@promptscript/cli 1.16.0 → 1.17.1

package/index.js

@@ -4437,20 +4437,20 @@ var init_services = __esm({
       existsSync,
       readFileSync: readFileSync2,
       rename: async (...args) => {
-        const { rename: rename2 } = await import("node:fs/promises");
-        return rename2(...args);
+        const { rename: rename3 } = await import("node:fs/promises");
+        return rename3(...args);
       },
       rm: async (...args) => {
         const { rm: rm3 } = await import("node:fs/promises");
         return rm3(...args);
       },
       lstat: async (path2) => {
-        const { lstat: lstat9 } = await import("node:fs/promises");
-        return lstat9(path2);
+        const { lstat: lstat10 } = await import("node:fs/promises");
+        return lstat10(path2);
       },
       realpath: async (path2) => {
-        const { realpath: realpath6 } = await import("node:fs/promises");
-        return realpath6(path2);
+        const { realpath: realpath7 } = await import("node:fs/promises");
+        return realpath7(path2);
       }
     };
     defaultPrompts = {
@@ -18437,8 +18437,8 @@ ${f.content}`
         if (project) sections.push(project);
         const techStack = this.techStack(ast, renderer);
         if (techStack) sections.push(techStack);
-        const architecture = this.architecture(ast, renderer);
-        if (architecture) sections.push(architecture);
+        const architecture2 = this.architecture(ast, renderer);
+        if (architecture2) sections.push(architecture2);
         const contextSection = this.contextSection(ast, renderer);
         if (contextSection) sections.push(contextSection);
         const codeStandards = this.codeStandards(ast, renderer);
@@ -20437,8 +20437,8 @@ ${content}`);
         if (intro) sections.push(intro);
         const techStack = this.techStack(ast);
         if (techStack) sections.push(techStack);
-        const architecture = this.architecture(ast);
-        if (architecture) sections.push(architecture);
+        const architecture2 = this.architecture(ast);
+        if (architecture2) sections.push(architecture2);
         const context = this.contextSection(ast);
         if (context) sections.push(context);
         const codeStyle = this.codeStyle(ast);
@@ -21021,8 +21021,8 @@ ${content}`);
         if (identity) sections.push(identity);
         const techStack = this.techStack(ast, renderer);
         if (techStack) sections.push(techStack);
-        const architecture = this.architecture(ast, renderer);
-        if (architecture) sections.push(architecture);
+        const architecture2 = this.architecture(ast, renderer);
+        if (architecture2) sections.push(architecture2);
         const contextSection = this.contextSection(ast, renderer);
         if (contextSection) sections.push(contextSection);
         const codeStandards = this.codeStandards(ast, renderer);
@@ -26597,8 +26597,20 @@ function loadEnvOverrides() {
   const registryUrl = process.env["PROMPTSCRIPT_REGISTRY_URL"];
   const cacheTtl = process.env["PROMPTSCRIPT_CACHE_TTL"];
   const cacheEnabled = process.env["PROMPTSCRIPT_CACHE_ENABLED"];
+  const telemetry = process.env["PROMPTSCRIPT_TELEMETRY"];
   const hasCache = cacheTtl || cacheEnabled;
   const hasRegistry = gitUrl || gitRef || registryUrl || hasCache;
+  if (!hasRegistry && telemetry === void 0) {
+    return overrides;
+  }
+  if (telemetry !== void 0) {
+    const normalized = telemetry.trim().toLowerCase();
+    if (["1", "true", "yes", "on"].includes(normalized)) {
+      overrides.telemetry = true;
+    } else if (["0", "false", "no", "off"].includes(normalized)) {
+      overrides.telemetry = false;
+    }
+  }
   if (!hasRegistry) {
     return overrides;
   }
@@ -26677,6 +26689,22 @@ function userConfigToProjectRegistry(userRegistry) {
 }
 function mergeConfigs(userConfig, projectConfig, envOverrides, cliFlags) {
   const merged = { ...projectConfig };
+  const telemetryValues = [
+    userConfig.telemetry,
+    projectConfig.telemetry,
+    envOverrides.telemetry,
+    cliFlags?.telemetry
+  ];
+  if (telemetryValues.includes(false)) {
+    merged.telemetry = false;
+  } else {
+    const explicitTelemetry = telemetryValues.find(
+      (value) => value !== void 0
+    );
+    if (explicitTelemetry !== void 0) {
+      merged.telemetry = explicitTelemetry;
+    }
+  }
   if (userConfig.registry) {
     const userRegistry = userConfigToProjectRegistry(userConfig.registry);
     merged.registry = deepMergeRegistry(userRegistry, merged.registry);
@@ -27416,13 +27444,7 @@ function getSkillWrites(targets) {
   const skillSource = resolve7(BUNDLED_SKILLS_DIR, skillName, "SKILL.md");
   try {
     const rawSkillContent = readFileSync3(skillSource, "utf-8");
-    let skillContent = rawSkillContent;
-    const hasMarker = rawSkillContent.includes("<!-- PromptScript") || rawSkillContent.includes("# promptscript-generated:");
-    if (!hasMarker && rawSkillContent.startsWith("---")) {
-      const yamlMarker = "# promptscript-generated: true";
-      skillContent = `---
-${yamlMarker}${rawSkillContent.slice(3)}`;
-    }
+    const skillContent = addPromptScriptMarker(rawSkillContent);
     writes.push({
       path: `.promptscript/skills/${skillName}/SKILL.md`,
       content: skillContent
@@ -27430,7 +27452,14 @@ ${yamlMarker}${rawSkillContent.slice(3)}`;
     for (const target of targets) {
       const targetSkillDir = getTargetSkillDir(target, skillName);
       if (targetSkillDir && !writes.some((write) => write.path === targetSkillDir.path)) {
-        writes.push({ path: targetSkillDir.path, content: skillContent });
+        const formatter = FormatterRegistry.get(target);
+        let targetContent = skillContent;
+        if (formatter?.transformInjectedSkillContent) {
+          targetContent = addPromptScriptMarker(
+            formatter.transformInjectedSkillContent(rawSkillContent)
+          );
+        }
+        writes.push({ path: targetSkillDir.path, content: targetContent });
       }
     }
   } catch {
@@ -27438,6 +27467,11 @@ ${yamlMarker}${rawSkillContent.slice(3)}`;
   }
   return writes;
 }
+function addPromptScriptMarker(content) {
+  const hasMarker = content.includes("<!-- PromptScript") || content.includes("# promptscript-generated:");
+  return !hasMarker && content.startsWith("---") ? `---
+# promptscript-generated: true${content.slice(3)}` : content;
+}
 async function resolveConfig(options, projectInfo, aiToolsDetection, prettierConfigPath, manifest, services) {
   if (options.yes) {
     const userConfig = await loadUserConfig();
@@ -28009,13 +28043,13 @@ var require_ipv4 = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.Address4 = void 0;
     var common = __importStar(require_common());
-    var constants3 = __importStar(require_constants());
+    var constants4 = __importStar(require_constants());
     var address_error_1 = require_address_error();
-    var isCorrect4 = common.isCorrect(constants3.BITS);
+    var isCorrect4 = common.isCorrect(constants4.BITS);
     var Address4 = class _Address4 {
       constructor(address) {
         this.addressMinusSuffix = "";
-        this.groups = constants3.GROUPS;
+        this.groups = constants4.GROUPS;
         this.parsedAddress = [];
         this.parsedSubnet = "";
         this.subnet = "/32";
@@ -28025,15 +28059,15 @@ var require_ipv4 = __commonJS({
         this.isInSubnet = common.isInSubnet;
         this.isHostInSubnet = common.isHostInSubnet;
         this.address = address;
-        const subnet = constants3.RE_SUBNET_STRING.exec(address);
+        const subnet = constants4.RE_SUBNET_STRING.exec(address);
         if (subnet) {
           this.parsedSubnet = subnet[0].replace("/", "");
           this.subnetMask = parseInt(this.parsedSubnet, 10);
           this.subnet = `/${this.subnetMask}`;
-          if (this.subnetMask < 0 || this.subnetMask > constants3.BITS) {
+          if (this.subnetMask < 0 || this.subnetMask > constants4.BITS) {
             throw new address_error_1.AddressError("Invalid subnet mask.");
           }
-          address = address.replace(constants3.RE_SUBNET_STRING, "");
+          address = address.replace(constants4.RE_SUBNET_STRING, "");
         }
         this.addressMinusSuffix = address;
         this.parsedAddress = this.parse(address);
@@ -28064,7 +28098,7 @@ var require_ipv4 = __commonJS({
         if (groups.some((group) => /^0\d/.test(group))) {
           throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.");
         }
-        if (!address.match(constants3.RE_ADDRESS)) {
+        if (!address.match(constants4.RE_ADDRESS)) {
           throw new address_error_1.AddressError("Invalid IPv4 address.");
         }
         return groups;
@@ -28087,7 +28121,7 @@ var require_ipv4 = __commonJS({
        * address.subnetMask; // 24
        */
       static fromAddressAndMask(address, mask) {
-        const bits = common.prefixLengthFromMask(new _Address4(mask).bigInt(), constants3.BITS);
+        const bits = common.prefixLengthFromMask(new _Address4(mask).bigInt(), constants4.BITS);
         return new _Address4(`${address}/${bits}`);
       }
       /**
@@ -28101,9 +28135,9 @@ var require_ipv4 = __commonJS({
        */
       static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new _Address4(wildcardMask).bigInt();
-        const allOnes = (BigInt(1) << BigInt(constants3.BITS)) - BigInt(1);
+        const allOnes = (BigInt(1) << BigInt(constants4.BITS)) - BigInt(1);
         const mask = wildcard ^ allOnes;
-        const bits = common.prefixLengthFromMask(mask, constants3.BITS);
+        const bits = common.prefixLengthFromMask(mask, constants4.BITS);
         return new _Address4(`${address}/${bits}`);
       }
       /**
@@ -28121,7 +28155,7 @@ var require_ipv4 = __commonJS({
        */
       static fromWildcard(input2) {
         const groups = input2.split(".");
-        if (groups.length !== constants3.GROUPS) {
+        if (groups.length !== constants4.GROUPS) {
           throw new address_error_1.AddressError("Wildcard pattern must have 4 octets");
         }
         let firstWildcard = -1;
@@ -28136,7 +28170,7 @@ var require_ipv4 = __commonJS({
         }
         const trailing = firstWildcard === -1 ? 0 : groups.length - firstWildcard;
         const replaced = groups.map((g) => g === "*" ? "0" : g);
-        const subnetBits = constants3.BITS - trailing * 8;
+        const subnetBits = constants4.BITS - trailing * 8;
         return new _Address4(`${replaced.join(".")}/${subnetBits}`);
       }
       /**
@@ -28206,7 +28240,7 @@ var require_ipv4 = __commonJS({
       toGroup6() {
         const output = [];
         let i;
-        for (i = 0; i < constants3.GROUPS; i += 2) {
+        for (i = 0; i < constants4.GROUPS; i += 2) {
           output.push(`${common.stringToPaddedHex(this.parsedAddress[i])}${common.stringToPaddedHex(this.parsedAddress[i + 1])}`);
         }
         return output.join(":");
@@ -28223,7 +28257,7 @@ var require_ipv4 = __commonJS({
        * @returns {bigint}
        */
       _startAddress() {
-        return BigInt(`0b${this.mask() + "0".repeat(constants3.BITS - this.subnetMask)}`);
+        return BigInt(`0b${this.mask() + "0".repeat(constants4.BITS - this.subnetMask)}`);
       }
       /**
        * The first address in the range given by this address' subnet.
@@ -28247,7 +28281,7 @@ var require_ipv4 = __commonJS({
        * @returns {bigint}
        */
       _endAddress() {
-        return BigInt(`0b${this.mask() + "1".repeat(constants3.BITS - this.subnetMask)}`);
+        return BigInt(`0b${this.mask() + "1".repeat(constants4.BITS - this.subnetMask)}`);
       }
       /**
        * The last address in the range given by this address' subnet
@@ -28272,7 +28306,7 @@ var require_ipv4 = __commonJS({
        * @returns {Address4}
        */
       subnetMaskAddress() {
-        return _Address4.fromBigInt(BigInt(`0b${"1".repeat(this.subnetMask)}${"0".repeat(constants3.BITS - this.subnetMask)}`));
+        return _Address4.fromBigInt(BigInt(`0b${"1".repeat(this.subnetMask)}${"0".repeat(constants4.BITS - this.subnetMask)}`));
       }
       /**
        * The Cisco-style wildcard mask, e.g. `0.0.0.255` for a `/24`. This is
@@ -28281,7 +28315,7 @@ var require_ipv4 = __commonJS({
        * @returns {Address4}
        */
       wildcardMask() {
-        return _Address4.fromBigInt(BigInt(`0b${"0".repeat(this.subnetMask)}${"1".repeat(constants3.BITS - this.subnetMask)}`));
+        return _Address4.fromBigInt(BigInt(`0b${"0".repeat(this.subnetMask)}${"1".repeat(constants4.BITS - this.subnetMask)}`));
       }
       /**
        * The network address in CIDR string form, e.g. `192.168.1.0/24` for
@@ -28416,7 +28450,7 @@ var require_ipv4 = __commonJS({
        */
       binaryZeroPad() {
         if (this._binaryZeroPad === void 0) {
-          this._binaryZeroPad = this.bigInt().toString(2).padStart(constants3.BITS, "0");
+          this._binaryZeroPad = this.bigInt().toString(2).padStart(constants4.BITS, "0");
         }
         return this._binaryZeroPad;
       }
@@ -28426,7 +28460,7 @@ var require_ipv4 = __commonJS({
        */
       groupForV6() {
         const segments = this.parsedAddress;
-        return this.correctForm().replace(constants3.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${segments.slice(2, 4).join(".")}</span>`);
+        return this.correctForm().replace(constants4.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${segments.slice(2, 4).join(".")}</span>`);
       }
     };
     exports.Address4 = Address4;
@@ -31082,9 +31116,9 @@ var require_rate_limit = __commonJS({
         throw new Error("The configured rate-limit store does not implement a `read` method, which is required to use `{ increment: false }`");
       }
       try {
-        const res = await new Promise((resolve37, reject) => {
+        const res = await new Promise((resolve38, reject) => {
           store[storeMethod](key, (err, res2) => {
-            err ? reject(err) : resolve37(res2);
+            err ? reject(err) : resolve38(res2);
           }, timeWindow, max);
         });
         current = res.current;
@@ -31191,13 +31225,13 @@ var init_health = __esm({
 });
 
