT2.js","names":[],"sources":["../src/shared/console-log.ts"],"sourcesContent":["/* eslint-disable no-console */\n/** Console output with the wizard's glyphs, for commands and runs that print instead of drawing screens. */\nimport { emitWizardError, sanitizeErrorDetail } from './errors';\nimport type { ErrorCode } from './errors';\nimport type { OutroData } from './outro';\n\n/** Where a console command prints: an intro and outro line, and one line per log call. */\nexport type ConsoleLog = {\n  intro(message: string): void;\n  outro(message: string): void;\n  log: {\n    info(message: string): void;\n    warn(message: string): void;\n    error(message: string): void;\n    success(message: string): void;\n    step(message: string): void;\n  };\n};\n\n/** The printer every console command and headless's log lines share. */\nexport const consoleLog: ConsoleLog = {\n  intro: (message) => console.log(`┌  ${message}`),\n  outro: (message) => console.log(`└  ${message}`),\n  log: {\n    info: (message) => console.log(`│  ${message}`),\n    warn: (message) => console.log(`▲  ${message}`),\n    error: (message) => console.log(`✖  ${message}`),\n    success: (message) => console.log(`✔  ${message}`),\n    step: (message) => console.log(`◇  ${message}`),\n  },\n};\n\n/** An abort's outro as console lines, then the machine-readable error line when it has a code. Resolves at once. */\nexport function printAbortOutro(\n  outro: OutroData,\n  report: {\n    code?: ErrorCode;\n    message: string;\n    detail?: Record<string, unknown>;\n  },\n): Promise<void> {\n  console.log(`✖  ${outro.message ?? 'Wizard aborted'}`);\n  if (outro.body) console.log(`│  ${outro.body}`);\n  if (outro.docsUrl) console.log(`│  Docs: ${outro.docsUrl}`);\n  if (report.code) {\n    emitWizardError({\n      code: report.code,\n      message: outro.message ?? report.message,\n      detail: sanitizeErrorDetail(outro.errorDetail ?? report.detail),\n    });\n  }\n  return Promise.resolve();\n}\n"],"mappings":";;;;;AAoBA,MAAa,aAAyB;CACpC,QAAQ,YAAY,QAAQ,IAAI,MAAM,UAAU;CAChD,QAAQ,YAAY,QAAQ,IAAI,MAAM,UAAU;CAChD,KAAK;EACH,OAAO,YAAY,QAAQ,IAAI,MAAM,UAAU;EAC/C,OAAO,YAAY,QAAQ,IAAI,MAAM,UAAU;EAC/C,QAAQ,YAAY,QAAQ,IAAI,MAAM,UAAU;EAChD,UAAU,YAAY,QAAQ,IAAI,MAAM,UAAU;EAClD,OAAO,YAAY,QAAQ,IAAI,MAAM,UAAU;EAChD;CACF;;AAGD,SAAgB,gBACd,OACA,QAKe;AACf,SAAQ,IAAI,MAAM,MAAM,WAAW,mBAAmB;AACtD,KAAI,MAAM,KAAM,SAAQ,IAAI,MAAM,MAAM,OAAO;AAC/C,KAAI,MAAM,QAAS,SAAQ,IAAI,YAAY,MAAM,UAAU;AAC3D,KAAI,OAAO,KACT,iBAAgB;EACd,MAAM,OAAO;EACb,SAAS,MAAM,WAAW,OAAO;EACjC,QAAQ,oBAAoB,MAAM,eAAe,OAAO,OAAO;EAChE,CAAC;AAEJ,QAAO,QAAQ,SAAS"}
+{"version":3,"file":"console-log-BMhBoX-o.js","names":[],"sources":["../src/shared/console-log.ts"],"sourcesContent":["/* eslint-disable no-console */\n/** Console output with the wizard's glyphs, for commands and runs that print instead of drawing screens. */\nimport { emitWizardError, sanitizeErrorDetail } from './errors';\nimport type { ErrorCode } from './errors';\nimport type { OutroData } from './outro';\n\n/** Where a console command prints: an intro and outro line, and one line per log call. */\nexport type ConsoleLog = {\n  intro(message: string): void;\n  outro(message: string): void;\n  log: {\n    info(message: string): void;\n    warn(message: string): void;\n    error(message: string): void;\n    success(message: string): void;\n    step(message: string): void;\n  };\n};\n\n/** The printer every console command and headless's log lines share. */\nexport const consoleLog: ConsoleLog = {\n  intro: (message) => console.log(`┌  ${message}`),\n  outro: (message) => console.log(`└  ${message}`),\n  log: {\n    info: (message) => console.log(`│  ${message}`),\n    warn: (message) => console.log(`▲  ${message}`),\n    error: (message) => console.log(`✖  ${message}`),\n    success: (message) => console.log(`✔  ${message}`),\n    step: (message) => console.log(`◇  ${message}`),\n  },\n};\n\n/** An abort's outro as console lines, then the machine-readable error line when it has a code. Resolves at once. */\nexport function printAbortOutro(\n  outro: OutroData,\n  report: {\n    code?: ErrorCode;\n    message: string;\n    detail?: Record<string, unknown>;\n  },\n): Promise<void> {\n  console.log(`✖  ${outro.message ?? 'Wizard aborted'}`);\n  if (outro.body) console.log(`│  ${outro.body}`);\n  if (outro.docsUrl) console.log(`│  Docs: ${outro.docsUrl}`);\n  if (report.code) {\n    emitWizardError({\n      code: report.code,\n      message: outro.message ?? report.message,\n      detail: sanitizeErrorDetail(outro.errorDetail ?? report.detail),\n    });\n  }\n  return Promise.resolve();\n}\n"],"mappings":";;;;;AAoBA,MAAa,aAAyB;CACpC,QAAQ,YAAY,QAAQ,IAAI,MAAM,UAAU;CAChD,QAAQ,YAAY,QAAQ,IAAI,MAAM,UAAU;CAChD,KAAK;EACH,OAAO,YAAY,QAAQ,IAAI,MAAM,UAAU;EAC/C,OAAO,YAAY,QAAQ,IAAI,MAAM,UAAU;EAC/C,QAAQ,YAAY,QAAQ,IAAI,MAAM,UAAU;EAChD,UAAU,YAAY,QAAQ,IAAI,MAAM,UAAU;EAClD,OAAO,YAAY,QAAQ,IAAI,MAAM,UAAU;EAChD;CACF;;AAGD,SAAgB,gBACd,OACA,QAKe;AACf,SAAQ,IAAI,MAAM,MAAM,WAAW,mBAAmB;AACtD,KAAI,MAAM,KAAM,SAAQ,IAAI,MAAM,MAAM,OAAO;AAC/C,KAAI,MAAM,QAAS,SAAQ,IAAI,YAAY,MAAM,UAAU;AAC3D,KAAI,OAAO,KACT,iBAAgB;EACd,MAAM,OAAO;EACb,SAAS,MAAM,WAAW,OAAO;EACjC,QAAQ,oBAAoB,MAAM,eAAe,OAAO,OAAO;EAChE,CAAC;AAEJ,QAAO,QAAQ,SAAS"}

package/dist/{debug-BvEbemym.js → debug-BfO_Txo8.js}

@@ -41,7 +41,7 @@ const TASK_RUN_ID = runtimeEnv("POSTHOG_TASK_RUN_ID") || void 0;
 const TASK_ID = runtimeEnv("POSTHOG_TASK_ID") || void 0;
 //#endregion
 //#region src/shared/version.ts
-const VERSION = "2.82.0";
+const VERSION = "2.84.0";
 //#endregion
 //#region src/shared/utils/paths.ts
 const TMP = process.platform === "win32" ? tmpdir() : "/tmp";
@@ -95,7 +95,7 @@ let reportedLogFailure = false;
 function reportLogFailureOnce(err) {
 	if (reportedLogFailure) return;
 	reportedLogFailure = true;
-	import("./analytics-DGDr6-iD.js").then(({ analytics }) => analytics.captureException(err instanceof Error ? err : new Error(String(err)), {
+	import("./analytics-Ix9HEra3.js").then(({ analytics }) => analytics.captureException(err instanceof Error ? err : new Error(String(err)), {
 		source: "log-file-write",
 		log_path: logFilePath,
 		platform: process.platform
@@ -134,4 +134,4 @@ function logToFile(...args) {
 //#endregion
 export { TASK_RUN_ID as _, initLogFile as a, WIZARD_LOG_FILE as c, relativeToInstallDir as d, VERSION as f, TASK_ID as g, RUN_SURFACE as h, getLogFilePath as i, WIZARD_TASK_STREAM_FILE as l, NODE_ENV as m, configureLogFileFromEnvironment as n, logToFile as o, HEADLESS_FLAG as p, formatLogLine as r, WIZARD_BENCHMARK_FILE as s, configureLogFile as t, WIZARD_YARA_REPORT_FILE as u, runtimeEnv as v };
 
-//# sourceMappingURL=debug-BvEbemym.js.map
+//# sourceMappingURL=debug-BfO_Txo8.js.map