 // packages/server/src/source-dirs.ts
-import { readFile as readFile28 } from "fs/promises";
-import { join as join28, dirname as dirname22 } from "path";
+import { readFile as readFile29 } from "fs/promises";
+import { join as join31, dirname as dirname23 } from "path";
 import { parse as parseYaml16 } from "yaml";
 async function readProjectConfig(workspace) {
   for (const filename of CONFIG_FILENAMES) {
     try {
-      const raw = await readFile28(join28(workspace, filename), "utf-8");
+      const raw = await readFile29(join31(workspace, filename), "utf-8");
       const config = parseYaml16(raw);
       if (config) return config;
     } catch {
@@ -31208,10 +31242,10 @@ async function readProjectConfig(workspace) {
 async function resolveSourceDir(workspace) {
   for (const filename of CONFIG_FILENAMES) {
     try {
-      const raw = await readFile28(join28(workspace, filename), "utf-8");
+      const raw = await readFile29(join31(workspace, filename), "utf-8");
       const config = parseYaml16(raw);
       if (config?.input?.entry) {
-        return dirname22(config.input.entry);
+        return dirname23(config.input.entry);
       }
     } catch {
     }
@@ -31225,9 +31259,9 @@ async function resolveFileGlobs(workspace) {
 async function resolveWatchPaths(workspace) {
   const sourceDir = await resolveSourceDir(workspace);
   return [
-    join28(workspace, sourceDir),
-    join28(workspace, "promptscript.yaml"),
-    join28(workspace, "promptscript.yml")
+    join31(workspace, sourceDir),
+    join31(workspace, "promptscript.yaml"),
+    join31(workspace, "promptscript.yml")
   ];
 }
 var DEFAULT_SOURCE_DIR, CONFIG_FILENAMES;
@@ -31254,32 +31288,32 @@ var init_config2 = __esm({
 });
 
 // packages/server/src/path-guard.ts
-import { resolve as resolve35, relative as relative16, isAbsolute as isAbsolute15, dirname as dirname23, basename as basename18 } from "path";
-import { realpath as realpath5 } from "fs/promises";
+import { resolve as resolve36, relative as relative16, isAbsolute as isAbsolute15, dirname as dirname24, basename as basename18 } from "path";
+import { realpath as realpath6 } from "fs/promises";
 async function resolveSafePath(workspace, requestedPath) {
   const decoded = decodeURIComponent(requestedPath);
   if (isAbsolute15(decoded)) {
     throw new PathTraversalError(requestedPath);
   }
-  const resolved = resolve35(workspace, decoded);
+  const resolved = resolve36(workspace, decoded);
   const rel = relative16(workspace, resolved);
   if (rel.startsWith("..") || isAbsolute15(rel)) {
     throw new PathTraversalError(requestedPath);
   }
   let realWorkspace;
   try {
-    realWorkspace = await realpath5(workspace);
+    realWorkspace = await realpath6(workspace);
   } catch {
     realWorkspace = workspace;
   }
   let real;
   try {
-    real = await realpath5(resolved);
+    real = await realpath6(resolved);
   } catch (err) {
     if (err instanceof Error && "code" in err && err.code === "ENOENT") {
       try {
-        const realParent = await realpath5(dirname23(resolved));
-        real = resolve35(realParent, basename18(resolved));
+        const realParent = await realpath6(dirname24(resolved));
+        real = resolve36(realParent, basename18(resolved));
       } catch {
         return resolved;
       }
@@ -31307,8 +31341,8 @@ var init_path_guard = __esm({
 });
 
 // packages/server/src/routes/files.ts
-import { readFile as readFile29, writeFile as writeFile12, unlink as unlink3, stat as stat3, mkdir as mkdir11 } from "fs/promises";
-import { dirname as dirname24 } from "path";
+import { readFile as readFile30, writeFile as writeFile13, unlink as unlink3, stat as stat3, mkdir as mkdir12 } from "fs/promises";
+import { dirname as dirname25 } from "path";
 import fg from "fast-glob";
 function registerRoutes(app, workspace, readOnly) {
   app.get("/api/files", async () => {
@@ -31328,7 +31362,7 @@ function registerRoutes(app, workspace, readOnly) {
     const filePath = request.params["*"];
     try {
       const resolved = await resolveSafePath(workspace, filePath);
-      const content = await readFile29(resolved, "utf-8");
+      const content = await readFile30(resolved, "utf-8");
       return { path: filePath, content };
     } catch (err) {
       if (err instanceof PathTraversalError) {
@@ -31345,7 +31379,7 @@ function registerRoutes(app, workspace, readOnly) {
       const filePath = request.params["*"];
       try {
         const resolved = await resolveSafePath(workspace, filePath);
-        await writeFile12(resolved, request.body.content, "utf-8");
+        await writeFile13(resolved, request.body.content, "utf-8");
         return { path: filePath, status: "updated" };
       } catch (err) {
         if (err instanceof PathTraversalError) {
@@ -31368,8 +31402,8 @@ function registerRoutes(app, workspace, readOnly) {
           return reply.status(409).send({ error: "File already exists" });
         } catch {
         }
-        await mkdir11(dirname24(resolved), { recursive: true });
-        await writeFile12(resolved, request.body.content, "utf-8");
+        await mkdir12(dirname25(resolved), { recursive: true });
+        await writeFile13(resolved, request.body.content, "utf-8");
         return reply.status(201).send({ path: filePath, status: "created" });
       } catch (err) {
         if (err instanceof PathTraversalError) {
@@ -31597,7 +31631,7 @@ var migrate_exports = {};
 __export(migrate_exports, {
   migrateCommand: () => migrateCommand
 });
-import { dirname as dirname25, relative as relative18, resolve as resolve36 } from "path";
+import { dirname as dirname26, relative as relative18, resolve as resolve37 } from "path";
 import { parse as parseYaml17 } from "yaml";
 async function migrateCommand(options, services = createDefaultServices()) {
   const previousOutputStream = getContext().outputStream;
@@ -31617,7 +31651,7 @@ async function runMigrateCommand(options, services) {
       ConsoleOutput.info("No migration candidates found. No files changed.");
       return;
     }
-    const configPath = findProjectConfig(services);
+    const configPath = findProjectConfig2(services);
     if (!configPath) {
       await initCommand(
         {
@@ -31730,7 +31764,7 @@ function validateOptions(options) {
     throw new Error("--static and --llm cannot be used together");
   }
 }
-function findProjectConfig(services) {
+function findProjectConfig2(services) {
   const envConfig = process.env["PROMPTSCRIPT_CONFIG"];
   if (envConfig && services.fs.existsSync(envConfig)) {
     return envConfig;
@@ -31781,7 +31815,7 @@ function extractTargetNames(targets) {
 }
 async function createStaticMigrationWrites(candidates, config, services) {
   const result = await importMultipleFiles(
-    candidates.map((candidate) => resolve36(services.cwd, candidate.path)),
+    candidates.map((candidate) => resolve37(services.cwd, candidate.path)),
     {
       projectName: config.id,
       syntaxVersion: config.syntax || getLatestSyntaxVersion()
@@ -31873,7 +31907,7 @@ ${content}`;
 }
 function toUsePath(entryPath, targetPath) {
   const withoutExtension = targetPath.replace(/\.prs$/, "");
-  const path2 = relative18(dirname25(entryPath), withoutExtension).replace(/\\/g, "/");
+  const path2 = relative18(dirname26(entryPath), withoutExtension).replace(/\\/g, "/");
   return path2.startsWith(".") ? path2 : `./${path2}`;
 }
 function validateProjectPath(path2) {
@@ -31933,16 +31967,16 @@ init_src();
 init_init();
 import { Command } from "commander";
 import { fileURLToPath as fileURLToPath4, pathToFileURL } from "url";
-import { dirname as dirname26 } from "path";
+import { dirname as dirname27 } from "path";
 
 // packages/cli/src/commands/compile.ts
-import { resolve as resolve19, dirname as dirname15, isAbsolute as isAbsolute13, relative as relative13 } from "path";
+import { resolve as resolve19, dirname as dirname15, isAbsolute as isAbsolute12, relative as relative13 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { chmod, writeFile as writeFile4, mkdir as mkdir5, readFile as readFile15 } from "fs/promises";
 import { existsSync as existsSync13 } from "fs";
 import chokidar from "chokidar";
 
-// node_modules/.pnpm/balanced-match@4.0.4/node_modules/balanced-match/dist/esm/index.js
+// node_modules/.pnpm/balanced-match@4.0.3/node_modules/balanced-match/dist/esm/index.js
 var balanced = (a, b, str) => {
   const ma = a instanceof RegExp ? maybeMatch(a, str) : a;
   const mb = b instanceof RegExp ? maybeMatch(b, str) : b;
@@ -33722,10 +33756,10 @@ var Minimatch = class {
       }
       return filtered.join("/");
     }).join("|");
-    const [open3, close] = set.length > 1 ? ["(?:", ")"] : ["", ""];
-    re = "^" + open3 + re + close + "$";
+    const [open4, close] = set.length > 1 ? ["(?:", ")"] : ["", ""];
+    re = "^" + open4 + re + close + "$";
     if (this.partial) {
-      re = "^(?:\\/|" + open3 + re.slice(1, -1) + close + ")$";
+      re = "^(?:\\/|" + open4 + re.slice(1, -1) + close + ")$";
     }
     if (this.negate)
       re = "^(?!" + re + ").+$";
@@ -38017,14 +38051,66 @@ async function discoverNativeContent(dir) {
 