package/dist/debug-BfO_Txo8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-BfO_Txo8.js","names":["join","sep"],"sources":["../src/env.ts","../src/shared/version.ts","../src/shared/utils/paths.ts","../src/shared/utils/debug.ts"],"sourcesContent":["/**\n * Central environment variable access for the PostHog wizard.\n *\n * ── Build-time constants ────────────────────────────────────────────\n * Inlined by tsdown's `env` option at compile time. After build, the\n * runtime value of these env vars has zero effect on the wizard.\n *\n * ── Runtime variables ───────────────────────────────────────────────\n * Read through `runtimeEnv()` with a typed allowlist. This makes every\n * runtime dependency on the environment explicit and grep-able.\n *\n * ── Direct process.env access ───────────────────────────────────────\n * Reserved for subprocess environment configuration (writes) and\n * vendored code. Production source outside those cases should use\n * this module instead.\n */\n\n/**\n * The on-CLI flag name. Intentionally ugly + undocumented; do not surface it in\n * `--help`, the README, or user-facing error messages.\n */\nexport const HEADLESS_FLAG = 'headless-DONOTUSE-EXPERIMENTAL';\n\n// ── Build-time constants ─────────────────────────────────────────────\n// tsdown replaces `process.env.NODE_ENV` with a string literal.\n// After build these are just `\"production\"`, `false`, etc.\n\nexport const NODE_ENV = process.env.NODE_ENV as string;\nexport const IS_DEV =\n  process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test';\n\n/**\n * True only in published/production builds. tsdown inlines\n * `process.env.NODE_ENV` as the literal `\"production\"` at build time, so this\n * collapses to `true` in `dist/` and stays `false` for `tsx`/dev/test runs\n * (where NODE_ENV is unset, `development`, or `test`). Used to gate features\n * that aren't supported in the shipped package — e.g. `--ci` mode.\n */\nexport const IS_PRODUCTION_BUILD = process.env.NODE_ENV === 'production';\n\n/** 'cloud' when launched with the experimental headless flag, else 'local' — resolved once from argv at launch. */\nexport const RUN_SURFACE: 'cloud' | 'local' = process.argv.some(\n  (a) => a === `--${HEADLESS_FLAG}` || a.startsWith(`--${HEADLESS_FLAG}=`),\n)\n  ? 'cloud'\n  : 'local';\n\n// ── Runtime environment ──────────────────────────────────────────────\n\n/**\n * Exhaustive allowlist of env vars the wizard reads at runtime.\n * Add new keys here when a new runtime dependency is needed.\n */\ntype RuntimeEnvKey =\n  // CI-build-only flag overrides (see utils/ci-flag-overrides.ts).\n  // Deliberately NOT POSTHOG_WIZARD_-prefixed: yargs .env('POSTHOG_WIZARD')\n  // would claim it as an unknown CLI option and strict-reject the run.\n  | 'WIZARD_CI_FLAG_OVERRIDES'\n  | 'WIZARD_CI_EXCLUDE_TASKS'\n  | 'WIZARD_CI_GATEWAY_TOKEN_FILE'\n  | 'WIZARD_CI_GATEWAY_URL'\n  // Wizard CLI configuration (yargs POSTHOG_WIZARD_ prefix)\n  | 'POSTHOG_WIZARD_BENCHMARK_CONFIG'\n  | 'POSTHOG_WIZARD_BENCHMARK_FILE'\n  | 'POSTHOG_WIZARD_LOG_DIR'\n  | 'POSTHOG_WIZARD_DEBUG'\n  // Identity of the PostHog task run whose sandbox launched this wizard. Set by\n  // the sandbox for every run it starts, agent or wizard. Deliberately NOT\n  // POSTHOG_WIZARD_-prefixed, for the same reason as the two keys above:\n  // yargs .env('POSTHOG_WIZARD') would claim them as CLI options and\n  // .strictOptions() would reject the run unless the wizard also declared them,\n  // which would tie every sandbox deploy to an npm release of this package.\n  | 'POSTHOG_WIZARD_RUN_ID'\n  | 'POSTHOG_TASK_RUN_ID'\n  | 'POSTHOG_TASK_ID'\n  | 'POSTHOG_HANDOFF_OUTPUT_PATH'\n  // Local/CI escape hatch to disable Warlock scanning without the PostHog flag.\n  | 'POSTHOG_WIZARD_WARLOCK_DISABLED'\n  // Dev-build override of the Decisions judgment service's mode: off, shadow or primary.\n  | 'WIZARD_DECISIONS_DETECTION'\n  | 'DEBUG'\n  // Agent / MCP\n  | 'MCP_URL'\n  | 'POSTHOG_API_KEY'\n  // Platform: terminal detection\n  | 'TERM'\n  | 'TERM_PROGRAM'\n  | 'TERMINAL_EMULATOR'\n  | 'CI'\n  | 'WT_SESSION'\n  | 'TERMINUS_SUBLIME'\n  | 'ConEmuTask'\n  // Platform: paths\n  | 'APPDATA'\n  | 'OPENCODE_CONFIG_DIR'\n  | 'XDG_CONFIG_HOME';\n\n/** Read a runtime environment variable. Only allowlisted keys compile. */\nexport function runtimeEnv(key: RuntimeEnvKey): string | undefined {\n  return process.env[key];\n}\n\n/**\n * The PostHog task run that launched this wizard, when one did. A cloud run's\n * sandbox exports both ids into the wizard's environment; every local run\n * leaves them undefined. Resolved once at launch, like RUN_SURFACE above.\n */\nexport const TASK_RUN_ID: string | undefined =\n  runtimeEnv('POSTHOG_TASK_RUN_ID') || undefined;\nexport const TASK_ID: string | undefined =\n  runtimeEnv('POSTHOG_TASK_ID') || undefined;\n","// Auto-generated by scripts/generate-version.js — do not edit\nexport const VERSION = '2.84.0';\n","import { tmpdir } from 'node:os';\nimport { join, sep } from 'node:path';\n\n// /tmp is stable and discoverable on macOS/Linux; Windows needs os.tmpdir()\nconst TMP = process.platform === 'win32' ? tmpdir() : '/tmp';\n\nexport const WIZARD_LOG_FILE = join(TMP, 'posthog-wizard.log');\nexport const WIZARD_BENCHMARK_FILE = join(TMP, 'posthog-wizard-benchmark.json');\n/** Default target of `--task-stream-log`. Dev builds only. */\nexport const WIZARD_TASK_STREAM_FILE = join(\n  TMP,\n  'posthog-wizard-task-stream.jsonl',\n);\nexport const WIZARD_YARA_REPORT_FILE = join(\n  TMP,\n  'posthog-wizard-yara-report.json',\n);\n/**\n * Strip an absolute installDir prefix off a project file path so the UI\n * renders `index.js:12` instead of `/Users/.../index.js:12`. Defends\n * against false matches like `/Users/foo` ⊂ `/Users/foobar/x.js` by\n * normalizing to a trailing path separator before the prefix check.\n */\nexport function relativeToInstallDir(file: string, installDir: string): string {\n  const prefix = installDir.endsWith(sep) ? installDir : installDir + sep;\n  return file.startsWith(prefix) ? file.slice(prefix.length) : file;\n}\n","import { appendFileSync, mkdirSync } from 'fs';\nimport path from 'path';\nimport { inspect } from 'node:util';\nimport { IS_DEV, runtimeEnv } from '@env';\nimport { WIZARD_LOG_FILE } from './paths';\n\n// Dev builds may redirect the log so concurrent runs don't interleave one file.\nlet logFilePath =\n  (IS_DEV && process.env.POSTHOG_WIZARD_LOG_FILE) || WIZARD_LOG_FILE;\nlet fileLoggingEnabled = true;\n// An explicit --log-file wins over every later path change while pinned.\nlet logFilePinned = false;\n\nfunction stringify(value: unknown): string {\n  if (typeof value === 'string') return value;\n  if (value instanceof Error) return value.stack ?? String(value);\n  try {\n    // JSON.stringify throws on cycles and skips some values — fall back to\n    // inspect so a crash log line is never dropped.\n    return JSON.stringify(value, null, 2) ?? inspect(value, { depth: 3 });\n  } catch {\n    return inspect(value, { depth: 3 });\n  }\n}\n\n/** One log line from `logToFile`-style arguments: strings as they are, errors as their stack, the rest as JSON. */\nexport function formatLogLine(...args: readonly unknown[]): string {\n  return args.map(stringify).join(' ');\n}\n\nexport function getLogFilePath(): string {\n  return logFilePath;\n}\n\nexport function configureLogFile(opts: {\n  path?: string;\n  enabled?: boolean;\n  pin?: boolean;\n}): void {\n  if (opts.pin === false) logFilePinned = false;\n  if (opts.path !== undefined && !logFilePinned) {\n    logFilePath = opts.path;\n    ensuredLogDir = false;\n  }\n  if (opts.pin === true) logFilePinned = true;\n  if (opts.enabled !== undefined) fileLoggingEnabled = opts.enabled;\n}\n\nlet ensuredLogDir = false;\nlet reportedLogFailure = false;\n\n// Failed log writes go to error tracking, once per process. Dynamic import:\n// analytics logs through this module, so a static import would be a cycle.\nfunction reportLogFailureOnce(err: unknown): void {\n  if (reportedLogFailure) return;\n  reportedLogFailure = true;\n  void import('./analytics')\n    .then(({ analytics }) =>\n      analytics.captureException(\n        err instanceof Error ? err : new Error(String(err)),\n        {\n          source: 'log-file-write',\n          log_path: logFilePath,\n          platform: process.platform,\n        },\n      ),\n    )\n    .catch(() => {\n      // Reporting must never crash the wizard either.\n    });\n}\n\n// The log's directory isn't guaranteed to exist (Windows %TEMP%,\n// POSTHOG_WIZARD_LOG_DIR) — create it on first failure.\nfunction appendLine(text: string): void {\n  try {\n    appendFileSync(logFilePath, text);\n  } catch (err) {\n    if (ensuredLogDir) {\n      reportLogFailureOnce(err);\n      return;\n    }\n    ensuredLogDir = true;\n    try {\n      mkdirSync(path.dirname(logFilePath), { recursive: true });\n      appendFileSync(logFilePath, text);\n    } catch (retryErr) {\n      reportLogFailureOnce(retryErr);\n    }\n  }\n}\n\nexport function configureLogFileFromEnvironment(): void {\n  const dir = runtimeEnv('POSTHOG_WIZARD_LOG_DIR');\n  if (dir) {\n    configureLogFile({ path: path.join(dir, 'posthog-wizard.log') });\n  }\n}\n\nexport function initLogFile(): void {\n  if (!fileLoggingEnabled) return;\n  const divider = '='.repeat(60);\n  appendLine(\n    `\\n${divider}\\nPostHog Wizard Run: ${new Date().toISOString()}\\n${divider}\\n`,\n  );\n}\n\nexport function logToFile(...args: unknown[]): void {\n  if (!fileLoggingEnabled) return;\n  const ts = new Date().toISOString();\n  appendLine(`[${ts}] ${formatLogLine(...args)}\\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,gBAAgB;AAM7B,MAAa,WAAA;;AAcb,MAAa,cAAiC,QAAQ,KAAK,MACxD,MAAM,MAAM,sCAAwB,EAAE,WAAW,oCAAsB,CACzE,GACG,UACA;;AAqDJ,SAAgB,WAAW,KAAwC;AACjE,QAAO,QAAQ,IAAI;;;;;;;AAQrB,MAAa,cACX,WAAW,sBAAsB,IAAI,KAAA;AACvC,MAAa,UACX,WAAW,kBAAkB,IAAI,KAAA;;;AC7GnC,MAAa,UAAU;;;ACGvB,MAAM,MAAM,QAAQ,aAAa,UAAU,QAAQ,GAAG;AAEtD,MAAa,kBAAkBA,OAAK,KAAK,qBAAqB;AAC9D,MAAa,wBAAwBA,OAAK,KAAK,gCAAgC;;AAE/E,MAAa,0BAA0BA,OACrC,KACA,mCACD;AACD,MAAa,0BAA0BA,OACrC,KACA,kCACD;;;;;;;AAOD,SAAgB,qBAAqB,MAAc,YAA4B;CAC7E,MAAM,SAAS,WAAW,SAASC,MAAI,GAAG,aAAa,aAAaA;AACpE,QAAO,KAAK,WAAW,OAAO,GAAG,KAAK,MAAM,OAAO,OAAO,GAAG;;;;AClB/D,IAAI,cACiD;AACrD,IAAI,qBAAqB;AAEzB,IAAI,gBAAgB;AAEpB,SAAS,UAAU,OAAwB;AACzC,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,iBAAiB,MAAO,QAAO,MAAM,SAAS,OAAO,MAAM;AAC/D,KAAI;AAGF,SAAO,KAAK,UAAU,OAAO,MAAM,EAAE,IAAI,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;SAC/D;AACN,SAAO,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;;;;AAKvC,SAAgB,cAAc,GAAG,MAAkC;AACjE,QAAO,KAAK,IAAI,UAAU,CAAC,KAAK,IAAI;;AAGtC,SAAgB,iBAAyB;AACvC,QAAO;;AAGT,SAAgB,iBAAiB,MAIxB;AACP,KAAI,KAAK,QAAQ,MAAO,iBAAgB;AACxC,KAAI,KAAK,SAAS,KAAA,KAAa,CAAC,eAAe;AAC7C,gBAAc,KAAK;AACnB,kBAAgB;;AAElB,KAAI,KAAK,QAAQ,KAAM,iBAAgB;AACvC,KAAI,KAAK,YAAY,KAAA,EAAW,sBAAqB,KAAK;;AAG5D,IAAI,gBAAgB;AACpB,IAAI,qBAAqB;AAIzB,SAAS,qBAAqB,KAAoB;AAChD,KAAI,mBAAoB;AACxB,sBAAqB;AAChB,QAAO,2BACT,MAAM,EAAE,gBACP,UAAU,iBACR,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC,EACnD;EACE,QAAQ;EACR,UAAU;EACV,UAAU,QAAQ;EACnB,CACF,CACF,CACA,YAAY,GAEX;;AAKN,SAAS,WAAW,MAAoB;AACtC,KAAI;AACF,iBAAe,aAAa,KAAK;UAC1B,KAAK;AACZ,MAAI,eAAe;AACjB,wBAAqB,IAAI;AACzB;;AAEF,kBAAgB;AAChB,MAAI;AACF,aAAU,KAAK,QAAQ,YAAY,EAAE,EAAE,WAAW,MAAM,CAAC;AACzD,kBAAe,aAAa,KAAK;WAC1B,UAAU;AACjB,wBAAqB,SAAS;;;;AAKpC,SAAgB,kCAAwC;CACtD,MAAM,MAAM,WAAW,yBAAyB;AAChD,KAAI,IACF,kBAAiB,EAAE,MAAM,KAAK,KAAK,KAAK,qBAAqB,EAAE,CAAC;;AAIpE,SAAgB,cAAoB;AAClC,KAAI,CAAC,mBAAoB;CACzB,MAAM,UAAU,IAAI,OAAO,GAAG;AAC9B,YACE,KAAK,QAAQ,yCAAwB,IAAI,MAAM,EAAC,aAAa,CAAC,IAAI,QAAQ,IAC3E;;AAGH,SAAgB,UAAU,GAAG,MAAuB;AAClD,KAAI,CAAC,mBAAoB;AAEzB,YAAW,qBADA,IAAI,MAAM,EAAC,aAAa,CACjB,IAAI,cAAc,GAAG,KAAK,CAAC,IAAI"}

package/dist/{defaults-DDVl3tKN.js → defaults-BWLIffh5.js}

@@ -257,4 +257,4 @@ const getDefaultServerConfig = (apiKey, selectedFeatures, local) => {
 //#endregion
 export { getNativeHTTPServerConfig as a, getDefaultServerConfig as i, AVAILABLE_FEATURES as n, isAllFeaturesSelected as o, buildMCPUrl as r, ALL_FEATURE_VALUES as t };
 
-//# sourceMappingURL=defaults-DDVl3tKN.js.map
+//# sourceMappingURL=defaults-BWLIffh5.js.map

package/dist/{defaults-DDVl3tKN.js.map → defaults-BWLIffh5.js.map}

@@ -1 +1 @@
-{"version":3,"file":"defaults-DDVl3tKN.js","names":["z"],"sources":["../src/shared/mcp-clients/defaults.ts"],"sourcesContent":["import z from 'zod';\n\nexport const DefaultMCPClientConfig = z\n  .object({\n    mcpServers: z.record(\n      z.string(),\n      z.union([\n        z.object({\n          command: z.string().optional(),\n          args: z.array(z.string()).optional(),\n          env: z.record(z.string(), z.string()).optional(),\n        }),\n        z.object({\n          url: z.string(),\n          headers: z.record(z.string(), z.string()).optional(),\n        }),\n      ]),\n    ),\n  })\n  .passthrough();\n\nexport const AVAILABLE_FEATURES = {\n  'Data & Analytics': [\n    {\n      value: 'dashboards',\n      label: 'Dashboards',\n      hint: 'Dashboard creation and management',\n    },\n    {\n      value: 'insights',\n      label: 'Insights',\n      hint: 'Analytics insights',\n    },\n    {\n      value: 'product_analytics',\n      label: 'Product Analytics',\n      hint: 'Insight CRUD management',\n    },\n    {\n      value: 'experiments',\n      label: 'Experiments',\n      hint: 'A/B testing experiments',\n    },\n    {\n      value: 'surveys',\n      label: 'Surveys',\n      hint: 'Survey management',\n    },\n    {\n      value: 'annotations',\n      label: 'Annotations',\n      hint: 'Annotation management',\n    },\n    {\n      value: 'replay',\n      label: 'Session Replay',\n      hint: 'Session recording management',\n    },\n    {\n      value: 'sql',\n      label: 'SQL',\n      hint: 'SQL query execution',\n    },\n    {\n      value: 'web_analytics',\n      label: 'Web Analytics',\n      hint: 'Web analytics queries and digests',\n    },\n    {\n      value: 'customer_analytics',\n      label: 'Usage metrics',\n      hint: 'Customer usage metric tracking',\n    },\n    {\n      value: 'signals',\n      label: 'Signals',\n      hint: 'Signal reports and source configs',\n    },\n  ],\n  'AI Engineering': [\n    {\n      value: 'llm_analytics',\n      label: 'AI Observability',\n      hint: 'LLM usage and cost tracking',\n    },\n  ],\n  'Development Tools': [\n    {\n      value: 'error_tracking',\n      label: 'Error Tracking',\n      hint: 'Error monitoring and debugging',\n    },\n    {\n      value: 'logs',\n      label: 'Logs',\n      hint: 'Log querying',\n    },\n    {\n      value: 'flags',\n      label: 'Feature Flags',\n      hint: 'Feature flag management',\n    },\n    {\n      value: 'early_access_features',\n      label: 'Early Access Features',\n      hint: 'Early access feature management',\n    },\n    {\n      value: 'cohorts',\n      label: 'Cohorts',\n      hint: 'Cohort management',\n    },\n    {\n      value: 'sdk_doctor',\n      label: 'SDK Doctor',\n      hint: 'SDK health diagnostics',\n    },\n    {\n      value: 'tracing',\n      label: 'APM Tracing',\n      hint: 'Distributed trace and span queries',\n    },\n  ],\n  'Data Management': [\n    {\n      value: 'events',\n      label: 'Events',\n      hint: 'Event and property definitions',\n    },\n    {\n      value: 'persons',\n      label: 'Persons',\n      hint: 'Person and group management',\n    },\n    {\n      value: 'actions',\n      label: 'Actions',\n      hint: 'Action definitions',\n    },\n    {\n      value: 'data_warehouse',\n      label: 'Data Warehouse',\n      hint: 'Data warehouse management',\n    },\n    {\n      value: 'endpoints',\n      label: 'Endpoints',\n      hint: 'Data warehouse endpoint management',\n    },\n    {\n      value: 'data_schema',\n      label: 'Data Schema',\n      hint: 'Data schema exploration',\n    },\n    {\n      value: 'batch_exports',\n      label: 'Batch Exports',\n      hint: 'Scheduled data exports',\n    },\n  ],\n  'CDP & Automation': [\n    {\n      value: 'hog_functions',\n      label: 'Hog Functions',\n      hint: 'CDP function management',\n    },\n    {\n      value: 'hog_function_templates',\n      label: 'Hog Function Templates',\n      hint: 'CDP function template browsing',\n    },\n    {\n      value: 'workflows',\n      label: 'Workflows',\n      hint: 'Workflow management',\n    },\n  ],\n  'Platform & Management': [\n    {\n      value: 'workspace',\n      label: 'Workspace',\n      hint: 'Organization and project management',\n    },\n    {\n      value: 'docs',\n      label: 'Documentation',\n      hint: 'PostHog documentation search',\n    },\n    {\n      value: 'notebooks',\n      label: 'Notebooks',\n      hint: 'Notebook management',\n    },\n    {\n      value: 'alerts',\n      label: 'Alerts',\n      hint: 'Alert management',\n    },\n    {\n      value: 'platform_features',\n      label: 'Platform Features',\n      hint: 'Activity logs, approvals, comments, and roles',\n    },\n    {\n      value: 'integrations',\n      label: 'Integrations',\n      hint: 'Connected integration management',\n    },\n    {\n      value: 'conversations',\n      label: 'Conversations',\n      hint: 'Support ticket management',\n    },\n    {\n      value: 'core',\n      label: 'Subscriptions',\n      hint: 'Scheduled insight and dashboard deliveries',\n    },\n    {\n      value: 'search',\n      label: 'Search',\n      hint: 'Entity search across the project',\n    },\n    {\n      value: 'reverse_proxy',\n      label: 'Reverse Proxy',\n      hint: 'Reverse proxy record management',\n    },\n    {\n      value: 'debug',\n      label: 'Debug',\n      hint: 'Debug and diagnostic tools',\n    },\n  ],\n};\n\nexport const ALL_FEATURE_VALUES = Object.values(AVAILABLE_FEATURES)\n  .flat()\n  .map((feature) => feature.value);\n\nexport const isAllFeaturesSelected = (features: string[]): boolean =>\n  features.length === ALL_FEATURE_VALUES.length &&\n  ALL_FEATURE_VALUES.every((feature) => features.includes(feature));\n\nexport const buildMCPUrl = (selectedFeatures?: string[], local?: boolean) => {\n  const host = local ? 'http://localhost:8787' : 'https://mcp.posthog.com';\n  const baseUrl = `${host}/mcp`;\n\n  const params: string[] = [];\n\n  // Add features param if not all features selected\n  if (\n    selectedFeatures &&\n    selectedFeatures.length > 0 &&\n    !isAllFeaturesSelected(selectedFeatures)\n  ) {\n    params.push(`features=${selectedFeatures.join(',')}`);\n  }\n\n  return params.length > 0 ? `${baseUrl}?${params.join('&')}` : baseUrl;\n};\n\nexport const getNativeHTTPServerConfig = (\n  apiKey: string | undefined,\n  selectedFeatures?: string[],\n  local?: boolean,\n) => {\n  const config: Record<string, unknown> = {\n    url: buildMCPUrl(selectedFeatures, local),\n  };\n\n  // Only add auth header if API key is provided (not OAuth mode)\n  if (apiKey) {\n    config.headers = {\n      Authorization: `Bearer ${apiKey}`,\n    };\n  }\n\n  return config;\n};\n\nexport const getDefaultServerConfig = (\n  apiKey: string | undefined,\n  selectedFeatures?: string[],\n  local?: boolean,\n) => {\n  const urlWithFeatures = buildMCPUrl(selectedFeatures, local);\n\n  // OAuth mode: no auth header, let MCP handle OAuth\n  if (!apiKey) {\n    return {\n      command: 'npx',\n      args: ['-y', 'mcp-remote@latest', urlWithFeatures],\n    };\n  }\n\n  // API key mode: include auth header\n  return {\n    command: 'npx',\n    args: [\n      '-y',\n      'mcp-remote@latest',\n      urlWithFeatures,\n      '--header',\n      `Authorization:\\${POSTHOG_AUTH_HEADER}`,\n    ],\n    env: {\n      POSTHOG_AUTH_HEADER: `Bearer ${apiKey}`,\n    },\n  };\n};\n"],"mappings":";AAEsCA,IACnC,OAAO,EACN,YAAYA,IAAE,OACZA,IAAE,QAAQ,EACVA,IAAE,MAAM,CACNA,IAAE,OAAO;CACP,SAASA,IAAE,QAAQ,CAAC,UAAU;CAC9B,MAAMA,IAAE,MAAMA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACpC,KAAKA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACjD,CAAC,EACFA,IAAE,OAAO;CACP,KAAKA,IAAE,QAAQ;CACf,SAASA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,CAAC,CACH,CAAC,CACH,EACF,CAAC,CACD,aAAa;AAEhB,MAAa,qBAAqB;CAChC,oBAAoB;EAClB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,kBAAkB,CAChB;EACE,OAAO;EACP,OAAO;EACP,MAAM;EACP,CACF;CACD,qBAAqB;EACnB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,mBAAmB;EACjB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,oBAAoB;EAClB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,yBAAyB;EACvB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACF;AAED,MAAa,qBAAqB,OAAO,OAAO,mBAAmB,CAChE,MAAM,CACN,KAAK,YAAY,QAAQ,MAAM;AAElC,MAAa,yBAAyB,aACpC,SAAS,WAAW,mBAAmB,UACvC,mBAAmB,OAAO,YAAY,SAAS,SAAS,QAAQ,CAAC;AAEnE,MAAa,eAAe,kBAA6B,UAAoB;CAE3E,MAAM,UAAU,GADH,QAAQ,0BAA0B,0BACvB;CAExB,MAAM,SAAmB,EAAE;AAG3B,KACE,oBACA,iBAAiB,SAAS,KAC1B,CAAC,sBAAsB,iBAAiB,CAExC,QAAO,KAAK,YAAY,iBAAiB,KAAK,IAAI,GAAG;AAGvD,QAAO,OAAO,SAAS,IAAI,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,KAAK;;AAGhE,MAAa,6BACX,QACA,kBACA,UACG;CACH,MAAM,SAAkC,EACtC,KAAK,YAAY,kBAAkB,MAAM,EAC1C;AAGD,KAAI,OACF,QAAO,UAAU,EACf,eAAe,UAAU,UAC1B;AAGH,QAAO;;AAGT,MAAa,0BACX,QACA,kBACA,UACG;CACH,MAAM,kBAAkB,YAAY,kBAAkB,MAAM;AAG5D,KAAI,CAAC,OACH,QAAO;EACL,SAAS;EACT,MAAM;GAAC;GAAM;GAAqB;GAAgB;EACnD;AAIH,QAAO;EACL,SAAS;EACT,MAAM;GACJ;GACA;GACA;GACA;GACA;GACD;EACD,KAAK,EACH,qBAAqB,UAAU,UAChC;EACF"}