 // packages/resolver/src/vendor-manifest.ts
 import { createHash as createHash3 } from "crypto";
-import { execFile } from "child_process";
-import { lstat as lstat5, readFile as readFile12, readdir as readdir4, realpath as realpath3 } from "fs/promises";
-import { basename as basename10, dirname as dirname9, isAbsolute as isAbsolute8, join as join9, posix as posix2, relative as relative7, sep as sep5 } from "path";
+import { execFile, spawn } from "child_process";
+import { constants as constants2 } from "fs";
+import { lstat as lstat5, open as open2, readFile as readFile12, readdir as readdir4, readlink, realpath as realpath3 } from "fs/promises";
+import { basename as basename10, dirname as dirname9, join as join9, posix as posix2, relative as relative7, sep as sep5 } from "path";
 import { promisify } from "util";
 var VENDOR_MANIFEST_FILE = ".vendor-manifest.json";
 var VENDOR_GIT_DIR = ".promptscript-git";
 var execFileAsync = promisify(execFile);
 var NULL_DEVICE = process.platform === "win32" ? "NUL" : "/dev/null";
+var MAX_GIT_STDERR_BYTES = 64 * 1024;
+var MAX_GIT_TREE_RECORD_BYTES = 1024 * 1024;
+var MAX_GIT_CONFIG_BYTES = 1024 * 1024;
+function hashGitBlob(content) {
+  return createHash3("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
+}
+async function readBoundedRegularFile(filePath, maxBytes, description) {
+  const flags = constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0) | (constants2.O_NONBLOCK ?? 0);
+  const handle = await open2(filePath, flags);
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile()) {
+      throw new Error(`${description} is not a regular file: ${filePath}`);
+    }
+    const content = Buffer.alloc(maxBytes + 1);
+    let offset = 0;
+    while (offset < content.length) {
+      const { bytesRead } = await handle.read(content, offset, content.length - offset, null);
+      if (bytesRead === 0) {
+        break;
+      }
+      offset += bytesRead;
+    }
+    if (offset > maxBytes) {
+      throw new Error(`${description} exceeds ${maxBytes} bytes: ${filePath}`);
+    }
+    return content.subarray(0, offset);
+  } finally {
+    await handle.close();
+  }
+}
+async function resolveSafeRepositorySymlink(symlinkPath, repositoryRoot, gitMetadataRoot) {
+  let targetPath;
+  try {
+    targetPath = await realpath3(symlinkPath);
+  } catch (error) {
+    throw new Error(`Symbolic links must resolve inside vendor repositories: ${symlinkPath}`, {
+      cause: error
+    });
+  }
+  if (targetPath === repositoryRoot || !isInsideCachePath(targetPath, repositoryRoot) || isInsideCachePath(targetPath, gitMetadataRoot)) {
+    throw new Error(`Symbolic links must resolve inside vendor repositories: ${symlinkPath}`);
+  }
+  const targetMetadata = await lstat5(targetPath);
+  if (!targetMetadata.isFile()) {
+    throw new Error(
+      `Symbolic links must resolve to regular files in vendor repositories: ${symlinkPath}`
+    );
+  }
+  return targetPath;
+}
 function getVendorRepositoryRelativePath(repoUrl) {
   const sshMatch = /^git@([^:]+):(.+)$/.exec(repoUrl);
   const candidate = sshMatch ? `https://${sshMatch[1]}/${sshMatch[2]}` : /^[a-z][a-z\d+.-]*:\/\//i.test(repoUrl) ? repoUrl : `https://${repoUrl}`;
@@ -38062,6 +38148,8 @@ function isValidVendorManifest(value) {
 }
 async function hashVendorRepository(directory) {
   const hash = createHash3("sha256");
+  const repositoryRoot = await realpath3(directory);
+  const gitMetadataRoot = join9(repositoryRoot, VENDOR_GIT_DIR);
   async function visit(currentDirectory, prefix) {
     const entries = await readdir4(currentDirectory, { withFileTypes: true });
     entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
@@ -38077,9 +38165,11 @@ async function hashVendorRepository(directory) {
       const entryPath = join9(currentDirectory, entry.name);
       const relativePath = posix2.join(prefix, entry.name);
       if (entry.isSymbolicLink()) {
-        throw new Error(`Symbolic links are not allowed in vendor repositories: ${entryPath}`);
-      }
-      if (entry.isDirectory()) {
+        await resolveSafeRepositorySymlink(entryPath, repositoryRoot, gitMetadataRoot);
+        hash.update(`symlink:${relativePath}\0`);
+        hash.update(await readlink(entryPath, { encoding: "buffer" }));
+        hash.update("\0");
+      } else if (entry.isDirectory()) {
         hash.update(`directory:${relativePath}\0`);
         await visit(entryPath, relativePath);
       } else if (entry.isFile()) {
@@ -38107,23 +38197,43 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
       }
     }
   }
+  async function rejectMetadataPath(relativePath, message) {
+    try {
+      await lstat5(join9(gitDir, ...relativePath.split("/")));
+      throw new Error(`${message}: ${gitDir}`);
+    } catch (error) {
+      if (!(typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT")) {
+        throw error;
+      }
+    }
+  }
   const gitMetadata = await lstat5(gitDir);
   if (!gitMetadata.isDirectory() || gitMetadata.isSymbolicLink()) {
     throw new Error(`Invalid vendor Git metadata directory: ${gitDir}`);
   }
   await rejectMetadataSymlinks(gitDir);
-  const localConfig = await readFile12(join9(gitDir, "config"), "utf-8");
-  if (/^\s*\[(?:include|includeif)\b/im.test(localConfig) || /\bpromisor\s*=\s*true\b/i.test(localConfig) || /\bpartialclone/i.test(localConfig)) {
+  const [repositoryRoot, gitMetadataRoot] = await Promise.all([
+    realpath3(directory),
+    realpath3(gitDir)
+  ]);
+  const localConfigContent = await readBoundedRegularFile(
+    join9(gitDir, "config"),
+    MAX_GIT_CONFIG_BYTES,
+    "Vendor Git config"
+  );
+  const localConfig = localConfigContent.toString("utf-8");
+  if (/^[ \t]*\[(?:include|includeif)\b/im.test(localConfig) || /\bpromisor\s*=\s*true\b/i.test(localConfig) || /\bpartialclone/i.test(localConfig) || /\bworktreeconfig\s*=\s*true\b/i.test(localConfig)) {
     throw new Error(`External or partial Git object sources are not allowed: ${gitDir}`);
   }
-  try {
-    await lstat5(join9(gitDir, "objects", "info", "alternates"));
-    throw new Error(`Git object alternates are not allowed in vendor metadata: ${gitDir}`);
-  } catch (error) {
-    if (!(typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT")) {
-      throw error;
-    }
-  }
+  await rejectMetadataPath("commondir", "Git common directories are not allowed");
+  await rejectMetadataPath(
+    "objects/info/alternates",
+    "Git object alternates are not allowed in vendor metadata"
+  );
+  await rejectMetadataPath(
+    "objects/info/http-alternates",
+    "Git HTTP alternates are not allowed in vendor metadata"
+  );
   const commonArgs = [`--git-dir=${gitDir}`, `--work-tree=${directory}`];
   const environment = {
     PATH: process.env["PATH"],
@@ -38141,27 +38251,96 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
   if (head.stdout.trim().toLowerCase() !== expectedCommit.toLowerCase()) {
     throw new Error(`Vendored repository commit does not match the lockfile: ${directory}`);
   }
-  const tree = await execFileAsync("git", [...commonArgs, "ls-tree", "-r", "-z", expectedCommit], {
-    env: environment
-  });
   const trackedFiles = /* @__PURE__ */ new Map();
-  for (const row of tree.stdout.split("\0").filter(Boolean)) {
-    const separator = row.indexOf("	");
-    const metadata = row.slice(0, separator).split(" ");
-    const path2 = row.slice(separator + 1);
-    if (separator < 0 || metadata.length !== 3 || metadata[1] !== "blob") {
-      throw new Error(`Unsupported Git tree entry in vendored repository: ${path2}`);
-    }
-    const mode = metadata[0];
-    if (mode !== "100644" && mode !== "100755") {
-      throw new Error(`Unsupported Git tree mode in vendored repository: ${path2}`);
-    }
-    trackedFiles.set(path2, {
-      objectId: metadata[2],
-      executable: mode === "100755"
+  const treeProcess = spawn("git", [...commonArgs, "ls-tree", "-r", "-z", expectedCommit], {
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let processError = null;
+  const processCompletion = new Promise((resolveProcess) => {
+    treeProcess.once("error", (error) => {
+      processError = new Error(`Failed to run git ls-tree: ${error.message}`, { cause: error });
+      resolveProcess({ code: null, signal: null });
     });
-  }
-  const worktreeFiles = [];
+    treeProcess.once("close", (code2, signal2) => {
+      resolveProcess({ code: code2, signal: signal2 });
+    });
+  });
+  const stderrChunks = [];
+  let stderrBytes = 0;
+  let stderrTruncated = false;
+  const stderrCompletion = (async () => {
+    for await (const chunk of treeProcess.stderr) {
+      const remaining = MAX_GIT_STDERR_BYTES - stderrBytes;
+      if (remaining > 0) {
+        const captured = chunk.subarray(0, remaining);
+        stderrChunks.push(Buffer.from(captured));
+        stderrBytes += captured.length;
+      }
+      if (chunk.length > remaining) {
+        stderrTruncated = true;
+      }
+    }
+  })();
+  let pendingRecord = Buffer.alloc(0);
+  let stdoutError = null;
+  try {
+    for await (const chunk of treeProcess.stdout) {
+      const output = pendingRecord.length > 0 ? Buffer.concat([pendingRecord, chunk]) : chunk;
+      let recordStart = 0;
+      let separator = output.indexOf(0, recordStart);
+      while (separator >= 0) {
+        if (separator > recordStart) {
+          const row = output.toString("utf8", recordStart, separator);
+          const metadataSeparator = row.indexOf("	");
+          const metadata = row.slice(0, metadataSeparator).split(" ");
+          const path2 = row.slice(metadataSeparator + 1);
+          const [mode, entryType, objectId, ...extraFields] = metadata;
+          if (metadataSeparator < 0 || entryType !== "blob" || extraFields.length > 0 || mode === void 0 || objectId === void 0) {
+            throw new Error(`Unsupported Git tree entry in vendored repository: ${path2}`);
+          }
+          if (mode !== "100644" && mode !== "100755" && mode !== "120000") {
+            throw new Error(`Unsupported Git tree mode in vendored repository: ${path2}`);
+          }
+          trackedFiles.set(path2, {
+            objectId,
+            executable: mode === "100755",
+            symbolicLink: mode === "120000"
+          });
+        }
+        recordStart = separator + 1;
+        separator = output.indexOf(0, recordStart);
+      }
+      pendingRecord = recordStart < output.length ? Buffer.from(output.subarray(recordStart)) : Buffer.alloc(0);
+      if (pendingRecord.length > MAX_GIT_TREE_RECORD_BYTES) {
+        throw new Error(`Git ls-tree record exceeds ${MAX_GIT_TREE_RECORD_BYTES} bytes`);
+      }
+    }
+  } catch (error) {
+    stdoutError = error instanceof Error ? error : new Error(String(error), { cause: error });
+    treeProcess.kill();
+  }
+  const [{ code, signal }] = await Promise.all([processCompletion, stderrCompletion]);
+  if (processError) {
+    throw processError;
+  }
+  if (stdoutError) {
+    throw stdoutError;
+  }
+  if (code !== 0) {
+    const stderrOutput = Buffer.concat(stderrChunks, stderrBytes).toString("utf8");
+    const stderrDetails = stderrTruncated ? `${stderrOutput}
+[stderr truncated]` : stderrOutput;
+    const details = stderrDetails.trim();
+    const status = signal ? `signal ${signal}` : `exit code ${code ?? "unknown"}`;
+    throw new Error(`Git ls-tree failed with ${status}${details ? `: ${details}` : ""}`);
+  }
+  if (pendingRecord.length > 0) {
+    throw new Error("Git ls-tree output ended with an unterminated record");
+  }
+  let worktreeFileCount = 0;
+  const regularFiles = [];
+  const worktreeSymlinks = /* @__PURE__ */ new Map();
   async function collectFiles(currentDirectory, prefix) {
     const entries = await readdir4(currentDirectory, { withFileTypes: true });
     for (const entry of entries) {
@@ -38171,13 +38350,32 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
       const entryPath = join9(currentDirectory, entry.name);
       const relativePath = posix2.join(prefix, entry.name);
       if (entry.isSymbolicLink()) {
-        throw new Error(`Symbolic links are not allowed in vendor repositories: ${entryPath}`);
-      }
-      if (entry.isDirectory()) {
+        const tracked = trackedFiles.get(relativePath);
+        if (!tracked?.symbolicLink) {
+          throw new Error(`Symbolic links are not allowed for regular files: ${entryPath}`);
+        }
+        const targetPath = await resolveSafeRepositorySymlink(
+          entryPath,
+          repositoryRoot,
+          gitMetadataRoot
+        );
+        const targetRelativePath = relative7(repositoryRoot, targetPath).split(sep5).join("/");
+        const trackedTarget = trackedFiles.get(targetRelativePath);
+        if (!trackedTarget || trackedTarget.symbolicLink) {
+          throw new Error(`Symbolic links must target tracked regular files: ${entryPath}`);
+        }
+        worktreeFileCount += 1;
+        worktreeSymlinks.set(relativePath, await readlink(entryPath, { encoding: "buffer" }));
+      } else if (entry.isDirectory()) {
         await collectFiles(entryPath, relativePath);
       } else if (entry.isFile()) {
         if (!allowedUntrackedFiles.has(relativePath)) {
           const tracked = trackedFiles.get(relativePath);
+          if (tracked?.symbolicLink) {
+            throw new Error(
+              `Vendored repository symbolic links do not match commit ${expectedCommit}`
+            );
+          }
           if (tracked && process.platform !== "win32") {
             const metadata = await lstat5(entryPath);
             if (Boolean(metadata.mode & 73) !== tracked.executable) {
@@ -38186,7 +38384,8 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
               );
             }
           }
-          worktreeFiles.push(relativePath);
+          worktreeFileCount += 1;
+          regularFiles.push(relativePath);
         }
       } else {
         throw new Error(`Unsupported vendor repository entry: ${entryPath}`);
@@ -38194,12 +38393,12 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
     }
   }
   await collectFiles(directory, "");
-  if (worktreeFiles.length !== trackedFiles.size || worktreeFiles.some((path2) => !trackedFiles.has(path2))) {
+  if (worktreeFileCount !== trackedFiles.size || regularFiles.some((path2) => !trackedFiles.has(path2))) {
     throw new Error(`Vendored repository contents do not match commit ${expectedCommit}`);
   }
   const batchSize = 100;
-  for (let index = 0; index < worktreeFiles.length; index += batchSize) {
-    const paths = worktreeFiles.slice(index, index + batchSize);
+  for (let index = 0; index < regularFiles.length; index += batchSize) {
+    const paths = regularFiles.slice(index, index + batchSize);
     const filePaths = paths.map((path2) => join9(directory, ...path2.split("/")));
     const objects = await execFileAsync(
       "git",
@@ -38211,6 +38410,12 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
       throw new Error(`Vendored repository contents do not match commit ${expectedCommit}`);
     }
   }
+  for (const [path2, linkTarget] of worktreeSymlinks) {
+    const tracked = trackedFiles.get(path2);
+    if (!tracked || hashGitBlob(linkTarget) !== tracked.objectId) {
+      throw new Error(`Vendored repository contents do not match commit ${expectedCommit}`);
+    }
+  }
 }
 async function verifyVendoredGitRepository(directory, expectedCommit) {
   await verifyGitRepositoryCheckout(directory, VENDOR_GIT_DIR, expectedCommit);
@@ -38276,8 +38481,7 @@ async function resolveVendoredRepository(vendorDir, repoUrl, expectedVersion, ex
       realpath3(fullPath),
       lstat5(fullPath)
     ]);
-    const containment = relative7(vendorRealPath, repositoryRealPath);
-    if (containment === ".." || containment.startsWith(`..${sep5}`) || isAbsolute8(containment) || repositoryRealPath === vendorRealPath) {
+    if (!isInsideCachePath(repositoryRealPath, vendorRealPath) || repositoryRealPath === vendorRealPath) {
       throw new Error(`Vendored dependency escapes the vendor directory: ${repoUrl}`);
     }
     if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
@@ -39380,7 +39584,7 @@ var HttpRegistry = class {
    * Sleep for specified milliseconds.
    */
   sleep(ms) {
-    return new Promise((resolve37) => setTimeout(resolve37, ms));
+    return new Promise((resolve38) => setTimeout(resolve38, ms));
   }
   /**
    * Fetch with timeout.
@@ -39422,7 +39626,7 @@ var HttpRegistry = class {
    */
   async fetchWithRetry(url) {
     let lastError;
-    let delay = this.initialDelay;
+    let delay2 = this.initialDelay;
     for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
       try {
         const response = await this.fetchWithTimeout(url, {
@@ -39441,8 +39645,8 @@ var HttpRegistry = class {
         lastError = error;
       }
       if (attempt < this.maxRetries) {
-        await this.sleep(delay);
-        delay *= 2;
+        await this.sleep(delay2);
+        delay2 *= 2;
       }
     }
     throw lastError ?? new Error("Unknown fetch error");
@@ -41018,36 +41222,76 @@ var suspiciousUrls = {
 // packages/validator/src/rules/authority-injection.ts
 var AUTHORITY_PATTERNS = [
   // Mandatory/strict mode indicators
-  /\[?\s{0,10}MANDATORY\s{0,10}(?:POLICY|UPDATE|FOOTER|INSTRUCTION|DIRECTIVE)\s{0,10}\]?/i,
+  /\[?\s{0,10}\bMANDATORY\b\s{0,10}(?:POLICY|UPDATE|FOOTER|INSTRUCTION|DIRECTIVE)\b\s{0,10}\]?/i,
   /\[\s{0,10}OVERRIDE\s{0,10}\]/i,
-  /\[?\s{0,10}STRICT[_\s]{0,10}MODE\s{0,10}[:\s]{1,10}ON\s{0,10}\]?/i,
-  /\[?\s{0,10}SYSTEM\s{0,10}(?:OVERRIDE|UPDATE|DIRECTIVE)\s{0,10}\]?/i,
-  /\[?\s{0,10}ADMIN(?:ISTRATOR)?\s{0,10}(?:MODE|OVERRIDE|ACCESS)\s{0,10}\]?/i,
-  /\[?\s{0,10}ROOT\s{0,10}(?:ACCESS|MODE|OVERRIDE)\s{0,10}\]?/i,
-  /\[?\s{0,10}PRIORITY\s{0,10}(?:OVERRIDE|ONE|ALPHA)\s{0,10}\]?/i,
-  /\[?\s{0,10}EMERGENCY\s{0,10}(?:PROTOCOL|OVERRIDE|MODE)\s{0,10}\]?/i,
+  /\[?\s{0,10}\bSTRICT[_\s]{0,10}MODE\b\s{0,10}[:\s]{1,10}ON\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bSYSTEM\b\s{0,10}(?:OVERRIDE|UPDATE|DIRECTIVE)\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bADMIN(?:ISTRATOR)?\b\s{0,10}(?:MODE|OVERRIDE|ACCESS)\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bROOT\b\s{0,10}(?:ACCESS|MODE|OVERRIDE)\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bPRIORITY\b\s{0,10}(?:OVERRIDE|ONE|ALPHA)\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bEMERGENCY\b\s{0,10}(?:PROTOCOL|OVERRIDE|MODE)\b\s{0,10}\]?/i,
   // Warning suppression patterns
   // Removed because it triggers false positives on valid agent instructions (e.g., "do not notify user")
   // /(?:DO\s{1,10}NOT|NEVER|DON'?T)\s{1,10}(?:WARN|ALERT|NOTIFY|FLAG|REPORT)/i,
-  /(?:DO\s{1,10}NOT|NEVER|DON'?T)\s{1,10}(?:PROVIDE|SHOW|DISPLAY|INCLUDE)\s{1,10}(?:SECURITY\s{1,10})?WARNINGS?/i,
-  /(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\s{1,10}(?:ALL\s{1,10})?WARNINGS?/i,
-  /(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\s{1,10}(?:ALL\s{1,10})?(?:SECURITY\s{1,10})?(?:ALERTS?|NOTIFICATIONS?)/i,
-  /IGNORE\s{1,10}(?:ALL\s{1,10})?(?:SAFETY\s{1,10})?WARNINGS?/i,
-  /(?:SKIP|BYPASS)\s{1,10}(?:ALL\s{1,10})?(?:SAFETY\s{1,10})?(?:CHECKS?|VALIDATION)/i,
+  /\b(?:DO\s{1,10}NOT|NEVER|DON'?T)\b\s{1,10}(?:PROVIDE|SHOW|DISPLAY|INCLUDE)\b\s{1,10}(?:SECURITY\s{1,10})?WARNINGS?\b/i,
+  /\b(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\b\s{1,10}(?:ALL\s{1,10})?WARNINGS?\b/i,
+  /\b(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\b\s{1,10}(?:ALL\s{1,10})?(?:SECURITY\s{1,10})?(?:ALERTS?|NOTIFICATIONS?)\b/i,
+  /\bIGNORE\b\s{1,10}(?:ALL\s{1,10})?(?:SAFETY\s{1,10})?WARNINGS?\b/i,
+  /(?:^|[.!?:;]\s{0,10})\s{0,10}(?:[-*]\s{1,10})?(?:PLEASE\s{1,10})?\b(?:SKIP|BYPASS)\b\s{1,10}(?:CHECKS?|VALIDATION)\b/im,
+  /\b(?:SKIP|BYPASS)\b\s{1,10}(?:(?:ALL\s{1,10})(?:SAFETY\s{1,10})?|SAFETY\s{1,10})(?:CHECKS?|VALIDATION)\b/i,
   // Execute/follow verbatim patterns
-  /EXECUTE\s{1,10}(?:THIS\s{1,10})?VERBATIM/i,
-  /FOLLOW\s{1,10}(?:THESE?\s{1,10})?INSTRUCTIONS?\s{1,10}(?:EXACTLY|PRECISELY|LITERALLY)/i,
-  /(?:MUST|SHALL|WILL)\s{1,10}(?:ALWAYS\s{1,10})?COMPLY/i,
-  /(?:ABSOLUTE|UNCONDITIONAL)\s{1,10}(?:COMPLIANCE|OBEDIENCE)/i,
-  /NO\s{1,10}(?:EXCEPTIONS?|DEVIATIONS?)\s{1,10}(?:ALLOWED|PERMITTED)/i,
+  /\bEXECUTE\b\s{1,10}(?:THIS\s{1,10})?VERBATIM\b/i,
+  /\bFOLLOW\b\s{1,10}(?:THESE?\s{1,10})?INSTRUCTIONS?\s{1,10}(?:EXACTLY|PRECISELY|LITERALLY)\b/i,
+  /\b(?:MUST|SHALL|WILL)\b\s{1,10}(?:ALWAYS\s{1,10})?COMPLY\b/i,
+  /\b(?:ABSOLUTE|UNCONDITIONAL)\b\s{1,10}(?:COMPLIANCE|OBEDIENCE)\b/i,
+  /\bNO\b\s{1,10}(?:EXCEPTIONS?|DEVIATIONS?)\s{1,10}(?:ALLOWED|PERMITTED)\b/i,
   // Authority assertion patterns
-  /THIS\s{1,10}(?:OVERRIDES?|SUPERSEDES?|REPLACES?)\s{1,10}(?:ALL\s{1,10})?(?:PREVIOUS|PRIOR|OTHER)/i,
-  /(?:HIGHEST|TOP|MAXIMUM)\s{1,10}PRIORITY\s{1,10}(?:INSTRUCTION|DIRECTIVE|ORDER)/i,
-  /(?:CORE|FUNDAMENTAL|BASE)\s{1,10}(?:DIRECTIVE|INSTRUCTION)\s{1,10}(?:UPDATE|OVERRIDE)/i,
-  /NEW\s{1,10}(?:SYSTEM|CORE|BASE)\s{1,10}(?:INSTRUCTIONS?|DIRECTIVES?|RULES?)/i
+  /\bTHIS\b\s{1,10}(?:OVERRIDES?|SUPERSEDES?|REPLACES?)\s{1,10}(?:ALL\s{1,10})?(?:PREVIOUS|PRIOR|OTHER)\b/i,
+  /\b(?:HIGHEST|TOP|MAXIMUM)\b\s{1,10}PRIORITY\s{1,10}(?:INSTRUCTION|DIRECTIVE|ORDER)\b/i,
+  /\b(?:CORE|FUNDAMENTAL|BASE)\b\s{1,10}(?:DIRECTIVE|INSTRUCTION)\s{1,10}(?:UPDATE|OVERRIDE)\b/i,
+  /\bNEW\b\s{1,10}(?:SYSTEM|CORE|BASE)\s{1,10}(?:INSTRUCTIONS?|DIRECTIVES?|RULES?)\b/i
 ];
 function stripFencedCodeBlocks2(text) {
-  return text.replace(/^\s*```[\s\S]*?^\s*```/gm, "");
+  const lines = text.split("\n");
+  const output = [];
+  let pendingFence = [];
+  let insideFence = false;
+  let fenceCharacter = "";
+  let fenceLength = 0;
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    const renderedLine = index < lines.length - 1 ? `${line}
+` : line;
+    const trimmedLine = line.trimStart();
+    const currentCharacter = trimmedLine[0];
+    let currentLength = 0;
+    if (currentCharacter === "`" || currentCharacter === "~") {
+      while (trimmedLine[currentLength] === currentCharacter) {
+        currentLength += 1;
+      }
+    }
+    const closesFence = insideFence && currentCharacter === fenceCharacter && currentLength >= fenceLength && trimmedLine.slice(currentLength).trim() === "";
+    const opensFence = !insideFence && currentLength >= 3;
+    if (closesFence) {
+      insideFence = false;
+      pendingFence = [];
+      fenceCharacter = "";
+      fenceLength = 0;
+    } else if (opensFence) {
+      insideFence = true;
+      fenceCharacter = currentCharacter;
+      fenceLength = currentLength;
+      pendingFence.push(renderedLine);
+    } else if (insideFence) {
+      pendingFence.push(renderedLine);
+    } else {
+      output.push(renderedLine);
+    }
+  }
+  if (insideFence) {
+    output.push(...pendingFence);
+  }
+  return output.join("");
 }
 var authorityInjection = {
   id: "PS011",
@@ -41059,8 +41303,9 @@ var authorityInjection = {
       ctx.ast,
       (text, loc) => {
         const strippedText = stripFencedCodeBlocks2(text);
+        const normalizedText = strippedText.replace(/\s+/g, " ");
         for (const pattern of AUTHORITY_PATTERNS) {
-          if (pattern.test(strippedText)) {
+          if (pattern.test(strippedText) || pattern.test(normalizedText)) {
             ctx.report({
               message: `Authority injection pattern detected: ${pattern.source}`,
               location: loc,
@@ -44157,15 +44402,15 @@ var SECURITY_STRICT_MULTILINGUAL = {
 };
 