+{"version":3,"file":"defaults-BWLIffh5.js","names":["z"],"sources":["../src/shared/mcp-clients/defaults.ts"],"sourcesContent":["import z from 'zod';\n\nexport const DefaultMCPClientConfig = z\n  .object({\n    mcpServers: z.record(\n      z.string(),\n      z.union([\n        z.object({\n          command: z.string().optional(),\n          args: z.array(z.string()).optional(),\n          env: z.record(z.string(), z.string()).optional(),\n        }),\n        z.object({\n          url: z.string(),\n          headers: z.record(z.string(), z.string()).optional(),\n        }),\n      ]),\n    ),\n  })\n  .passthrough();\n\nexport const AVAILABLE_FEATURES = {\n  'Data & Analytics': [\n    {\n      value: 'dashboards',\n      label: 'Dashboards',\n      hint: 'Dashboard creation and management',\n    },\n    {\n      value: 'insights',\n      label: 'Insights',\n      hint: 'Analytics insights',\n    },\n    {\n      value: 'product_analytics',\n      label: 'Product Analytics',\n      hint: 'Insight CRUD management',\n    },\n    {\n      value: 'experiments',\n      label: 'Experiments',\n      hint: 'A/B testing experiments',\n    },\n    {\n      value: 'surveys',\n      label: 'Surveys',\n      hint: 'Survey management',\n    },\n    {\n      value: 'annotations',\n      label: 'Annotations',\n      hint: 'Annotation management',\n    },\n    {\n      value: 'replay',\n      label: 'Session Replay',\n      hint: 'Session recording management',\n    },\n    {\n      value: 'sql',\n      label: 'SQL',\n      hint: 'SQL query execution',\n    },\n    {\n      value: 'web_analytics',\n      label: 'Web Analytics',\n      hint: 'Web analytics queries and digests',\n    },\n    {\n      value: 'customer_analytics',\n      label: 'Usage metrics',\n      hint: 'Customer usage metric tracking',\n    },\n    {\n      value: 'signals',\n      label: 'Signals',\n      hint: 'Signal reports and source configs',\n    },\n  ],\n  'AI Engineering': [\n    {\n      value: 'llm_analytics',\n      label: 'AI Observability',\n      hint: 'LLM usage and cost tracking',\n    },\n  ],\n  'Development Tools': [\n    {\n      value: 'error_tracking',\n      label: 'Error Tracking',\n      hint: 'Error monitoring and debugging',\n    },\n    {\n      value: 'logs',\n      label: 'Logs',\n      hint: 'Log querying',\n    },\n    {\n      value: 'flags',\n      label: 'Feature Flags',\n      hint: 'Feature flag management',\n    },\n    {\n      value: 'early_access_features',\n      label: 'Early Access Features',\n      hint: 'Early access feature management',\n    },\n    {\n      value: 'cohorts',\n      label: 'Cohorts',\n      hint: 'Cohort management',\n    },\n    {\n      value: 'sdk_doctor',\n      label: 'SDK Doctor',\n      hint: 'SDK health diagnostics',\n    },\n    {\n      value: 'tracing',\n      label: 'APM Tracing',\n      hint: 'Distributed trace and span queries',\n    },\n  ],\n  'Data Management': [\n    {\n      value: 'events',\n      label: 'Events',\n      hint: 'Event and property definitions',\n    },\n    {\n      value: 'persons',\n      label: 'Persons',\n      hint: 'Person and group management',\n    },\n    {\n      value: 'actions',\n      label: 'Actions',\n      hint: 'Action definitions',\n    },\n    {\n      value: 'data_warehouse',\n      label: 'Data Warehouse',\n      hint: 'Data warehouse management',\n    },\n    {\n      value: 'endpoints',\n      label: 'Endpoints',\n      hint: 'Data warehouse endpoint management',\n    },\n    {\n      value: 'data_schema',\n      label: 'Data Schema',\n      hint: 'Data schema exploration',\n    },\n    {\n      value: 'batch_exports',\n      label: 'Batch Exports',\n      hint: 'Scheduled data exports',\n    },\n  ],\n  'CDP & Automation': [\n    {\n      value: 'hog_functions',\n      label: 'Hog Functions',\n      hint: 'CDP function management',\n    },\n    {\n      value: 'hog_function_templates',\n      label: 'Hog Function Templates',\n      hint: 'CDP function template browsing',\n    },\n    {\n      value: 'workflows',\n      label: 'Workflows',\n      hint: 'Workflow management',\n    },\n  ],\n  'Platform & Management': [\n    {\n      value: 'workspace',\n      label: 'Workspace',\n      hint: 'Organization and project management',\n    },\n    {\n      value: 'docs',\n      label: 'Documentation',\n      hint: 'PostHog documentation search',\n    },\n    {\n      value: 'notebooks',\n      label: 'Notebooks',\n      hint: 'Notebook management',\n    },\n    {\n      value: 'alerts',\n      label: 'Alerts',\n      hint: 'Alert management',\n    },\n    {\n      value: 'platform_features',\n      label: 'Platform Features',\n      hint: 'Activity logs, approvals, comments, and roles',\n    },\n    {\n      value: 'integrations',\n      label: 'Integrations',\n      hint: 'Connected integration management',\n    },\n    {\n      value: 'conversations',\n      label: 'Conversations',\n      hint: 'Support ticket management',\n    },\n    {\n      value: 'core',\n      label: 'Subscriptions',\n      hint: 'Scheduled insight and dashboard deliveries',\n    },\n    {\n      value: 'search',\n      label: 'Search',\n      hint: 'Entity search across the project',\n    },\n    {\n      value: 'reverse_proxy',\n      label: 'Reverse Proxy',\n      hint: 'Reverse proxy record management',\n    },\n    {\n      value: 'debug',\n      label: 'Debug',\n      hint: 'Debug and diagnostic tools',\n    },\n  ],\n};\n\nexport const ALL_FEATURE_VALUES = Object.values(AVAILABLE_FEATURES)\n  .flat()\n  .map((feature) => feature.value);\n\nexport const isAllFeaturesSelected = (features: string[]): boolean =>\n  features.length === ALL_FEATURE_VALUES.length &&\n  ALL_FEATURE_VALUES.every((feature) => features.includes(feature));\n\nexport const buildMCPUrl = (selectedFeatures?: string[], local?: boolean) => {\n  const host = local ? 'http://localhost:8787' : 'https://mcp.posthog.com';\n  const baseUrl = `${host}/mcp`;\n\n  const params: string[] = [];\n\n  // Add features param if not all features selected\n  if (\n    selectedFeatures &&\n    selectedFeatures.length > 0 &&\n    !isAllFeaturesSelected(selectedFeatures)\n  ) {\n    params.push(`features=${selectedFeatures.join(',')}`);\n  }\n\n  return params.length > 0 ? `${baseUrl}?${params.join('&')}` : baseUrl;\n};\n\nexport const getNativeHTTPServerConfig = (\n  apiKey: string | undefined,\n  selectedFeatures?: string[],\n  local?: boolean,\n) => {\n  const config: Record<string, unknown> = {\n    url: buildMCPUrl(selectedFeatures, local),\n  };\n\n  // Only add auth header if API key is provided (not OAuth mode)\n  if (apiKey) {\n    config.headers = {\n      Authorization: `Bearer ${apiKey}`,\n    };\n  }\n\n  return config;\n};\n\nexport const getDefaultServerConfig = (\n  apiKey: string | undefined,\n  selectedFeatures?: string[],\n  local?: boolean,\n) => {\n  const urlWithFeatures = buildMCPUrl(selectedFeatures, local);\n\n  // OAuth mode: no auth header, let MCP handle OAuth\n  if (!apiKey) {\n    return {\n      command: 'npx',\n      args: ['-y', 'mcp-remote@latest', urlWithFeatures],\n    };\n  }\n\n  // API key mode: include auth header\n  return {\n    command: 'npx',\n    args: [\n      '-y',\n      'mcp-remote@latest',\n      urlWithFeatures,\n      '--header',\n      `Authorization:\\${POSTHOG_AUTH_HEADER}`,\n    ],\n    env: {\n      POSTHOG_AUTH_HEADER: `Bearer ${apiKey}`,\n    },\n  };\n};\n"],"mappings":";AAEsCA,IACnC,OAAO,EACN,YAAYA,IAAE,OACZA,IAAE,QAAQ,EACVA,IAAE,MAAM,CACNA,IAAE,OAAO;CACP,SAASA,IAAE,QAAQ,CAAC,UAAU;CAC9B,MAAMA,IAAE,MAAMA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACpC,KAAKA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACjD,CAAC,EACFA,IAAE,OAAO;CACP,KAAKA,IAAE,QAAQ;CACf,SAASA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,CAAC,CACH,CAAC,CACH,EACF,CAAC,CACD,aAAa;AAEhB,MAAa,qBAAqB;CAChC,oBAAoB;EAClB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,kBAAkB,CAChB;EACE,OAAO;EACP,OAAO;EACP,MAAM;EACP,CACF;CACD,qBAAqB;EACnB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,mBAAmB;EACjB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,oBAAoB;EAClB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,yBAAyB;EACvB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACF;AAED,MAAa,qBAAqB,OAAO,OAAO,mBAAmB,CAChE,MAAM,CACN,KAAK,YAAY,QAAQ,MAAM;AAElC,MAAa,yBAAyB,aACpC,SAAS,WAAW,mBAAmB,UACvC,mBAAmB,OAAO,YAAY,SAAS,SAAS,QAAQ,CAAC;AAEnE,MAAa,eAAe,kBAA6B,UAAoB;CAE3E,MAAM,UAAU,GADH,QAAQ,0BAA0B,0BACvB;CAExB,MAAM,SAAmB,EAAE;AAG3B,KACE,oBACA,iBAAiB,SAAS,KAC1B,CAAC,sBAAsB,iBAAiB,CAExC,QAAO,KAAK,YAAY,iBAAiB,KAAK,IAAI,GAAG;AAGvD,QAAO,OAAO,SAAS,IAAI,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,KAAK;;AAGhE,MAAa,6BACX,QACA,kBACA,UACG;CACH,MAAM,SAAkC,EACtC,KAAK,YAAY,kBAAkB,MAAM,EAC1C;AAGD,KAAI,OACF,QAAO,UAAU,EACf,eAAe,UAAU,UAC1B;AAGH,QAAO;;AAGT,MAAa,0BACX,QACA,kBACA,UACG;CACH,MAAM,kBAAkB,YAAY,kBAAkB,MAAM;AAG5D,KAAI,CAAC,OACH,QAAO;EACL,SAAS;EACT,MAAM;GAAC;GAAM;GAAqB;GAAgB;EACnD;AAIH,QAAO;EACL,SAAS;EACT,MAAM;GACJ;GACA;GACA;GACA;GACA;GACD;EACD,KAAK,EACH,qBAAqB,UAAU,UAChC;EACF"}

package/dist/{errors-DhFeR8Sp.js → errors-BXlWujEw.js}

@@ -76,4 +76,4 @@ function classifyRunFailure(err) {
 //#endregion
 export { WizardError as a, classifyAuthFailure as i, sanitizeErrorDetail as n, skillErrorCode as r, classifyRunFailure as t };
 
-//# sourceMappingURL=errors-DhFeR8Sp.js.map
+//# sourceMappingURL=errors-BXlWujEw.js.map

package/dist/{errors-DhFeR8Sp.js.map → errors-BXlWujEw.js.map}

@@ -1 +1 @@
-{"version":3,"file":"errors-DhFeR8Sp.js","names":[],"sources":["../src/shared/errors/catalog.ts","../src/shared/errors/wizard-error.ts","../src/shared/errors/auth.ts","../src/shared/errors/skill-map.ts","../src/shared/errors/sanitize.ts","../src/shared/errors/run-failure.ts"],"sourcesContent":["import { ErrorCodes, type ErrorCode } from './codes';\nimport type { ErrorCatalogEntry } from './types';\n\nexport const ERROR_CATALOG: Record<ErrorCode, ErrorCatalogEntry> = {\n  [ErrorCodes.CliNodeVersion]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Node.js runtime is older than the required range.',\n  },\n  [ErrorCodes.CliBadArgs]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Unrecognized command or option.',\n  },\n  [ErrorCodes.CliFlagUnavailable]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'A dev-only flag or env var was passed to a published build.',\n  },\n  [ErrorCodes.CliInteractiveRequired]: {\n    group: 'cli',\n    retry: 'no',\n    description:\n      'The command requires an interactive terminal and has no non-interactive fallback.',\n  },\n  [ErrorCodes.ArgsMissingApiKey]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --api-key.',\n  },\n  [ErrorCodes.ArgsMissingInstallDir]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --install-dir.',\n  },\n  [ErrorCodes.ArgsMissingEmail]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Signup run without --email.',\n  },\n  [ErrorCodes.ArgsSignupProvisionFailed]: {\n    group: 'args',\n    retry: 'yes',\n    description: 'Account provisioning for --signup failed.',\n  },\n  [ErrorCodes.AuthKeyType]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The API key has the wrong type or prefix for this mode.',\n  },\n  [ErrorCodes.AuthInvalidOrExpired]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The credential was rejected by the LLM gateway or API.',\n  },\n  [ErrorCodes.AuthSessionExpired]: {\n    group: 'auth',\n    // Retryable, unlike its neighbours: a new run means a new login.\n    retry: 'yes',\n    description: 'The OAuth grant expired or was revoked mid-run.',\n  },\n  [ErrorCodes.AuthMissingScope]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The personal API key lacks a scope the run requires.',\n  },\n  [ErrorCodes.AuthRegionMismatch]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The resolved region does not match the credential.',\n  },\n  [ErrorCodes.AuthSettingsConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'A Claude settings file overrides the gateway credential.',\n  },\n  [ErrorCodes.AuthStoredLoginConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description:\n      'The agent SDK used a stored Claude login instead of the gateway token.',\n  },\n  [ErrorCodes.AuthProjectFetchFailed]: {\n    group: 'auth',\n    retry: 'yes',\n    description: 'Fetching user or project data from the PostHog API failed.',\n  },\n  [ErrorCodes.EnvLocalServicesDown]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'A local dev target service is not running.',\n  },\n  [ErrorCodes.EnvServiceOutage]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'Blocking external services are down.',\n  },\n  [ErrorCodes.DetectBadDirectory]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The install directory is missing, not a directory, or unreadable.',\n  },\n  [ErrorCodes.DetectNoFramework]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Framework auto-detection found no supported framework.',\n  },\n  [ErrorCodes.DetectUnsupportedVersion]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The detected framework version is below the supported minimum.',\n  },\n  [ErrorCodes.DetectUnsupportedPlatform]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project platform has no matching skill variant.',\n  },\n  [ErrorCodes.DetectNoPosthogSdk]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The program requires an installed PostHog SDK and none was found.',\n  },\n  [ErrorCodes.DetectNoProjectFiles]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no files for the program to work on.',\n  },\n  [ErrorCodes.DetectNoSources]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'No data warehouse sources were found.',\n  },\n  [ErrorCodes.DetectNoPackageJson]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no package.json for the program to scan.',\n  },\n  [ErrorCodes.DetectNoSdks]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'None of the SDKs the program needs are installed.',\n  },\n  [ErrorCodes.DetectMissingStripe]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Revenue analytics requires a Stripe SDK and none was found.',\n  },\n  [ErrorCodes.DetectUnclassified]: {\n    group: 'detect',\n    // A detect step reported a precondition failure we have no code for yet.\n    // Every known cause is a property of the user's project, so retrying can\n    // only burn budget — fail closed rather than inheriting `internal`'s 'yes'.\n    retry: 'no',\n    description: 'A detect step failed with a kind absent from the catalog.',\n  },\n  [ErrorCodes.SkillMenuFetchFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The context-mill skill menu could not be fetched.',\n  },\n  [ErrorCodes.SkillNotFound]: {\n    group: 'skill',\n    retry: 'no',\n    description: 'The skill id is absent from the context-mill menu.',\n  },\n  [ErrorCodes.SkillDownloadFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The skill download or extraction failed.',\n  },\n  [ErrorCodes.AgentAbort]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent emitted an [ABORT] signal with a reason.',\n  },\n  [ErrorCodes.AgenticDetectionTimeout]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent run exceeded its configured time limit.',\n  },\n  [ErrorCodes.AgentMcpMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not reach the PostHog MCP server.',\n  },\n  [ErrorCodes.AgentResourceMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not access a setup resource.',\n  },\n  [ErrorCodes.AgentRateLimit]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The LLM gateway rate-limited the run.',\n  },\n  [ErrorCodes.AgentApiError]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent hit an API error other than a rate limit.',\n  },\n  [ErrorCodes.AgentYaraViolation]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The security scanner terminated the run.',\n  },\n  [ErrorCodes.AgentNoProgress]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent ended without a single tool call.',\n  },\n  [ErrorCodes.AgentInvalidStructuredOutput]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The agent ended a schema-bound run without output matching the schema.',\n  },\n  [ErrorCodes.AgentIncompleteTasks]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent stopped with planned tasks still open.',\n  },\n  [ErrorCodes.AgentOrchestratorSkillVariantMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The orchestrator could not download a needed skill variant.',\n  },\n  [ErrorCodes.AgentOrchestratorTasksFailed]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The orchestrator queue drained with failed required tasks.',\n  },\n  [ErrorCodes.AgentOrchestratorTasksBlocked]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description:\n      'The orchestrator queue drained with no failed task but blocked ones that never ran.',\n  },\n  [ErrorCodes.AgentOrchestratorHollowRun]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The orchestrator drained with zero tasks — the seed step got no usable model output.',\n  },\n  [ErrorCodes.AgentOrchestratorSinkInvariant]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The orchestrator plan failed the sink coverage invariant.',\n  },\n  [ErrorCodes.GatewayMintRefused]: {\n    group: 'gateway',\n    // 429 clears with the daily window, 401 with a fresh login, 403 never.\n    retry: 'case-by-case',\n    description:\n      'The PostHog backend refused to mint a gateway token for this run.',\n  },\n  [ErrorCodes.GatewayMintFailed]: {\n    group: 'gateway',\n    retry: 'yes',\n    description:\n      'The PostHog backend could not mint a gateway token: unreachable, a 5xx, or an unusable response.',\n  },\n  [ErrorCodes.SettingsUnfixableConflict]: {\n    group: 'settings',\n    retry: 'no',\n    description:\n      'A Claude settings conflict cannot be neutralized automatically.',\n  },\n  [ErrorCodes.InternalUnhandled]: {\n    group: 'internal',\n    retry: 'yes',\n    description: 'An unexpected error escaped the pipeline.',\n  },\n};\n","import type { ErrorCode } from './codes';\n\n/**\n * Structured error data for analytics and the machine-readable error line.\n *\n * A data carrier: the agent returns it inside a failure and a host hands it\n * to `wizardAbort()`, which captures it. Never thrown by the wizard.\n */\nexport class WizardError extends Error {\n  readonly code?: ErrorCode;\n\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n    code?: ErrorCode,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n    this.code = code;\n  }\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\n\nexport interface AuthFailureInput {\n  hasSettingsConflict?: boolean;\n  usingManagedLogin?: boolean;\n  /** A pre-run token refresh already failed on a dead grant this run. */\n  sessionExpired?: boolean;\n  apiKey?: string;\n  missingScopes?: readonly string[];\n  gatewayRegion?: 'us' | 'eu' | 'local';\n  sessionRegion?: 'us' | 'eu';\n}\n\nexport function classifyAuthFailure(input: AuthFailureInput): ErrorCode {\n  // First: the only branch backed by a server verdict rather than inference.