 // packages/compiler/src/compiler.ts
-import { dirname as dirname13, isAbsolute as isAbsolute10, join as join13, relative as relative10, resolve as resolve16, sep as sep7 } from "path";
+import { dirname as dirname13, isAbsolute as isAbsolute9, join as join13, relative as relative10, resolve as resolve16, sep as sep7 } from "path";
 
 // packages/compiler/src/hook-script-validator.ts
 init_src4();
 import { lstat as lstat7, realpath as realpath4 } from "fs/promises";
-import { dirname as dirname12, isAbsolute as isAbsolute9, relative as relative9, resolve as resolve15, sep as sep6 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute8, relative as relative9, resolve as resolve15, sep as sep6 } from "path";
 function isInside(root, candidate) {
   const relation = relative9(root, candidate);
-  return relation === "" || !relation.startsWith(`..${sep6}`) && relation !== ".." && !isAbsolute9(relation);
+  return relation === "" || !relation.startsWith(`..${sep6}`) && relation !== ".." && !isAbsolute8(relation);
 }
 function inferProjectRoot(localPath, configuredProjectRoot, entryPath) {
   if (configuredProjectRoot) return resolve15(configuredProjectRoot);
@@ -44310,7 +44555,7 @@ var Compiler = class _Compiler {
       formatTime: 0,
       totalTime: 0
     };
-    const sourceLabel = isAbsolute10(entryPath) ? relative10(process.cwd(), entryPath) : entryPath;
+    const sourceLabel = isAbsolute9(entryPath) ? relative10(process.cwd(), entryPath) : entryPath;
     this.logger.verbose("=== Stage 1: Resolve ===");
     const startResolve = Date.now();
     let resolved;
@@ -44395,7 +44640,7 @@ var Compiler = class _Compiler {
         const sourceFile = block.loc.file;
         const referenceRoot = sourceFile ? referenceRoots.find((root) => {
           const relation = relative10(resolve16(root.path), resolve16(sourceFile));
-          return relation === "" || relation !== ".." && !relation.startsWith(`..${sep7}`) && !isAbsolute10(relation);
+          return relation === "" || relation !== ".." && !relation.startsWith(`..${sep7}`) && !isAbsolute9(relation);
         }) : void 0;
         for (const [, skillValue] of Object.entries(block.content.properties)) {
           if (typeof skillValue !== "object" || skillValue === null || !("references" in skillValue))
@@ -44408,7 +44653,7 @@ var Compiler = class _Compiler {
             if (sourceFile && referenceRoot) {
               const resolvedReference = resolve16(dirname13(sourceFile), ref);
               const relation = relative10(resolve16(referenceRoot.path), resolvedReference);
-              if (relation !== "" && relation !== ".." && !relation.startsWith(`..${sep7}`) && !isAbsolute10(relation)) {
+              if (relation !== "" && relation !== ".." && !relation.startsWith(`..${sep7}`) && !isAbsolute9(relation)) {
                 const sourceReferences = registryReferencePaths.get(sourceFile) ?? /* @__PURE__ */ new Map();
                 const relativePath = relation.replaceAll("\\", "/");
                 const referenceKey = `${referenceRoot.repoUrl}\0${relativePath}\0${referenceRoot.version}`;
@@ -44700,12 +44945,12 @@ var Compiler = class _Compiler {
    */
   async watch(entryPath, options = {}) {
     const { default: chokidar2 } = await import("chokidar");
-    const { dirname: dirname27, resolve: resolve37 } = await import("path");
-    const baseDir = dirname27(resolve37(entryPath));
+    const { dirname: dirname28, resolve: resolve38 } = await import("path");
+    const baseDir = dirname28(resolve38(entryPath));
     const includePatterns = options.include ?? ["**/*.prs"];
     const excludePatterns = options.exclude ?? ["**/node_modules/**"];
     const debounceMs = options.debounce ?? 300;
-    const watchPatterns = includePatterns.map((p) => resolve37(baseDir, p));
+    const watchPatterns = includePatterns.map((p) => resolve38(baseDir, p));
     let debounceTimer = null;
     let pendingChanges = [];
     const handleChange = async (changedFiles) => {
@@ -44843,7 +45088,7 @@ var Compiler = class _Compiler {
 };
 
 // packages/cli/src/output/pager.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 function isTTY() {
   return process.stdout.isTTY === true;
 }
@@ -44880,7 +45125,7 @@ var Pager = class {
       }
       return;
     }
-    return new Promise((resolve37) => {
+    return new Promise((resolve38) => {
       const pagerCmd = getPagerCommand();
       const [cmd, ...args] = pagerCmd.split(" ");
       if (cmd === "less" && !args.includes("-R")) {
@@ -44888,10 +45133,10 @@ var Pager = class {
       }
       if (!cmd) {
         console.log(content);
-        resolve37();
+        resolve38();
         return;
       }
-      const pager = spawn(cmd, args, {
+      const pager = spawn2(cmd, args, {
         stdio: ["pipe", "inherit", "inherit"],
         env: {
           ...process.env,
@@ -44901,17 +45146,17 @@ var Pager = class {
       });
       pager.on("error", (_err) => {
         console.log(content);
-        resolve37();
+        resolve38();
       });
       pager.on("close", () => {
-        resolve37();
+        resolve38();
       });
       if (pager.stdin) {
         pager.stdin.write(content);
         pager.stdin.end();
       } else {
         console.log(content);
-        resolve37();
+        resolve38();
       }
     });
   }
@@ -44925,14 +45170,14 @@ init_services();
 
 // packages/cli/src/utils/registry-resolver.ts
 import { existsSync as existsSync12 } from "fs";
-import { isAbsolute as isAbsolute11, join as join14, relative as relative11, resolve as resolve17, sep as sep8 } from "path";
+import { isAbsolute as isAbsolute10, join as join14, relative as relative11, resolve as resolve17, sep as sep8 } from "path";
 async function resolveRegistrySubPath(repositoryPath, subPath) {
   if (!subPath) {
     return repositoryPath;
   }
   const result = resolve17(repositoryPath, subPath);
   const relation = relative11(resolve17(repositoryPath), result);
-  if (relation === ".." || relation.startsWith(`..${sep8}`) || isAbsolute11(relation)) {
+  if (relation === ".." || relation.startsWith(`..${sep8}`) || isAbsolute10(relation)) {
     throw new Error(`Registry path escapes its repository: ${subPath}`);
   }
   if (existsSync12(result) && !await isRealPathInside(result, repositoryPath)) {
@@ -45097,19 +45342,19 @@ function detectOutputConflicts(targets) {
 }
 
 // packages/cli/src/utils/managed-output-cleanup.ts
-import { constants as constants2 } from "node:fs";
-import { execFile as execFile2, spawn as spawn2 } from "node:child_process";
+import { constants as constants3 } from "node:fs";
+import { execFile as execFile2, spawn as spawn3 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import {
   lstat as lstat8,
   mkdir as mkdir4,
-  open as open2,
+  open as open3,
   readFile as readFile14,
   readdir as readdir6,
   rmdir,
   unlink as unlink2
 } from "node:fs/promises";
-import { basename as basename13, dirname as dirname14, isAbsolute as isAbsolute12, relative as relative12, resolve as resolve18 } from "node:path";
+import { basename as basename13, dirname as dirname14, isAbsolute as isAbsolute11, relative as relative12, resolve as resolve18 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFileAsync2 = promisify2(execFile2);
 var PROMPTSCRIPT_MARKER_PATTERNS = [
@@ -45437,7 +45682,7 @@ function collectManagedDirectories(outputs, outputRoot) {
   for (const output of outputs.values()) {
     for (const directory of output.managedOutputDirectories ?? []) {
       const normalized = directory.replace(/\\/g, "/");
-      if (!normalized || isAbsolute12(normalized)) continue;
+      if (!normalized || isAbsolute11(normalized)) continue;
       if (normalized.split("/").some((segment) => segment === "..")) continue;
       const absolutePath = resolve18(outputRoot, normalized);
       if (isWithin(outputRoot, absolutePath)) directories.add(absolutePath);
@@ -45458,7 +45703,7 @@ function collectManagedFiles(outputs, outputRoot) {
   for (const output of outputs.values()) {
     for (const file of output.managedOutputFiles ?? []) {
       const normalized = file.replace(/\\/g, "/");
-      if (!normalized || isAbsolute12(normalized)) continue;
+      if (!normalized || isAbsolute11(normalized)) continue;
       if (normalized.split("/").some((segment) => segment === "..")) continue;
       const absolutePath = resolve18(outputRoot, normalized);
       if (isWithin(outputRoot, absolutePath)) files.add(absolutePath);
@@ -45565,7 +45810,7 @@ async function removeHookOutputIfUnchanged(file, outputRoot, expectedContent) {
 async function guardedRewrite(directory, name, directoryStat, fileStat, expectedContent, content) {
   const expectedHash = createHash4("sha256").update(expectedContent).digest("hex");
   return new Promise((resolveResult) => {
-    const child = spawn2(
+    const child = spawn3(
       process.execPath,
       [
         "-e",
@@ -45603,7 +45848,7 @@ async function guardedRewrite(directory, name, directoryStat, fileStat, expected
 }
 async function guardedCreate(directory, name, directoryStat, content, mode) {
   return new Promise((resolveResult) => {
-    const child = spawn2(
+    const child = spawn3(
       process.execPath,
       [
         "-e",
@@ -45739,7 +45984,7 @@ async function openAncestorDirectories(root, directory) {
 }
 async function openOrCreateAncestorDirectories(root, file) {
   const relativePath = relative12(root, file);
-  if (relativePath.startsWith("..") || isAbsolute12(relativePath)) {
+  if (relativePath.startsWith("..") || isAbsolute11(relativePath)) {
     return void 0;
   }
   await mkdir4(root, { recursive: true });
@@ -45799,7 +46044,7 @@ async function closeDirectoryGuards(guards) {
 }
 async function safeOpenDirectory(path2) {
   try {
-    return await open2(path2, constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW);
+    return await open3(path2, constants3.O_RDONLY | constants3.O_DIRECTORY | constants3.O_NOFOLLOW);
   } catch (error) {
     if (isNodeError(error) && (error.code === "ENOENT" || error.code === "ENOTDIR" || error.code === "ELOOP")) {
       return void 0;
@@ -46172,7 +46417,7 @@ function scanHookOwnership(value) {
 }
 function isWithin(root, candidate) {
   const relativePath = relative12(root, candidate);
-  return relativePath === "" || !relativePath.startsWith("..") && !isAbsolute12(relativePath);
+  return relativePath === "" || !relativePath.startsWith("..") && !isAbsolute11(relativePath);
 }
 function isNodeError(error) {
   return error instanceof Error && "code" in error;
@@ -46302,10 +46547,10 @@ function getBuildProfile(config, buildName) {
 }
 function resolveOutputBase(projectRoot, output) {
   if (!output) return projectRoot;
-  return isAbsolute13(output) ? output : resolve19(projectRoot, output);
+  return isAbsolute12(output) ? output : resolve19(projectRoot, output);
 }
 function resolveProjectPath(projectRoot, path2) {
-  return isAbsolute13(path2) ? path2 : resolve19(projectRoot, path2);
+  return isAbsolute12(path2) ? path2 : resolve19(projectRoot, path2);
 }
 function resolveCompileConfigPath(projectRoot, options) {
   if (options.config) {
@@ -49253,7 +49498,7 @@ import { resolve as resolve28, join as join22 } from "path";
 
 // packages/cli/src/commands/lock-reference-scanner.ts
 import { readFile as readFile22 } from "fs/promises";
-import { dirname as dirname19, isAbsolute as isAbsolute14, relative as relative15, resolve as resolve27, sep as sep9 } from "path";
+import { dirname as dirname19, isAbsolute as isAbsolute13, relative as relative15, resolve as resolve27, sep as sep9 } from "path";
 async function collectRegistryReferences(ast, roots, existing = {}, lockedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   const references = {};
   const sortedRoots = [...roots].sort(
@@ -49271,7 +49516,7 @@ async function collectRegistryReferences(ast, roots, existing = {}, lockedAt = (
       if (!Array.isArray(refs)) continue;
       for (const ref of refs) {
         if (typeof ref !== "string") continue;
-        const referencePath = isAbsolute14(ref) ? resolve27(ref) : resolve27(dirname19(block.loc.file), ref);
+        const referencePath = isAbsolute13(ref) ? resolve27(ref) : resolve27(dirname19(block.loc.file), ref);
         const root = sortedRoots.find(
           (candidate) => isInsideCachePath(referencePath, candidate.cachePath)
         );
@@ -49601,7 +49846,17 @@ async function updateCommand(packageArg, options) {
 init_loader2();
 init_console();
 init_src();
-import { mkdir as mkdir9, mkdtemp, readFile as readFile24, readdir as readdir7, rename, rm, writeFile as writeFile9 } from "fs/promises";
+import {
+  lstat as lstat9,
+  mkdir as mkdir9,
+  mkdtemp,
+  readFile as readFile24,
+  readdir as readdir7,
+  realpath as realpath5,
+  rename,
+  rm,
+  writeFile as writeFile9
+} from "fs/promises";
 import { existsSync as existsSync21 } from "fs";
 import { basename as basename14, dirname as dirname20, join as join23, resolve as resolve30 } from "path";
 import { parse as parseYaml13 } from "yaml";
@@ -49625,11 +49880,11 @@ async function vendorSyncCommand(options) {
       return;
     }
     const vendorDir = resolve30(VENDOR_DIR);
+    await validateVendorParentDirectory(vendorDir, true);
     const recoveredBackup = await recoverVendorDirectory(vendorDir);
     if (recoveredBackup) {
       ConsoleOutput.warn(`Recovered interrupted vendor update: ${recoveredBackup}`);
     }
-    await mkdir9(dirname20(vendorDir), { recursive: true });
     const stagingDir = await mkdtemp(join23(dirname20(vendorDir), ".vendor-stage-"));
     try {
       const manifest = { version: 1, dependencies: {} };
@@ -49698,6 +49953,7 @@ async function vendorCheckCommand(_options) {
     const deps = getRepositoryDependencies(lockfile);
     validateDependencyPaths(deps);
     const vendorDir = resolve30(VENDOR_DIR);
+    await validateVendorParentDirectory(vendorDir, false);
     const recoveredBackup = await recoverVendorDirectory(vendorDir);
     if (recoveredBackup) {
       ConsoleOutput.warn(`Recovered interrupted vendor update: ${recoveredBackup}`);
@@ -49805,6 +50061,24 @@ function validateDependencyPaths(dependencies) {
 function toCloneUrl(repoUrl) {
   return /^[a-z][a-z\d+.-]*:\/\//i.test(repoUrl) || repoUrl.startsWith("git@") ? repoUrl : `https://${repoUrl}`;
 }
+async function validateVendorParentDirectory(vendorDir, createIfMissing) {
+  const projectRoot = await realpath5(".");
+  const parentDir = dirname20(vendorDir);
+  if (createIfMissing) {
+    await mkdir9(parentDir, { recursive: true });
+  }
+  try {
+    const [metadata, parentRealPath] = await Promise.all([lstat9(parentDir), realpath5(parentDir)]);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory() || parentRealPath === projectRoot || !isInsideCachePath(parentRealPath, projectRoot)) {
+      throw new Error(`Unsafe vendor parent directory: ${parentDir}`);
+    }
+  } catch (error) {
+    if (!createIfMissing && typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+}
 async function replaceVendorDirectory(stagingDir, vendorDir) {
   if (!existsSync21(vendorDir)) {
     await rename(stagingDir, vendorDir);
@@ -50741,14 +51015,1169 @@ Usage: echo '{"file_path":"..."}' | prs hook ${action}
 // packages/cli/src/cli.ts
 init_hooks();
 