\n  // The token endpoint already told us the grant is dead, so every heuristic\n  // below would be guessing at a cause we know.\n  if (input.sessionExpired) return ErrorCodes.AuthSessionExpired;\n  if (input.usingManagedLogin) return ErrorCodes.AuthStoredLoginConflict;\n  if (input.hasSettingsConflict) return ErrorCodes.AuthSettingsConflict;\n  if (\n    input.apiKey &&\n    !input.apiKey.startsWith('phx_') &&\n    !input.apiKey.startsWith('pha_')\n  ) {\n    return ErrorCodes.AuthKeyType;\n  }\n  if (input.missingScopes && input.missingScopes.length > 0) {\n    return ErrorCodes.AuthMissingScope;\n  }\n  if (\n    input.gatewayRegion &&\n    input.sessionRegion &&\n    input.gatewayRegion !== 'local' &&\n    input.gatewayRegion !== input.sessionRegion\n  ) {\n    return ErrorCodes.AuthRegionMismatch;\n  }\n  return ErrorCodes.AuthInvalidOrExpired;\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\nimport type { InstallSkillResult } from '@shared/skill-install';\n\nconst SKILL_CODES: Record<\n  Exclude<InstallSkillResult['kind'], 'ok'>,\n  ErrorCode\n> = {\n  'menu-fetch-failed': ErrorCodes.SkillMenuFetchFailed,\n  'skill-not-found': ErrorCodes.SkillNotFound,\n  'download-failed': ErrorCodes.SkillDownloadFailed,\n};\n\nexport function skillErrorCode(result: InstallSkillResult): ErrorCode | null {\n  if (result.kind === 'ok') return null;\n  return SKILL_CODES[result.kind];\n}\n","const DETAIL_ALLOWLIST = ['reason', 'detected', 'platform'] as const;\n\nexport function sanitizeErrorDetail(\n  detail: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!detail) return undefined;\n  const safe: Record<string, unknown> = {};\n  for (const key of DETAIL_ALLOWLIST) {\n    if (detail[key] !== undefined) safe[key] = detail[key];\n  }\n  return Object.keys(safe).length > 0 ? safe : undefined;\n}\n","import { ErrorCodes, isErrorCode, type ErrorCode } from './codes';\n\nexport interface RunFailure {\n  code: ErrorCode;\n  message: string;\n  /** True when the error carried its own code: a decision, not a crash. */\n  coded: boolean;\n}\n\n/**\n * How a run's terminal error is reported. A coded WizardError (a mint refusal,\n * say) keeps its own message and code; anything else is unhandled and gets the\n * generic framing. Duck-typed on `code` so callers need not load wizard-abort.\n */\nexport function classifyRunFailure(err: unknown): RunFailure {\n  const message = err instanceof Error ? err.message : String(err);\n  const code =\n    err instanceof Error ? (err as { code?: unknown }).code : undefined;\n  if (typeof code === 'string' && isErrorCode(code)) {\n    return { code, message, coded: true };\n  }\n  return { code: ErrorCodes.InternalUnhandled, message, coded: false };\n}\n"],"mappings":";AAIG,WAAW,gBAKX,WAAW,YAKX,WAAW,oBAKX,WAAW,wBAMX,WAAW,mBAKX,WAAW,uBAKX,WAAW,kBAKX,WAAW,2BAKX,WAAW,aAKX,WAAW,sBAKX,WAAW,oBAMX,WAAW,kBAKX,WAAW,oBAKX,WAAW,sBAKX,WAAW,yBAMX,WAAW,wBAKX,WAAW,sBAKX,WAAW,kBAKX,WAAW,oBAMX,WAAW,mBAKX,WAAW,0BAMX,WAAW,2BAKX,WAAW,oBAMX,WAAW,sBAKX,WAAW,iBAKX,WAAW,qBAKX,WAAW,cAKX,WAAW,qBAKX,WAAW,oBAQX,WAAW,sBAKX,WAAW,eAKX,WAAW,qBAKX,WAAW,YAKX,WAAW,yBAKX,WAAW,iBAKX,WAAW,sBAKX,WAAW,gBAKX,WAAW,eAKX,WAAW,oBAKX,WAAW,iBAKX,WAAW,8BAMX,WAAW,sBAKX,WAAW,sCAKX,WAAW,8BAKX,WAAW,+BAMX,WAAW,4BAMX,WAAW,gCAKX,WAAW,oBAOX,WAAW,mBAMX,WAAW,2BAMX,WAAW;;;;;;;;;ACtQd,IAAa,cAAb,cAAiC,MAAM;CACrC;CAEA,YACE,SACA,SACA,MACA;AACA,QAAM,QAAQ;AAHE,OAAA,UAAA;AAIhB,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;ACLhB,SAAgB,oBAAoB,OAAoC;AAItE,KAAI,MAAM,eAAgB,QAAO,WAAW;AAC5C,KAAI,MAAM,kBAAmB,QAAO,WAAW;AAC/C,KAAI,MAAM,oBAAqB,QAAO,WAAW;AACjD,KACE,MAAM,UACN,CAAC,MAAM,OAAO,WAAW,OAAO,IAChC,CAAC,MAAM,OAAO,WAAW,OAAO,CAEhC,QAAO,WAAW;AAEpB,KAAI,MAAM,iBAAiB,MAAM,cAAc,SAAS,EACtD,QAAO,WAAW;AAEpB,KACE,MAAM,iBACN,MAAM,iBACN,MAAM,kBAAkB,WACxB,MAAM,kBAAkB,MAAM,cAE9B,QAAO,WAAW;AAEpB,QAAO,WAAW;;;;ACnCpB,MAAM,cAGF;CACF,qBAAqB,WAAW;CAChC,mBAAmB,WAAW;CAC9B,mBAAmB,WAAW;CAC/B;AAED,SAAgB,eAAe,QAA8C;AAC3E,KAAI,OAAO,SAAS,KAAM,QAAO;AACjC,QAAO,YAAY,OAAO;;;;ACd5B,MAAM,mBAAmB;CAAC;CAAU;CAAY;CAAW;AAE3D,SAAgB,oBACd,QACqC;AACrC,KAAI,CAAC,OAAQ,QAAO,KAAA;CACpB,MAAM,OAAgC,EAAE;AACxC,MAAK,MAAM,OAAO,iBAChB,KAAI,OAAO,SAAS,KAAA,EAAW,MAAK,OAAO,OAAO;AAEpD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,KAAA;;;;;;;;;ACI/C,SAAgB,mBAAmB,KAA0B;CAC3D,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;CAChE,MAAM,OACJ,eAAe,QAAS,IAA2B,OAAO,KAAA;AAC5D,KAAI,OAAO,SAAS,YAAY,YAAY,KAAK,CAC/C,QAAO;EAAE;EAAM;EAAS,OAAO;EAAM;AAEvC,QAAO;EAAE,MAAM,WAAW;EAAmB;EAAS,OAAO;EAAO"}
+{"version":3,"file":"errors-BXlWujEw.js","names":[],"sources":["../src/shared/errors/catalog.ts","../src/shared/errors/wizard-error.ts","../src/shared/errors/auth.ts","../src/shared/errors/skill-map.ts","../src/shared/errors/sanitize.ts","../src/shared/errors/run-failure.ts"],"sourcesContent":["import { ErrorCodes, type ErrorCode } from './codes';\nimport type { ErrorCatalogEntry } from './types';\n\nexport const ERROR_CATALOG: Record<ErrorCode, ErrorCatalogEntry> = {\n  [ErrorCodes.CliNodeVersion]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Node.js runtime is older than the required range.',\n  },\n  [ErrorCodes.CliBadArgs]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Unrecognized command or option.',\n  },\n  [ErrorCodes.CliFlagUnavailable]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'A dev-only flag or env var was passed to a published build.',\n  },\n  [ErrorCodes.CliInteractiveRequired]: {\n    group: 'cli',\n    retry: 'no',\n    description:\n      'The command requires an interactive terminal and has no non-interactive fallback.',\n  },\n  [ErrorCodes.ArgsMissingApiKey]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --api-key.',\n  },\n  [ErrorCodes.ArgsMissingInstallDir]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --install-dir.',\n  },\n  [ErrorCodes.ArgsMissingEmail]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Signup run without --email.',\n  },\n  [ErrorCodes.ArgsSignupProvisionFailed]: {\n    group: 'args',\n    retry: 'yes',\n    description: 'Account provisioning for --signup failed.',\n  },\n  [ErrorCodes.AuthKeyType]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The API key has the wrong type or prefix for this mode.',\n  },\n  [ErrorCodes.AuthInvalidOrExpired]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The credential was rejected by the LLM gateway or API.',\n  },\n  [ErrorCodes.AuthSessionExpired]: {\n    group: 'auth',\n    // Retryable, unlike its neighbours: a new run means a new login.\n    retry: 'yes',\n    description: 'The OAuth grant expired or was revoked mid-run.',\n  },\n  [ErrorCodes.AuthMissingScope]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The personal API key lacks a scope the run requires.',\n  },\n  [ErrorCodes.AuthRegionMismatch]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The resolved region does not match the credential.',\n  },\n  [ErrorCodes.AuthSettingsConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'A Claude settings file overrides the gateway credential.',\n  },\n  [ErrorCodes.AuthStoredLoginConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description:\n      'The agent SDK used a stored Claude login instead of the gateway token.',\n  },\n  [ErrorCodes.AuthProjectFetchFailed]: {\n    group: 'auth',\n    retry: 'yes',\n    description: 'Fetching user or project data from the PostHog API failed.',\n  },\n  [ErrorCodes.EnvLocalServicesDown]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'A local dev target service is not running.',\n  },\n  [ErrorCodes.EnvServiceOutage]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'Blocking external services are down.',\n  },\n  [ErrorCodes.DetectBadDirectory]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The install directory is missing, not a directory, or unreadable.',\n  },\n  [ErrorCodes.DetectNoFramework]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Framework auto-detection found no supported framework.',\n  },\n  [ErrorCodes.DetectUnsupportedVersion]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The detected framework version is below the supported minimum.',\n  },\n  [ErrorCodes.DetectUnsupportedPlatform]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project platform has no matching skill variant.',\n  },\n  [ErrorCodes.DetectNoPosthogSdk]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The program requires an installed PostHog SDK and none was found.',\n  },\n  [ErrorCodes.DetectNoProjectFiles]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no files for the program to work on.',\n  },\n  [ErrorCodes.DetectNoSources]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'No data warehouse sources were found.',\n  },\n  [ErrorCodes.DetectNoPackageJson]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no package.json for the program to scan.',\n  },\n  [ErrorCodes.DetectNoSdks]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'None of the SDKs the program needs are installed.',\n  },\n  [ErrorCodes.DetectMissingStripe]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Revenue analytics requires a Stripe SDK and none was found.',\n  },\n  [ErrorCodes.DetectUnclassified]: {\n    group: 'detect',\n    // A detect step reported a precondition failure we have no code for yet.