+// packages/cli/src/commands/telemetry.ts
+init_console();
+
+// packages/cli/src/telemetry/config.ts
+import { existsSync as existsSync27 } from "node:fs";
+import { mkdir as mkdir11, readFile as readFile27, rename as rename2, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname21, isAbsolute as isAbsolute14, join as join29, resolve as resolve34 } from "node:path";
+import { parseDocument } from "yaml";
+
+// packages/telemetry/src/config.ts
+import { homedir as homedir6 } from "node:os";
+import { join as join27 } from "node:path";
+var DEFAULT_TELEMETRY_ENDPOINT = "https://telemetry.guziak.net/v1/events";
+function isDisabled(value) {
+  if (value === void 0) {
+    return false;
+  }
+  return ["0", "false", "no", "off"].includes(value.trim().toLowerCase());
+}
+function isDoNotTrackEnabled(value) {
+  if (value === void 0) {
+    return false;
+  }
+  const normalized = value.trim();
+  return normalized !== "" && normalized !== "0";
+}
+function isSecureEndpoint(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.username === "" && url.password === "";
+  } catch {
+    return false;
+  }
+}
+function resolveTelemetryConfig(input2 = {}) {
+  const environment = input2.environment ?? process.env;
+  const endpoint = input2.endpoint ?? environment["PROMPTSCRIPT_TELEMETRY_ENDPOINT"] ?? DEFAULT_TELEMETRY_ENDPOINT;
+  const vetoes = [];
+  if (isDoNotTrackEnabled(environment["DO_NOT_TRACK"])) {
+    vetoes.push("DO_NOT_TRACK");
+  }
+  if (isDisabled(environment["PROMPTSCRIPT_TELEMETRY"])) {
+    vetoes.push("PROMPTSCRIPT_TELEMETRY");
+  }
+  if (input2.userEnabled === false) {
+    vetoes.push("user config");
+  }
+  if (input2.projectEnabled === false) {
+    vetoes.push("project config");
+  }
+  if (input2.configurationValid === false) {
+    vetoes.push("configuration unavailable");
+  }
+  if (!isSecureEndpoint(endpoint)) {
+    vetoes.push("insecure endpoint");
+  }
+  return {
+    enabled: vetoes.length === 0,
+    endpoint,
+    cacheDirectory: input2.cacheDirectory ?? join27(homedir6(), ".promptscript", ".cache"),
+    vetoes
+  };
+}
+
+// packages/telemetry/telemetry-schema/promptscript-v1.json
+var promptscript_v1_default = {
+  eventSchema: 1,
+  commands: [
+    "init",
+    "compile",
+    "build",
+    "validate",
+    "inspect",
+    "pull",
+    "diff",
+    "check",
+    "update-check",
+    "serve",
+    "import",
+    "migrate",
+    "upgrade",
+    "lock",
+    "update",
+    "vendor-sync",
+    "vendor-check",
+    "resolve",
+    "hooks",
+    "skills-add",
+    "skills-remove",
+    "skills-list",
+    "skills-update",
+    "registry",
+    "other"
+  ],
+  outcomes: ["success", "error", "cancelled"],
+  features: ["dry_run", "watch", "strict", "ci", "build_profile"],
+  targets: [
+    "github",
+    "claude",
+    "cursor",
+    "antigravity",
+    "factory",
+    "opencode",
+    "gemini",
+    "windsurf",
+    "cline",
+    "roo",
+    "codex",
+    "continue",
+    "augment",
+    "goose",
+    "kilo",
+    "amp",
+    "trae",
+    "junie",
+    "kiro",
+    "cortex",
+    "crush",
+    "command-code",
+    "kode",
+    "mcpjam",
+    "mistral-vibe",
+    "mux",
+    "openhands",
+    "pi",
+    "qoder",
+    "qwen-code",
+    "zencoder",
+    "neovate",
+    "pochi",
+    "adal",
+    "iflow",
+    "openclaw",
+    "codebuddy",
+    "aider",
+    "amazon-q",
+    "warp",
+    "zed",
+    "jules",
+    "devin",
+    "grok",
+    "kimi",
+    "mimo",
+    "deep-agents",
+    "forgecode"
+  ],
+  limits: {
+    maxEvents: 25,
+    maxCount: 1e6,
+    maxDurationSumMs: 1e12
+  }
+};
+
+// packages/telemetry/src/schema.ts
+var TELEMETRY_EVENT_SCHEMA = promptscript_v1_default.eventSchema;
+var MAX_EVENTS_PER_BATCH = promptscript_v1_default.limits.maxEvents;
+var MAX_EVENT_COUNT = promptscript_v1_default.limits.maxCount;
+var MAX_DURATION_SUM_MS = promptscript_v1_default.limits.maxDurationSumMs;
+var COMMANDS = new Set(promptscript_v1_default.commands);
+var OUTCOMES = new Set(promptscript_v1_default.outcomes);
+var FEATURES = new Set(promptscript_v1_default.features);
+var TARGETS = new Set(promptscript_v1_default.targets);
+function sanitizeCommand(value) {
+  return COMMANDS.has(value) ? value : "other";
+}
+function isTelemetryOutcome(value) {
+  return OUTCOMES.has(value);
+}
+function sanitizeFeature(value) {
+  if (FEATURES.has(value)) {
+    return value;
+  }
+  const parts = value.split(":");
+  const target = parts[1];
+  if (parts.length === 2 && parts[0] === "target" && target !== void 0 && TARGETS.has(target)) {
+    return value;
+  }
+  return null;
+}
+function isExcludedCommand(value) {
+  return value === "hook" || value === "telemetry" || value === "__telemetry-flush";
+}
+
+// packages/telemetry/src/payload.ts
+function metadataKey(record) {
+  return [record.app_version, record.runtime_version, record.os, record.arch].join(":");
+}
+function eventKey(event) {
+  return event.name === "command" ? `${event.name}:${event.command}:${event.outcome}` : `${event.name}:${event.feature}`;
+}
+function copyEvent(event) {
+  return event.name === "command" ? { ...event } : { ...event };
+}
+function canAggregate(target, source) {
+  if (target.count + source.count > MAX_EVENT_COUNT) {
+    return false;
+  }
+  if (target.name === "command" && source.name === "command") {
+    return target.duration_ms_sum + source.duration_ms_sum <= MAX_DURATION_SUM_MS;
+  }
+  return true;
+}
+function addEvent(target, source) {
+  target.count += source.count;
+  if (target.name === "command" && source.name === "command") {
+    target.duration_ms_sum += source.duration_ms_sum;
+  }
+}
+function aggregateRecords(records) {
+  const aggregates = [];
+  records.forEach((record, index) => {
+    const key = `${metadataKey(record)}:${eventKey(record.event)}`;
+    const aggregate = aggregates.find(
+      (candidate) => `${metadataKey(candidate.metadata)}:${eventKey(candidate.event)}` === key && canAggregate(candidate.event, record.event)
+    );
+    if (aggregate !== void 0) {
+      addEvent(aggregate.event, record.event);
+      aggregate.sourceIndexes.push(index);
+      return;
+    }
+    aggregates.push({
+      metadata: {
+        app_version: record.app_version,
+        runtime_version: record.runtime_version,
+        os: record.os,
+        arch: record.arch
+      },
+      event: copyEvent(record.event),
+      sourceIndexes: [index]
+    });
+  });
+  return aggregates;
+}
+function toPayload(batch) {
+  return {
+    schema: 1,
+    app: "promptscript",
+    event_schema: TELEMETRY_EVENT_SCHEMA,
+    runtime: "node",
+    ...batch.metadata,
+    events: batch.events
+  };
+}
+function buildTelemetryBatches(records) {
+  const builders = [];
+  for (const aggregate of aggregateRecords(records)) {
+    const key = eventKey(aggregate.event);
+    let batch = builders.find(
+      (candidate) => metadataKey(candidate.metadata) === metadataKey(aggregate.metadata) && candidate.events.length < MAX_EVENTS_PER_BATCH && !candidate.eventKeys.has(key)
+    );
+    if (batch === void 0) {
+      batch = {
+        metadata: aggregate.metadata,
+        events: [],
+        eventKeys: /* @__PURE__ */ new Set(),
+        sourceIndexes: /* @__PURE__ */ new Set()
+      };
+      builders.push(batch);
+    }
+    batch.events.push(aggregate.event);
+    batch.eventKeys.add(key);
+    aggregate.sourceIndexes.forEach((index) => batch?.sourceIndexes.add(index));
+  }
+  return builders.map((batch) => ({
+    payload: toPayload(batch),
+    sourceIndexes: [...batch.sourceIndexes]
+  }));
+}
+
+// packages/telemetry/src/spool.ts
+import {
+  appendFileSync,
+  existsSync as existsSync26,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync7,
+  readdirSync as readdirSync2,
+  renameSync as renameSync2,
+  rmSync,
+  statSync as statSync3,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { join as join28 } from "node:path";
+var ACTIVE_FILE = "telemetry.ndjson";
+var INFLIGHT_FILE = "telemetry.inflight.ndjson";
+var QUARANTINE_FILE = "telemetry-quarantine.ndjson";
+var STATE_FILE = "telemetry-state.json";
+var LOCK_DIRECTORY = "telemetry.lock";
+var FLUSH_LOCK_DIRECTORY = "telemetry-flush.lock";
+var SIDECAR_PATTERN = /^telemetry\.\d+\.\d+\.\d+\.ndjson$/;
+var MAX_SPOOL_BYTES = 64 * 1024;
+var MAX_SPOOL_RECORDS = 200;
+var STALE_LOCK_MS = 3e4;
+var sidecarSequence = 0;
+function pathFor(cacheDirectory, name) {
+  return join28(cacheDirectory, name);
+}
+function isNodeError2(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+function removeStaleLock(lockPath) {
+  try {
+    if (Date.now() - statSync3(lockPath).mtimeMs > STALE_LOCK_MS) {
+      rmSync(lockPath, { recursive: true });
+    }
+  } catch {
+  }
+}
+function acquireLock2(cacheDirectory, lockDirectory = LOCK_DIRECTORY) {
+  mkdirSync2(cacheDirectory, { recursive: true });
+  const lockPath = pathFor(cacheDirectory, lockDirectory);
+  try {
+    mkdirSync2(lockPath);
+    return true;
+  } catch (error) {
+    if (!isNodeError2(error, "EEXIST")) {
+      return false;
+    }
+    removeStaleLock(lockPath);
+    try {
+      mkdirSync2(lockPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+function releaseLock2(cacheDirectory, lockDirectory = LOCK_DIRECTORY) {
+  try {
+    rmSync(pathFor(cacheDirectory, lockDirectory), { recursive: true });
+  } catch {
+  }
+}
+function compactLines(lines) {
+  const selected = [];
+  let bytes = 0;
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const line = lines[index];
+    const lineBytes = Buffer.byteLength(`${line}
+`);
+    if (selected.length >= MAX_SPOOL_RECORDS || bytes + lineBytes > MAX_SPOOL_BYTES) {
+      break;
+    }
+    selected.push(line);
+    bytes += lineBytes;
+  }
+  return selected.reverse();
+}
+function readLines(filePath) {
+  try {
+    return readFileSync7(filePath, "utf8").split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function writeLines(filePath, lines) {
+  if (lines.length === 0) {
+    try {
+      unlinkSync3(filePath);
+    } catch (error) {
+      if (!isNodeError2(error, "ENOENT")) {
+        throw error;
+      }
+    }
+    return;
+  }
+  const temporaryPath = `${filePath}.${process.pid}.tmp`;
+  writeFileSync5(temporaryPath, `${lines.join("\n")}
+`, { encoding: "utf8", mode: 384 });
+  renameSync2(temporaryPath, filePath);
+}
+function compactFile(filePath) {
+  writeLines(filePath, compactLines(readLines(filePath)));
+}
+function parseTelemetryEvent(value) {
+  if (typeof value !== "object" || value === null || !("name" in value)) {
+    return null;
+  }
+  const event = value;
+  if (!Number.isSafeInteger(event["count"]) || Number(event["count"]) < 1 || Number(event["count"]) > MAX_EVENT_COUNT) {
+    return null;
+  }
+  const count = Number(event["count"]);
+  if (event["name"] === "command") {
+    if (typeof event["command"] === "string" && sanitizeCommand(event["command"]) === event["command"] && typeof event["outcome"] === "string" && isTelemetryOutcome(event["outcome"]) && typeof event["duration_ms_sum"] === "number" && Number.isSafeInteger(event["duration_ms_sum"]) && event["duration_ms_sum"] >= 0 && event["duration_ms_sum"] <= MAX_DURATION_SUM_MS) {
+      return {
+        name: "command",
+        command: event["command"],
+        outcome: event["outcome"],
+        count,
+        duration_ms_sum: event["duration_ms_sum"]
+      };
+    }
+    return null;
+  }
+  if (event["name"] === "feature" && typeof event["feature"] === "string") {
+    const feature = sanitizeFeature(event["feature"]);
+    return feature === null ? null : { name: "feature", feature, count };
+  }
+  return null;
+}
+function parseRecord(line) {
+  try {
+    const value = JSON.parse(line);
+    if (typeof value !== "object" || value === null || !("event" in value)) {
+      return null;
+    }
+    const record = value;
+    const event = parseTelemetryEvent(record["event"]);
+    if (typeof record["app_version"] !== "string" || !/^\d{1,5}\.\d{1,5}\.\d{1,5}(?:[-+][0-9A-Za-z.-]{1,32})?$/.test(record["app_version"]) || typeof record["runtime_version"] !== "string" || !/^\d{1,3}$/.test(record["runtime_version"]) || !["darwin", "linux", "windows", "other"].includes(String(record["os"])) || !["arm64", "x86_64", "other"].includes(String(record["arch"])) || event === null) {
+      return null;
+    }
+    return {
+      app_version: record["app_version"],
+      runtime_version: record["runtime_version"],
+      os: record["os"],
+      arch: record["arch"],
+      event
+    };
+  } catch {
+    return null;
+  }
+}
+function parseLines(lines) {
+  const records = [];
+  let corruptLines = 0;
+  for (const line of lines) {
+    const record = parseRecord(line);
+    if (record === null) {
+      corruptLines += 1;
+    } else {
+      records.push(record);
+    }
+  }
+  return { records, corruptLines };
+}
+function sidecarFiles(cacheDirectory) {
+  try {
+    return readdirSync2(cacheDirectory).filter((name) => SIDECAR_PATTERN.test(name)).map((name) => pathFor(cacheDirectory, name));
+  } catch {
+    return [];
+  }
+}
+function mergeSidecars(cacheDirectory) {
+  const activePath = pathFor(cacheDirectory, ACTIVE_FILE);
+  for (const sidecarPath of sidecarFiles(cacheDirectory)) {
+    for (const line of readLines(sidecarPath)) {
+      appendFileSync(activePath, `${line}
+`, { encoding: "utf8", mode: 384 });
+    }
+    try {
+      unlinkSync3(sidecarPath);
+    } catch {
+    }
+  }
+  compactFile(activePath);
+}
+function appendSpoolRecords(cacheDirectory, records) {
+  if (records.length === 0) {
+    return;
+  }
+  const lines = records.map((record) => JSON.stringify(record));
+  try {
+    if (acquireLock2(cacheDirectory)) {
+      try {
+        const activePath = pathFor(cacheDirectory, ACTIVE_FILE);
+        appendFileSync(activePath, `${lines.join("\n")}
+`, {
+          encoding: "utf8",
+          mode: 384
+        });
+        compactFile(activePath);
+      } finally {
+        releaseLock2(cacheDirectory);
+      }
+      return;
+    }
+    mkdirSync2(cacheDirectory, { recursive: true });
+    sidecarSequence += 1;
+    const sidecarPath = pathFor(
+      cacheDirectory,
+      `telemetry.${process.pid}.${Date.now()}.${sidecarSequence}.ndjson`
+    );
+    const temporaryPath = `${sidecarPath}.tmp`;
+    writeFileSync5(temporaryPath, `${lines.join("\n")}
+`, { encoding: "utf8", mode: 384 });
+    renameSync2(temporaryPath, sidecarPath);
+  } catch {
+  }
+}
+function claimSpool(cacheDirectory) {
+  if (!acquireLock2(cacheDirectory)) {
+    return null;
+  }
+  try {
+    const inflightPath = pathFor(cacheDirectory, INFLIGHT_FILE);
+    if (existsSync26(inflightPath) && readLines(inflightPath).length === 0) {
+      try {
+        unlinkSync3(inflightPath);
+      } catch {
+        return null;
+      }
+    }
+    if (!existsSync26(inflightPath)) {
+      mergeSidecars(cacheDirectory);
+      const activePath = pathFor(cacheDirectory, ACTIVE_FILE);
+      if (existsSync26(activePath)) {
+        renameSync2(activePath, inflightPath);
+      }
+    }
+    const lines = readLines(inflightPath);
+    return lines.length === 0 ? null : parseLines(lines);
+  } finally {
+    releaseLock2(cacheDirectory);
+  }
+}
+function completeSpoolClaim(cacheDirectory, remainingRecords, rejectedRecords = []) {
+  if (!acquireLock2(cacheDirectory)) {
+    return false;
+  }
+  try {
+    try {
+      writeLines(
+        pathFor(cacheDirectory, INFLIGHT_FILE),
+        remainingRecords.map((record) => JSON.stringify(record))
+      );
+      if (rejectedRecords.length > 0) {
+        const quarantinePath = pathFor(cacheDirectory, QUARANTINE_FILE);
+        for (const record of rejectedRecords) {
+          appendFileSync(quarantinePath, `${JSON.stringify(record)}
+`, {
+            encoding: "utf8",
+            mode: 384
+          });
+        }
+        compactFile(quarantinePath);
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  } finally {
+    releaseLock2(cacheDirectory);
+  }
+}
+function prepareSpoolAttempt(cacheDirectory, remainingRecords) {
+  if (!acquireLock2(cacheDirectory)) {
+    return false;
+  }
+  try {
+    try {
+      writeLines(
+        pathFor(cacheDirectory, INFLIGHT_FILE),
+        remainingRecords.map((record) => JSON.stringify(record))
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  } finally {
+    releaseLock2(cacheDirectory);
+  }
+}
+function acquireFlushLease(cacheDirectory) {
+  return acquireLock2(cacheDirectory, FLUSH_LOCK_DIRECTORY);
+}
+function releaseFlushLease(cacheDirectory) {
+  releaseLock2(cacheDirectory, FLUSH_LOCK_DIRECTORY);
+}
+function getSpoolInfo(cacheDirectory) {
+  const files = [
+    pathFor(cacheDirectory, ACTIVE_FILE),
+    pathFor(cacheDirectory, INFLIGHT_FILE),
+    ...sidecarFiles(cacheDirectory)
+  ];
+  let records = 0;
+  let bytes = 0;
+  for (const file of files) {
+    const lines = readLines(file);
+    records += lines.length;
+    try {
+      bytes += statSync3(file).size;
+    } catch {
+    }
+  }
+  return { records, bytes };
+}
+function readFlushState(cacheDirectory) {
+  try {
+    const value = JSON.parse(readFileSync7(pathFor(cacheDirectory, STATE_FILE), "utf8"));
+    return typeof value === "object" && value !== null ? value : {};
+  } catch {
+    return {};
+  }
+}
+function writeFlushState(cacheDirectory, state) {
+  try {
+    mkdirSync2(cacheDirectory, { recursive: true });
+    const statePath = pathFor(cacheDirectory, STATE_FILE);
+    const temporaryPath = `${statePath}.${process.pid}.tmp`;
+    writeFileSync5(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384
+    });
+    renameSync2(temporaryPath, statePath);
+  } catch {
+  }
+}
+
+// packages/telemetry/src/transport.ts
+function isSecureEndpoint2(endpoint) {
+  try {
+    const url = new URL(endpoint);
+    return url.protocol === "https:" && url.username === "" && url.password === "";
+  } catch {
+    return false;
+  }
+}
+async function postTelemetry(endpoint, payload, timeoutMs, fetchImplementation = fetch) {
+  if (!isSecureEndpoint2(endpoint)) {
+    return "rejected";
+  }
+  const controller = new AbortController();
+  const timeout = setTimeout(
+    () => {
+      controller.abort();
+    },
+    Math.max(0, timeoutMs)
+  );
+  try {
+    const response = await fetchImplementation(endpoint, {
+      method: "POST",
+      redirect: "manual",
+      signal: controller.signal,
+      headers: {
+        "Content-Type": "application/json",
+        "User-Agent": "promptscript-telemetry/1"
+      },
+      body: JSON.stringify(payload)
+    });
+    if (response.ok) {
+      return "sent";
+    }
+    if (response.status >= 300 && response.status < 400) {
+      return "rejected";
+    }
+    if (response.status === 429 || response.status >= 500) {
+      return "retryable";
+    }
+    if (response.status >= 400 && response.status < 500) {
+      return "rejected";
+    }
+    return "retryable";
+  } catch {
+    return "unknown";
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// packages/telemetry/src/flush.ts
+var FLUSH_BUDGET_MS = 5e3;
+var MAX_BATCHES_PER_FLUSH = 3;
+var COMPLETION_RETRIES = 20;
+function delay(milliseconds) {
+  return new Promise((resolve38) => setTimeout(resolve38, milliseconds));
+}
+async function persistCompletion(cacheDirectory, remainingRecords, rejectedRecords) {
+  for (let attempt = 0; attempt < COMPLETION_RETRIES; attempt += 1) {
+    if (completeSpoolClaim(cacheDirectory, remainingRecords, rejectedRecords)) {
+      return true;
+    }
+    await delay(10);
+  }
+  return false;
+}
+async function persistAttempt(cacheDirectory, remainingRecords) {
+  for (let attempt = 0; attempt < COMPLETION_RETRIES; attempt += 1) {
+    if (prepareSpoolAttempt(cacheDirectory, remainingRecords)) {
+      return true;
+    }
+    await delay(10);
+  }
+  return false;
+}
+async function runFlush(config, fetchImplementation = fetch) {
+  const emptyResult = {
+    attempted: false,
+    deliveredRecords: 0,
+    rejectedRecords: 0,
+    remainingRecords: 0
+  };
+  if (!config.enabled || !acquireFlushLease(config.cacheDirectory)) {
+    return emptyResult;
+  }
+  try {
+    const claim = claimSpool(config.cacheDirectory);
+    if (claim === null) {
+      return emptyResult;
+    }
+    const state = readFlushState(config.cacheDirectory);
+    const startedAt = Date.now();
+    writeFlushState(config.cacheDirectory, {
+      ...state,
+      lastAttempt: new Date(startedAt).toISOString(),
+      ...claim.corruptLines > 0 ? { lastError: `Skipped ${claim.corruptLines} corrupt spool record(s)` } : {}
+    });
+    const remainingIndexes = new Set(claim.records.map((_record, index) => index));
+    const rejectedIndexes = /* @__PURE__ */ new Set();
+    const batches = buildTelemetryBatches(claim.records).slice(0, MAX_BATCHES_PER_FLUSH);
+    let deliveredRecords = 0;
+    let stoppedForRetry = false;
+    for (const batch of batches) {
+      let remainingBudget = FLUSH_BUDGET_MS - (Date.now() - startedAt);
+      if (remainingBudget <= 0) {
+        stoppedForRetry = true;
+        break;
+      }
+      const pendingRecords = claim.records.filter(
+        (_record, index) => remainingIndexes.has(index) && !batch.sourceIndexes.includes(index)
+      );
+      if (!await persistAttempt(config.cacheDirectory, pendingRecords)) {
+        stoppedForRetry = true;
+        break;
+      }
+      for (const index of batch.sourceIndexes) {
+        remainingIndexes.delete(index);
+      }
+      remainingBudget = FLUSH_BUDGET_MS - (Date.now() - startedAt);
+      if (remainingBudget <= 0) {
+        for (const index of batch.sourceIndexes) {
+          remainingIndexes.add(index);
+        }
+        stoppedForRetry = true;
+        break;
+      }
+      const result = await postTelemetry(
+        config.endpoint,
+        batch.payload,
+        remainingBudget,
+        fetchImplementation
+      );
+      if (result === "sent" || result === "unknown") {
+        deliveredRecords += batch.sourceIndexes.length;
+        if (result === "unknown") {
+          break;
+        }
+        continue;
+      }
+      if (result === "rejected") {
+        for (const index of batch.sourceIndexes) {
+          rejectedIndexes.add(index);
+        }
+        continue;
+      }
+      for (const index of batch.sourceIndexes) {
+        remainingIndexes.add(index);
+      }
+      stoppedForRetry = true;
+      break;
+    }
+    const remainingRecords = claim.records.filter((_record, index) => remainingIndexes.has(index));
+    const rejectedRecords = claim.records.filter((_record, index) => rejectedIndexes.has(index));
+    const persisted = await persistCompletion(
+      config.cacheDirectory,
+      remainingRecords,
+      rejectedRecords
+    );
+    const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const lastError = stoppedForRetry ? "Delivery deferred after retryable failure" : rejectedRecords.length > 0 ? `Collector rejected ${rejectedRecords.length} record(s)` : !persisted ? "Could not finalize telemetry spool" : claim.corruptLines > 0 ? `Skipped ${claim.corruptLines} corrupt spool record(s)` : void 0;
+    writeFlushState(config.cacheDirectory, {
+      ...readFlushState(config.cacheDirectory),
+      ...remainingRecords.length === 0 && persisted ? { lastSuccess: finishedAt } : {},
+      lastError
+    });
+    return {
+      attempted: batches.length > 0,
+      deliveredRecords,
+      rejectedRecords: rejectedRecords.length,
+      remainingRecords: remainingRecords.length
+    };
+  } finally {
+    releaseFlushLease(config.cacheDirectory);
+  }
+}
+
+// packages/telemetry/src/reporter.ts
+import { spawn as spawn4 } from "node:child_process";
+import { performance } from "node:perf_hooks";
+var FLUSH_INTERVAL_MS = 4 * 60 * 60 * 1e3;
+var FLUSH_RECORD_THRESHOLD = 50;
+var TelemetrySession = class {
+  config;
+  metadata;
+  command;
+  features;
+  startTime;
+  excluded;
+  finished = false;
+  constructor(options) {
+    this.config = options.config;
+    this.metadata = options.metadata;
+    this.excluded = isExcludedCommand(options.command);
+    this.command = sanitizeCommand(options.command);
+    this.features = (options.features ?? []).map((feature) => sanitizeFeature(feature)).filter((feature) => feature !== null);
+    this.startTime = options.startTime ?? performance.now();
+  }
+  finish(outcome) {
+    if (this.finished || !this.config.enabled || this.excluded) {
+      return;
+    }
+    this.finished = true;
+    const duration = Math.max(0, Math.round(performance.now() - this.startTime));
+    const records = [
+      {
+        ...this.metadata,
+        event: {
+          name: "command",
+          command: this.command,
+          outcome,
+          count: 1,
+          duration_ms_sum: duration
+        }
+      },
+      ...this.features.map((feature) => ({
+        ...this.metadata,
+        event: { name: "feature", feature, count: 1 }
+      }))
+    ];
+    appendSpoolRecords(this.config.cacheDirectory, records);
+  }
+};
+function shouldFlush(config, now) {
+  const spool = getSpoolInfo(config.cacheDirectory);
+  if (spool.records === 0) {
+    return false;
+  }
+  if (spool.records >= FLUSH_RECORD_THRESHOLD) {
+    return true;
+  }
+  const lastAttempt = readFlushState(config.cacheDirectory).lastAttempt;
+  if (lastAttempt === void 0) {
+    return true;
+  }
+  const timestamp = Date.parse(lastAttempt);
+  return !Number.isFinite(timestamp) || now - timestamp >= FLUSH_INTERVAL_MS;
+}
+function maybeSpawnFlush(config, options = {}) {
+  const environment = options.environment ?? process.env;
+  const entrypoint = options.entrypoint ?? process.argv[1];
+  if (!config.enabled || environment["PROMPTSCRIPT_TELEMETRY_FLUSH"] === "1" || entrypoint === void 0 || !shouldFlush(config, options.now ?? Date.now())) {
+    return false;
+  }
+  try {
+    const child = (options.spawn ?? spawn4)(
+      options.executable ?? process.execPath,
+      [entrypoint, "__telemetry-flush"],
+      {
+        detached: true,
+        stdio: "ignore",
+        env: {
+          ...environment,
+          PROMPTSCRIPT_TELEMETRY_FLUSH: "1",
+          PROMPTSCRIPT_NO_UPDATE_CHECK: "1"
+        }
+      }
+    );
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// packages/telemetry/src/runtime.ts
+function operatingSystem(platform) {
+  switch (platform) {
+    case "darwin":
+      return "darwin";
+    case "linux":
+      return "linux";
+    case "win32":
+      return "windows";
+    default:
+      return "other";
+  }
+}
+function architecture(value) {
+  switch (value) {
+    case "arm64":
+      return "arm64";
+    case "x64":
+      return "x86_64";
+    default:
+      return "other";
+  }
+}
+function runtimeMetadata(appVersion, input2 = {}) {
+  return {
+    app_version: appVersion,
+    runtime_version: (input2.nodeVersion ?? process.versions.node).split(".")[0] ?? "0",
+    os: operatingSystem(input2.platform ?? process.platform),
+    arch: architecture(input2.architecture ?? process.arch)
+  };
+}
+
+// packages/cli/src/telemetry/config.ts
+init_loader2();
+init_user_config();
+function resolveFrom(baseDirectory, value) {
+  return isAbsolute14(value) ? value : resolve34(baseDirectory, value);
+}
+function findProjectConfig(cwd, customPath) {
+  if (customPath !== void 0) {
+    const path2 = resolveFrom(cwd, customPath);
+    return existsSync27(path2) ? path2 : null;
+  }
+  const environmentPath = process.env["PROMPTSCRIPT_CONFIG"];
+  if (environmentPath !== void 0 && environmentPath !== "") {
+    const path2 = resolveFrom(cwd, environmentPath);
+    return existsSync27(path2) ? path2 : null;
+  }
+  for (const file of CONFIG_FILES) {
+    const path2 = join29(cwd, file);
+    if (existsSync27(path2)) {
+      return path2;
+    }
+  }
+  return null;
+}
+function isNodeError3(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+async function readUserTelemetrySetting(configPath) {
+  let source;
+  try {
+    source = await readFile27(configPath, "utf8");
+  } catch (error) {
+    return isNodeError3(error, "ENOENT") ? { valid: true } : { valid: false };
+  }
+  try {
+    const document = parseDocument(source);
+    if (document.errors.length > 0) {
+      return { valid: false };
+    }
+    const value = document.get("telemetry");
+    if (value === void 0) {
+      return { valid: true };
+    }
+    return typeof value === "boolean" ? { enabled: value, valid: true } : { valid: false };
+  } catch {
+    return { valid: false };
+  }
+}
+async function resolveCliTelemetryConfig(options = {}) {