\n    // Every known cause is a property of the user's project, so retrying can\n    // only burn budget — fail closed rather than inheriting `internal`'s 'yes'.\n    retry: 'no',\n    description: 'A detect step failed with a kind absent from the catalog.',\n  },\n  [ErrorCodes.SkillMenuFetchFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The context-mill skill menu could not be fetched.',\n  },\n  [ErrorCodes.SkillNotFound]: {\n    group: 'skill',\n    retry: 'no',\n    description: 'The skill id is absent from the context-mill menu.',\n  },\n  [ErrorCodes.SkillDownloadFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The skill download or extraction failed.',\n  },\n  [ErrorCodes.AgentAbort]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent emitted an [ABORT] signal with a reason.',\n  },\n  [ErrorCodes.AgenticDetectionTimeout]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent run exceeded its configured time limit.',\n  },\n  [ErrorCodes.AgentMcpMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not reach the PostHog MCP server.',\n  },\n  [ErrorCodes.AgentResourceMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not access a setup resource.',\n  },\n  [ErrorCodes.AgentRateLimit]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The LLM gateway rate-limited the run.',\n  },\n  [ErrorCodes.AgentApiError]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent hit an API error other than a rate limit.',\n  },\n  [ErrorCodes.AgentYaraViolation]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The security scanner terminated the run.',\n  },\n  [ErrorCodes.AgentNoProgress]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent ended without a single tool call.',\n  },\n  [ErrorCodes.AgentInvalidStructuredOutput]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The agent ended a schema-bound run without output matching the schema.',\n  },\n  [ErrorCodes.AgentIncompleteTasks]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent stopped with planned tasks still open.',\n  },\n  [ErrorCodes.AgentOrchestratorSkillVariantMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The orchestrator could not download a needed skill variant.',\n  },\n  [ErrorCodes.AgentOrchestratorTasksFailed]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The orchestrator queue drained with failed required tasks.',\n  },\n  [ErrorCodes.AgentOrchestratorTasksBlocked]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description:\n      'The orchestrator queue drained with no failed task but blocked ones that never ran.',\n  },\n  [ErrorCodes.AgentOrchestratorHollowRun]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The orchestrator drained with zero tasks — the seed step got no usable model output.',\n  },\n  [ErrorCodes.AgentOrchestratorSinkInvariant]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The orchestrator plan failed the sink coverage invariant.',\n  },\n  [ErrorCodes.GatewayMintRefused]: {\n    group: 'gateway',\n    // 429 clears with the daily window, 401 with a fresh login, 403 never.\n    retry: 'case-by-case',\n    description:\n      'The PostHog backend refused to mint a gateway token for this run.',\n  },\n  [ErrorCodes.GatewayMintFailed]: {\n    group: 'gateway',\n    retry: 'yes',\n    description:\n      'The PostHog backend could not mint a gateway token: unreachable, a 5xx, or an unusable response.',\n  },\n  [ErrorCodes.SettingsUnfixableConflict]: {\n    group: 'settings',\n    retry: 'no',\n    description:\n      'A Claude settings conflict cannot be neutralized automatically.',\n  },\n  [ErrorCodes.InternalUnhandled]: {\n    group: 'internal',\n    retry: 'yes',\n    description: 'An unexpected error escaped the pipeline.',\n  },\n};\n","import type { ErrorCode } from './codes';\n\n/**\n * Structured error data for analytics and the machine-readable error line.\n *\n * A data carrier: the agent returns it inside a failure and a host hands it\n * to `wizardAbort()`, which captures it. Never thrown by the wizard.\n */\nexport class WizardError extends Error {\n  readonly code?: ErrorCode;\n\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n    code?: ErrorCode,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n    this.code = code;\n  }\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\n\nexport interface AuthFailureInput {\n  hasSettingsConflict?: boolean;\n  usingManagedLogin?: boolean;\n  /** A pre-run token refresh already failed on a dead grant this run. */\n  sessionExpired?: boolean;\n  apiKey?: string;\n  missingScopes?: readonly string[];\n  gatewayRegion?: 'us' | 'eu' | 'local';\n  sessionRegion?: 'us' | 'eu';\n}\n\nexport function classifyAuthFailure(input: AuthFailureInput): ErrorCode {\n  // First: the only branch backed by a server verdict rather than inference.\n  // The token endpoint already told us the grant is dead, so every heuristic\n  // below would be guessing at a cause we know.\n  if (input.sessionExpired) return ErrorCodes.AuthSessionExpired;\n  if (input.usingManagedLogin) return ErrorCodes.AuthStoredLoginConflict;\n  if (input.hasSettingsConflict) return ErrorCodes.AuthSettingsConflict;\n  if (\n    input.apiKey &&\n    !input.apiKey.startsWith('phx_') &&\n    !input.apiKey.startsWith('pha_')\n  ) {\n    return ErrorCodes.AuthKeyType;\n  }\n  if (input.missingScopes && input.missingScopes.length > 0) {\n    return ErrorCodes.AuthMissingScope;\n  }\n  if (\n    input.gatewayRegion &&\n    input.sessionRegion &&\n    input.gatewayRegion !== 'local' &&\n    input.gatewayRegion !== input.sessionRegion\n  ) {\n    return ErrorCodes.AuthRegionMismatch;\n  }\n  return ErrorCodes.AuthInvalidOrExpired;\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\nimport type { InstallSkillResult } from '@shared/skill-install';\n\nconst SKILL_CODES: Record<\n  Exclude<InstallSkillResult['kind'], 'ok'>,\n  ErrorCode\n> = {\n  'menu-fetch-failed': ErrorCodes.SkillMenuFetchFailed,\n  'skill-not-found': ErrorCodes.SkillNotFound,\n  'download-failed': ErrorCodes.SkillDownloadFailed,\n};\n\nexport function skillErrorCode(result: InstallSkillResult): ErrorCode | null {\n  if (result.kind === 'ok') return null;\n  return SKILL_CODES[result.kind];\n}\n","const DETAIL_ALLOWLIST = ['reason', 'detected', 'platform'] as const;\n\nexport function sanitizeErrorDetail(\n  detail: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!detail) return undefined;\n  const safe: Record<string, unknown> = {};\n  for (const key of DETAIL_ALLOWLIST) {\n    if (detail[key] !== undefined) safe[key] = detail[key];\n  }\n  return Object.keys(safe).length > 0 ? safe : undefined;\n}\n","import { ErrorCodes, isErrorCode, type ErrorCode } from './codes';\n\nexport interface RunFailure {\n  code: ErrorCode;\n  message: string;\n  /** True when the error carried its own code: a decision, not a crash. */\n  coded: boolean;\n}\n\n/**\n * How a run's terminal error is reported. A coded WizardError (a mint refusal,\n * say) keeps its own message and code; anything else is unhandled and gets the\n * generic framing. Duck-typed on `code` so callers need not load wizard-abort.\n */\nexport function classifyRunFailure(err: unknown): RunFailure {\n  const message = err instanceof Error ? err.message : String(err);\n  const code =\n    err instanceof Error ? (err as { code?: unknown }).code : undefined;\n  if (typeof code === 'string' && isErrorCode(code)) {\n    return { code, message, coded: true };\n  }\n  return { code: ErrorCodes.InternalUnhandled, message, coded: false };\n}\n"],"mappings":";AAIG,WAAW,gBAKX,WAAW,YAKX,WAAW,oBAKX,WAAW,wBAMX,WAAW,mBAKX,WAAW,uBAKX,WAAW,kBAKX,WAAW,2BAKX,WAAW,aAKX,WAAW,sBAKX,WAAW,oBAMX,WAAW,kBAKX,WAAW,oBAKX,WAAW,sBAKX,WAAW,yBAMX,WAAW,wBAKX,WAAW,sBAKX,WAAW,kBAKX,WAAW,oBAMX,WAAW,mBAKX,WAAW,0BAMX,WAAW,2BAKX,WAAW,oBAMX,WAAW,sBAKX,WAAW,iBAKX,WAAW,qBAKX,WAAW,cAKX,WAAW,qBAKX,WAAW,oBAQX,WAAW,sBAKX,WAAW,eAKX,WAAW,qBAKX,WAAW,YAKX,WAAW,yBAKX,WAAW,iBAKX,WAAW,sBAKX,WAAW,gBAKX,WAAW,eAKX,WAAW,oBAKX,WAAW,iBAKX,WAAW,8BAMX,WAAW,sBAKX,WAAW,sCAKX,WAAW,8BAKX,WAAW,+BAMX,WAAW,4BAMX,WAAW,gCAKX,WAAW,oBAOX,WAAW,mBAMX,WAAW,2BAMX,WAAW;;;;;;;;;ACtQd,IAAa,cAAb,cAAiC,MAAM;CACrC;CAEA,YACE,SACA,SACA,MACA;AACA,QAAM,QAAQ;AAHE,OAAA,UAAA;AAIhB,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;ACLhB,SAAgB,oBAAoB,OAAoC;AAItE,KAAI,MAAM,eAAgB,QAAO,WAAW;AAC5C,KAAI,MAAM,kBAAmB,QAAO,WAAW;AAC/C,KAAI,MAAM,oBAAqB,QAAO,WAAW;AACjD,KACE,MAAM,UACN,CAAC,MAAM,OAAO,WAAW,OAAO,IAChC,CAAC,MAAM,OAAO,WAAW,OAAO,CAEhC,QAAO,WAAW;AAEpB,KAAI,MAAM,iBAAiB,MAAM,cAAc,SAAS,EACtD,QAAO,WAAW;AAEpB,KACE,MAAM,iBACN,MAAM,iBACN,MAAM,kBAAkB,WACxB,MAAM,kBAAkB,MAAM,cAE9B,QAAO,WAAW;AAEpB,QAAO,WAAW;;;;ACnCpB,MAAM,cAGF;CACF,qBAAqB,WAAW;CAChC,mBAAmB,WAAW;CAC9B,mBAAmB,WAAW;CAC/B;AAED,SAAgB,eAAe,QAA8C;AAC3E,KAAI,OAAO,SAAS,KAAM,QAAO;AACjC,QAAO,YAAY,OAAO;;;;ACd5B,MAAM,mBAAmB;CAAC;CAAU;CAAY;CAAW;AAE3D,SAAgB,oBACd,QACqC;AACrC,KAAI,CAAC,OAAQ,QAAO,KAAA;CACpB,MAAM,OAAgC,EAAE;AACxC,MAAK,MAAM,OAAO,iBAChB,KAAI,OAAO,SAAS,KAAA,EAAW,MAAK,OAAO,OAAO;AAEpD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,KAAA;;;;;;;;;ACI/C,SAAgB,mBAAmB,KAA0B;CAC3D,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;CAChE,MAAM,OACJ,eAAe,QAAS,IAA2B,OAAO,KAAA;AAC5D,KAAI,OAAO,SAAS,YAAY,YAAY,KAAK,CAC/C,QAAO;EAAE;EAAM;EAAS,OAAO;EAAM;AAEvC,QAAO;EAAE,MAAM,WAAW;EAAmB;EAAS,OAAO;EAAO"}

package/dist/{family-picker-BKs-tTyu.js → family-picker-CAW_VtYf.js}

@@ -1,4 +1,4 @@
-import { m as Colors, t as PickerMenu } from "./PickerMenu-BGGeYqd-.js";
+import { m as Colors, t as PickerMenu } from "./PickerMenu-BtheKi1o.js";
 import { Box, Text, render } from "ink";
 import { createElement } from "react";
 //#region src/tui/family-picker.tsx
@@ -43,4 +43,4 @@ function renderFamilyPicker(parentLabel, options) {
 //#endregion
 export { renderFamilyPicker };
 
-//# sourceMappingURL=family-picker-BKs-tTyu.js.map
+//# sourceMappingURL=family-picker-CAW_VtYf.js.map

package/dist/{family-picker-BKs-tTyu.js.map → family-picker-CAW_VtYf.js.map}

@@ -1 +1 @@
-{"version":3,"file":"family-picker-BKs-tTyu.js","names":[],"sources":["../src/tui/family-picker.tsx"],"sourcesContent":["/**\n * An Ink picker over a family's subcommands: one headline, one option per\n * child, the first option focused. Resolves with the picked value once the\n * user selects; which children to show and what to run are the CLI's.\n */\n\nimport { Box, Text, render } from 'ink';\nimport { createElement } from 'react';\n\nimport { Colors } from '@tui/styles';\nimport { PickerMenu } from '@tui/primitives/PickerMenu';\n\nexport interface FamilyPickerOption<T> {\n  label: string;\n  value: T;\n  hint?: string;\n}\n\ninterface FamilyPickerAppProps<T> {\n  parentLabel: string;\n  options: FamilyPickerOption<T>[];\n  onSelect: (value: T) => void;\n}\n\nfunction FamilyPickerApp<T>(props: FamilyPickerAppProps<T>) {\n  return createElement(\n    Box,\n    { flexDirection: 'column', paddingX: 1, paddingY: 1 },\n    createElement(\n      Text,\n      { bold: true, color: Colors.accent },\n      props.parentLabel,\n    ),\n    createElement(Box, { height: 1 }),\n    createElement(PickerMenu<T>, {\n      message: 'Pick a subcommand',\n      options: props.options,\n      optionMarginBottom: 1,\n      onSelect: (value) => {\n        // PickerMenu in single mode returns one value; only the multi-mode\n        // signature is the array variant. Narrow defensively.\n        const picked = Array.isArray(value) ? value[0] : value;\n        if (picked) props.onSelect(picked);\n      },\n    }),\n  );\n}\n\n/** Render the picker and resolve with the selected option's value. */\nexport function renderFamilyPicker<T>(\n  parentLabel: string,\n  options: FamilyPickerOption<T>[],\n): Promise<T> {\n  return new Promise((resolve) => {\n    let app: ReturnType<typeof render> | null = null;\n    const handleSelect = (value: T): void => {\n      app?.unmount();\n      resolve(value);\n    };\n    app = render(\n      createElement(FamilyPickerApp<T>, {\n        parentLabel,\n        options,\n        onSelect: handleSelect,\n      }),\n    );\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,gBAAmB,OAAgC;AAC1D,QAAO,cACL,KACA;EAAE,eAAe;EAAU,UAAU;EAAG,UAAU;EAAG,EACrD,cACE,MACA;EAAE,MAAM;EAAM,OAAO,OAAO;EAAQ,EACpC,MAAM,YACP,EACD,cAAc,KAAK,EAAE,QAAQ,GAAG,CAAC,EACjC,cAAc,YAAe;EAC3B,SAAS;EACT,SAAS,MAAM;EACf,oBAAoB;EACpB,WAAW,UAAU;GAGnB,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,MAAM,KAAK;AACjD,OAAI,OAAQ,OAAM,SAAS,OAAO;;EAErC,CAAC,CACH;;;AAIH,SAAgB,mBACd,aACA,SACY;AACZ,QAAO,IAAI,SAAS,YAAY;EAC9B,IAAI,MAAwC;EAC5C,MAAM,gBAAgB,UAAmB;AACvC,QAAK,SAAS;AACd,WAAQ,MAAM;;AAEhB,QAAM,OACJ,cAAc,iBAAoB;GAChC;GACA;GACA,UAAU;GACX,CAAC,CACH;GACD"}
+{"version":3,"file":"family-picker-CAW_VtYf.js","names":[],"sources":["../src/tui/family-picker.tsx"],"sourcesContent":["/**\n * An Ink picker over a family's subcommands: one headline, one option per\n * child, the first option focused. Resolves with the picked value once the\n * user selects; which children to show and what to run are the CLI's.\n */\n\nimport { Box, Text, render } from 'ink';\nimport { createElement } from 'react';\n\nimport { Colors } from '@tui/styles';\nimport { PickerMenu } from '@tui/primitives/PickerMenu';\n\nexport interface FamilyPickerOption<T> {\n  label: string;\n  value: T;\n  hint?: string;\n}\n\ninterface FamilyPickerAppProps<T> {\n  parentLabel: string;\n  options: FamilyPickerOption<T>[];\n  onSelect: (value: T) => void;\n}\n\nfunction FamilyPickerApp<T>(props: FamilyPickerAppProps<T>) {\n  return createElement(\n    Box,\n    { flexDirection: 'column', paddingX: 1, paddingY: 1 },\n    createElement(\n      Text,\n      { bold: true, color: Colors.accent },\n      props.parentLabel,\n    ),\n    createElement(Box, { height: 1 }),\n    createElement(PickerMenu<T>, {\n      message: 'Pick a subcommand',\n      options: props.options,\n      optionMarginBottom: 1,\n      onSelect: (value) => {\n        // PickerMenu in single mode returns one value; only the multi-mode\n        // signature is the array variant. Narrow defensively.\n        const picked = Array.isArray(value) ? value[0] : value;\n        if (picked) props.onSelect(picked);\n      },\n    }),\n  );\n}\n\n/** Render the picker and resolve with the selected option's value. */\nexport function renderFamilyPicker<T>(\n  parentLabel: string,\n  options: FamilyPickerOption<T>[],\n): Promise<T> {\n  return new Promise((resolve) => {\n    let app: ReturnType<typeof render> | null = null;\n    const handleSelect = (value: T): void => {\n      app?.unmount();\n      resolve(value);\n    };\n    app = render(\n      createElement(FamilyPickerApp<T>, {\n        parentLabel,\n        options,\n        onSelect: handleSelect,\n      }),\n    );\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,gBAAmB,OAAgC;AAC1D,QAAO,cACL,KACA;EAAE,eAAe;EAAU,UAAU;EAAG,UAAU;EAAG,EACrD,cACE,MACA;EAAE,MAAM;EAAM,OAAO,OAAO;EAAQ,EACpC,MAAM,YACP,EACD,cAAc,KAAK,EAAE,QAAQ,GAAG,CAAC,EACjC,cAAc,YAAe;EAC3B,SAAS;EACT,SAAS,MAAM;EACf,oBAAoB;EACpB,WAAW,UAAU;GAGnB,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,MAAM,KAAK;AACjD,OAAI,OAAQ,OAAM,SAAS,OAAO;;EAErC,CAAC,CACH;;;AAIH,SAAgB,mBACd,aACA,SACY;AACZ,QAAO,IAAI,SAAS,YAAY;EAC9B,IAAI,MAAwC;EAC5C,MAAM,gBAAgB,UAAmB;AACvC,QAAK,SAAS;AACd,WAAQ,MAAM;;AAEhB,QAAM,OACJ,cAAc,iBAAoB;GAChC;GACA;GACA,UAAU;GACX,CAAC,CACH;GACD"}

package/dist/{gateway-CWoYlPz7.js → gateway-CLQQb96F.js}

@@ -1,9 +1,9 @@
 import { n as ErrorCodes } from "./emit-BqLCdV8Y.js";
-import { o as logToFile } from "./debug-BvEbemym.js";
-import { l as AWS_SKILLS_BASE_URL, n as analytics, y as GITHUB_SKILLS_BASE_URL } from "./analytics-B_xFshPY.js";
-import { a as WizardError } from "./errors-DhFeR8Sp.js";
-import { a as oauthLoginKey } from "./oauth-session-Bi1MLRCC.js";
-import { i as modelCapabilities } from "./models-C9rjXPZ6.js";
+import { o as logToFile } from "./debug-BfO_Txo8.js";
+import { b as GITHUB_SKILLS_BASE_URL, n as analytics, u as AWS_SKILLS_BASE_URL } from "./analytics-Drox5LSW.js";
+import { a as WizardError } from "./errors-BXlWujEw.js";
+import { a as oauthLoginKey } from "./oauth-session-9EU3ky0v.js";
+import { i as modelCapabilities } from "./models-B0huHItG.js";
 //#region src/shared/health-checks/endpoints.ts
 function noConnectionResult(error, attempts) {
 	return {
@@ -383,12 +383,25 @@ const AgentSignals = {
 	ERROR_RESOURCE_MISSING: "[ERROR-RESOURCE-MISSING]",
 	SKILL_INSTALL_FAILED: "[SKILL-INSTALL-FAILED]",
 	ABORT: "[ABORT]",
+	POLICY_ABORT: "[posthog:abort]",
 	WIZARD_REMARK: "[WIZARD-REMARK]",
 	BENCHMARK: "[BENCHMARK]",
 	DASHBOARD_URL: "[DASHBOARD_URL]",
 	NOTEBOOK_URL: "[NOTEBOOK_URL]"
 };
 /**
+* The reason of a reply that starts with the policy abort marker, or undefined
+* for any other reply. The marker ends at a non-word character or the end of
+* the text, and the reason is the rest of that first line.
+*/
+function policyAbortReason(text) {
+	const reply = text.trimStart();
+	if (!reply.startsWith(AgentSignals.POLICY_ABORT)) return void 0;
+	const rest = reply.slice(AgentSignals.POLICY_ABORT.length);
+	if (/^\w/.test(rest)) return void 0;
+	return rest.split("\n")[0].trim() || "The AI gateway refused this request";
+}
+/**
 * End-of-run reflection ask, shared by both harnesses so remarks are
 * comparable. The format clause comes FIRST and nothing trails the marker —
 * literal models (gpt-5-mini) echo whatever text follows it. The parser also
@@ -406,8 +419,8 @@ const RESUME_INSTRUCTION = "Your previous request failed with a transient gatewa
 * PostHog AI gateway provider spec for pi sessions, shared by the linear run
 * and the orchestrator's per-task runs so both speak to the gateway
 * identically: bearer auth, the wizard properties header, transport shape
-* inferred from the model id. The caller registers the spec on its own
-* (lazily imported, properly typed) pi ModelRegistry.
+* inferred from the model id. `createGatewayRuntime` registers the spec on a
+* pi ModelRuntime that holds nothing else.
 */
 /** Provider registered on the in-memory registry for this run. */
 const GATEWAY_PROVIDER = "posthog-gateway";
@@ -451,6 +464,7 @@ function buildGatewayModel(inputs) {
 		provider: GATEWAY_PROVIDER,
 		baseUrl: api === "anthropic-messages" ? gatewayUrl : `${gatewayUrl}/v1`,
 		reasoning: modelCapabilities(modelId).reasoning,
+		compat: { supportsDeveloperRole: false },
 		input: ["text"],
 		cost: {
 			input: 0,
@@ -527,6 +541,22 @@ function isGatewayAuthRejection(turn) {
 	return /\b401\b|authentication_error|unauthorized/i.test(errorMessage ?? "");
 }
 /**
+* A model runtime holding only the gateway provider. Credentials stay in memory,
+* and it reads no models.json and refreshes no catalog over the network, so a
+* run reads nothing of the user's own pi setup.
+*/
+async function createGatewayRuntime(provider) {
+	const [{ ModelRuntime }, { InMemoryCredentialStore }] = await Promise.all([import("@earendil-works/pi-coding-agent"), import("@earendil-works/pi-ai")]);
+	const runtime = await ModelRuntime.create({
+		credentials: new InMemoryCredentialStore(),
+		modelsPath: null,
+		allowModelNetwork: false,
+		refreshOnCreate: false
+	});
+	runtime.registerProvider(GATEWAY_PROVIDER, provider);
+	return runtime;
+}
+/**
 * Wraps a pi session's prompt(): when a turn ends on a 401 from a bearer past
 * its refresh instant, mint once, re-register the provider with the new
 * bearer (pi resolves the apiKey per request), and continue. A 401 on a fresh
@@ -563,6 +593,6 @@ function withGatewayRemint(opts) {
 	};
 }
 //#endregion
-export { gatewayTerminalFailure as a, REMARK_INSTRUCTION as c, gatewayAuth as d, isPastRefresh as f, gatewayApiFor as i, RESUME_INSTRUCTION as l, checkSkillsOriginHealth as m, buildGatewayModel as n, withGatewayRemint as o, useRunGatewayCredential as p, buildGatewayProvider as r, AgentSignals as s, GATEWAY_PROVIDER as t, buildWizardPropertiesBlob as u };
+export { gatewayApiFor as a, AgentSignals as c, policyAbortReason as d, buildWizardPropertiesBlob as f, checkSkillsOriginHealth as g, useRunGatewayCredential as h, createGatewayRuntime as i, REMARK_INSTRUCTION as l, isPastRefresh as m, buildGatewayModel as n, gatewayTerminalFailure as o, gatewayAuth as p, buildGatewayProvider as r, withGatewayRemint as s, GATEWAY_PROVIDER as t, RESUME_INSTRUCTION as u };
 
-//# sourceMappingURL=gateway-CWoYlPz7.js.map
+//# sourceMappingURL=gateway-CLQQb96F.js.map