+  const cwd = options.cwd === void 0 ? process.cwd() : resolve34(process.cwd(), options.cwd);
+  const userSetting = await readUserTelemetrySetting(options.userConfigPath ?? USER_CONFIG_PATH);
+  const projectPath = findProjectConfig(cwd, options.config);
+  const environmentConfig = process.env["PROMPTSCRIPT_CONFIG"];
+  const projectConfigRequested = options.config !== void 0 || environmentConfig !== void 0 && environmentConfig !== "";
+  let projectEnabled;
+  let configurationValid = userSetting.valid;
+  if (projectConfigRequested && projectPath === null) {
+    configurationValid = false;
+  } else if (projectPath !== null) {
+    try {
+      const value = (await loadConfig(projectPath)).telemetry;
+      if (value === void 0 || typeof value === "boolean") {
+        projectEnabled = value;
+      } else {
+        configurationValid = false;
+      }
+    } catch {
+      configurationValid = false;
+    }
+  }
+  return resolveTelemetryConfig({
+    environment: process.env,
+    userEnabled: userSetting.enabled,
+    projectEnabled,
+    configurationValid,
+    ...options.cacheDirectory === void 0 ? {} : { cacheDirectory: options.cacheDirectory }
+  });
+}
+async function setUserTelemetryEnabled(enabled, configPath = USER_CONFIG_PATH) {
+  let source = "version: '1'\n";
+  try {
+    source = await readFile27(configPath, "utf8");
+  } catch (error) {
+    if (!isNodeError3(error, "ENOENT")) {
+      throw error;
+    }
+  }
+  const document = parseDocument(source);
+  if (document.errors.length > 0) {
+    throw new Error(`Cannot update invalid YAML user config: ${configPath}`);
+  }
+  document.set("telemetry", enabled);
+  await mkdir11(dirname21(configPath), { recursive: true });
+  const temporaryPath = `${configPath}.${process.pid}.tmp`;
+  await writeFile11(temporaryPath, document.toString(), { encoding: "utf8", mode: 384 });
+  await rename2(temporaryPath, configPath);
+}
+
+// packages/cli/src/telemetry/session.ts
+var activeSession = null;
+var exitHandlerInstalled = false;
+function normalizedCommandName(command) {
+  const name = command.name();
+  const parentName = command.parent?.name();
+  if (parentName === "vendor" || parentName === "skills") {
+    return `${parentName}-${name}`;
+  }
+  if (parentName === "registry") {
+    return "registry";
+  }
+  return name;
+}
+function stringValues(value) {
+  if (typeof value === "string") {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.filter((item) => typeof item === "string");
+  }
+  return [];
+}
+function commandFeatures(command) {
+  const options = command.opts();
+  const features = /* @__PURE__ */ new Set();
+  const targetValues = [...stringValues(options["target"]), ...stringValues(options["targets"])];
+  for (const target of targetValues) {
+    const feature = sanitizeFeature(`target:${target}`);
+    if (feature !== null) {
+      features.add(feature);
+    }
+  }
+  if (options["dryRun"] === true) {
+    features.add("dry_run");
+  }
+  if (options["watch"] === true) {
+    features.add("watch");
+  }
+  if (options["strict"] === true) {
+    features.add("strict");
+  }
+  if (options["build"] !== void 0 || command.name() === "build") {
+    features.add("build_profile");
+  }
+  if (process.env["CI"] !== void 0) {
+    features.add("ci");
+  }
+  return [...features];
+}
+function exitOutcome(code) {
+  if (code === 130 || code === 143) {
+    return "cancelled";
+  }
+  return code === 0 ? "success" : "error";
+}
+function installExitHandler() {
+  if (exitHandlerInstalled) {
+    return;
+  }
+  process.on("exit", (code) => {
+    finishCliTelemetry(exitOutcome(code));
+  });
+  for (const [signal, fallbackCode] of [
+    ["SIGINT", 130],
+    ["SIGTERM", 143]
+  ]) {
+    process.once(signal, () => {
+      finishCliTelemetry("cancelled");
+      if (process.listenerCount(signal) > 0) {
+        return;
+      }
+      try {
+        process.kill(process.pid, signal);
+      } catch {
+        process.exit(fallbackCode);
+      }
+    });
+  }
+  exitHandlerInstalled = true;
+}
+async function prepareCliTelemetry(command, appVersion) {
+  const name = normalizedCommandName(command);
+  if (isExcludedCommand(name) || process.env["PROMPTSCRIPT_TELEMETRY_FLUSH"] === "1") {
+    return;
+  }
+  const options = command.opts();
+  const config = await resolveCliTelemetryConfig({
+    ...typeof options["cwd"] === "string" ? { cwd: options["cwd"] } : {},
+    ...typeof options["config"] === "string" ? { config: options["config"] } : {}
+  });
+  maybeSpawnFlush(config);
+  activeSession = new TelemetrySession({
+    config,
+    metadata: runtimeMetadata(appVersion),
+    command: name,
+    features: commandFeatures(command)
+  });
+  installExitHandler();
+}
+function finishCliTelemetry(outcome) {
+  const session = activeSession;
+  activeSession = null;
+  session?.finish(
+    outcome ?? (process.exitCode === void 0 || process.exitCode === 0 ? "success" : "error")
+  );
+}
+async function flushCliTelemetry() {
+  const config = await resolveCliTelemetryConfig();
+  await runFlush(config);
+}
+async function telemetryStatus() {
+  const config = await resolveCliTelemetryConfig();
+  return {
+    config,
+    spool: getSpoolInfo(config.cacheDirectory),
+    state: readFlushState(config.cacheDirectory)
+  };
+}
+
+// packages/cli/src/commands/telemetry.ts
+async function telemetryCommand(action) {
+  if (action === "enable") {
+    await setUserTelemetryEnabled(true);
+    ConsoleOutput.success("Anonymous usage telemetry enabled in user config");
+    return;
+  }
+  if (action === "disable") {
+    await setUserTelemetryEnabled(false);
+    ConsoleOutput.success("Anonymous usage telemetry disabled in user config");
+    return;
+  }
+  if (action !== "status") {
+    ConsoleOutput.error("Action must be status, enable, or disable");
+    process.exitCode = 1;
+    return;
+  }
+  const { config, spool, state } = await telemetryStatus();
+  console.log(`Enabled: ${config.enabled ? "yes" : "no"}`);
+  console.log(`Endpoint: ${config.endpoint}`);
+  console.log(`Spool records: ${spool.records}`);
+  console.log(`Spool bytes: ${spool.bytes}`);
+  console.log(`Last attempt: ${state.lastAttempt ?? "never"}`);
+  console.log(`Last success: ${state.lastSuccess ?? "never"}`);
+  console.log(`Last error: ${state.lastError ?? "none"}`);
+  if (config.vetoes.length > 0) {
+    console.log(`Disabled by: ${config.vetoes.join(", ")}`);
+  }
+}
+
 // packages/cli/src/commands/skills.ts
 init_src2();
 init_loader2();
 init_console();
 init_src();
-import { writeFile as writeFile11, readFile as readFile27, readdir as readdir9, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
-import { resolve as resolve34, join as join27, basename as basename17, dirname as dirname21 } from "path";
-import { existsSync as existsSync26 } from "fs";
+import { writeFile as writeFile12, readFile as readFile28, readdir as readdir9, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { resolve as resolve35, join as join30, basename as basename17, dirname as dirname22 } from "path";
+import { existsSync as existsSync28 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
 import { parse as parseYaml15, stringify as stringifyYaml4 } from "yaml";
 var REMOTE_SOURCE_PATTERN = /^[a-zA-Z0-9][\w.-]*\.[a-zA-Z]{2,}\/.+/;
@@ -50796,32 +52225,32 @@ async function collectProjectRemoteImports(entryFile) {
   const projectRoot = process.cwd();
   const entryFiles = /* @__PURE__ */ new Set();
   if (entryFile) {
-    entryFiles.add(resolve34(entryFile));
+    entryFiles.add(resolve35(entryFile));
   }
   if (config) {
     if (config.input?.entry) {
-      entryFiles.add(resolve34(projectRoot, config.input.entry));
+      entryFiles.add(resolve35(projectRoot, config.input.entry));
     }
     for (const build of Object.values(config.builds ?? {})) {
       if (build.entry) {
-        entryFiles.add(resolve34(projectRoot, build.entry));
+        entryFiles.add(resolve35(projectRoot, build.entry));
       }
     }
-    const defaultEntry = resolve34(projectRoot, ".promptscript/project.prs");
-    if (!config.input?.entry && (existsSync26(defaultEntry) || entryFiles.size === 0)) {
+    const defaultEntry = resolve35(projectRoot, ".promptscript/project.prs");
+    if (!config.input?.entry && (existsSync28(defaultEntry) || entryFiles.size === 0)) {
       entryFiles.add(defaultEntry);
     }
   } else if (!entryFile) {
-    const defaultEntry = resolve34(projectRoot, ".promptscript/project.prs");
-    if (existsSync26(defaultEntry)) {
+    const defaultEntry = resolve35(projectRoot, ".promptscript/project.prs");
+    if (existsSync28(defaultEntry)) {
       entryFiles.add(defaultEntry);
     } else {
-      const promptscriptDir = resolve34(projectRoot, ".promptscript");
-      if (existsSync26(promptscriptDir)) {
+      const promptscriptDir = resolve35(projectRoot, ".promptscript");
+      if (existsSync28(promptscriptDir)) {
         const entries = await readdir9(promptscriptDir);
         const prsFiles = entries.filter((entry) => entry.endsWith(".prs"));
         if (prsFiles.length === 1) {
-          entryFiles.add(resolve34(promptscriptDir, prsFiles[0]));
+          entryFiles.add(resolve35(promptscriptDir, prsFiles[0]));
         }
       }
     }
@@ -50830,7 +52259,7 @@ async function collectProjectRemoteImports(entryFile) {
   for (const projectEntry of entryFiles) {
     imports.push(
       ...await collectRemoteImports(projectEntry, {
-        localPath: resolve34(projectRoot, ".promptscript"),
+        localPath: resolve35(projectRoot, ".promptscript"),
         registries: config?.registries,
         strict: true,
         deduplicate: false,
@@ -50880,7 +52309,7 @@ function deriveSkillFolderName(source) {
   const subPath = extractSubPath(source);
   if (!subPath) return basename17(parseSkillSource(source).path);
   if (!subPath.toLowerCase().endsWith(".md")) return basename17(subPath);
-  const parent = dirname21(subPath);
+  const parent = dirname22(subPath);
   if (parent === "." || parent === "") return basename17(parseSkillSource(source).path);
   return basename17(parent);
 }
@@ -50897,16 +52326,16 @@ function collectExistingSkillNames(lockfile, exclude) {
 async function fetchAndValidateRemoteSkill(source, options) {
   const skillFilePath = extractSkillFilePath(source);
   const repoUrl = options.gitUrl ?? extractRepoUrl(source);
-  const tmp = await mkdtemp2(join27(tmpdir3(), "prs-skill-validate-"));
+  const tmp = await mkdtemp2(join30(tmpdir3(), "prs-skill-validate-"));
   const repoName = basename17(parseSkillSource(source).path.split("/")[2]);
-  const cloneDir = !skillFilePath.includes("/") ? join27(tmp, repoName) : tmp;
+  const cloneDir = !skillFilePath.includes("/") ? join30(tmp, repoName) : tmp;
   try {
     const gitRegistry = createGitRegistry({ url: repoUrl });
     const cloneRef = options.version === "latest" || /^[0-9a-f]{40}$/i.test(options.version) ? void 0 : options.version;
     await gitRegistry.cloneAtTag(repoUrl, cloneRef, cloneDir);
     await gitRegistry.checkoutCommit(cloneDir, options.commit);
     const subPath = extractSubPath(source);
-    if (!subPath.toLowerCase().endsWith(".md") && existsSync26(join27(cloneDir, `${subPath}.prs`))) {
+    if (!subPath.toLowerCase().endsWith(".md") && existsSync28(join30(cloneDir, `${subPath}.prs`))) {
       return {
         content: "",
         integrity: "",
@@ -50920,10 +52349,10 @@ async function fetchAndValidateRemoteSkill(source, options) {
         ]
       };
     }
-    const filePath = join27(cloneDir, skillFilePath);
+    const filePath = join30(cloneDir, skillFilePath);
     let content;
     try {
-      content = await readFile27(filePath, "utf-8");
+      content = await readFile28(filePath, "utf-8");
     } catch {
       return {
         content: "",
@@ -50999,8 +52428,8 @@ function validateRemoteSource(source) {
 }
 async function resolveEntryFile(fileFlag) {
   if (fileFlag) {
-    const resolved = resolve34(fileFlag);
-    if (!existsSync26(resolved)) {
+    const resolved = resolve35(fileFlag);
+    if (!existsSync28(resolved)) {
       throw new Error(`File not found: ${resolved}`);
     }
     return resolved;
@@ -51010,24 +52439,24 @@ async function resolveEntryFile(fileFlag) {
     try {
       const config = await loadConfig();
       if (config.input?.entry) {
-        const entryPath = resolve34(config.input.entry);
-        if (existsSync26(entryPath)) {
+        const entryPath = resolve35(config.input.entry);
+        if (existsSync28(entryPath)) {
           return entryPath;
         }
       }
     } catch {
     }
   }
-  const promptscriptDir = resolve34(".promptscript");
-  if (existsSync26(promptscriptDir)) {
+  const promptscriptDir = resolve35(".promptscript");
+  if (existsSync28(promptscriptDir)) {
     const entries = await readdir9(promptscriptDir);
     const prsFiles = entries.filter((f) => f.endsWith(".prs"));
     if (prsFiles.length === 1) {
-      return resolve34(promptscriptDir, prsFiles[0]);
+      return resolve35(promptscriptDir, prsFiles[0]);
     }
     if (prsFiles.length > 1) {
       if (prsFiles.includes("project.prs")) {
-        return resolve34(promptscriptDir, "project.prs");
+        return resolve35(promptscriptDir, "project.prs");
       }
       throw new Error(
         `Multiple .prs files found in .promptscript/. Use --file to specify which one.`
@@ -51128,12 +52557,12 @@ function findUseEndLine(lines, startLine) {
 }
 async function loadLockfile3() {
   const defaultLockfile = { version: LOCKFILE_VERSION, dependencies: {} };
-  if (!existsSync26(LOCKFILE_PATH)) {
+  if (!existsSync28(LOCKFILE_PATH)) {
     return defaultLockfile;
   }
   let parsed;
   try {
-    const raw = await readFile27(LOCKFILE_PATH, "utf-8");
+    const raw = await readFile28(LOCKFILE_PATH, "utf-8");
     parsed = parseYaml15(raw, { maxAliasCount: 100 });
   } catch (error) {
     throw new Error(
@@ -51147,7 +52576,7 @@ async function loadLockfile3() {
   return parsed;
 }
 async function saveLockfile(lockfile) {
-  await writeFile11(LOCKFILE_PATH, stringifyYaml4(lockfile), "utf-8");
+  await writeFile12(LOCKFILE_PATH, stringifyYaml4(lockfile), "utf-8");
 }
 async function skillsAddCommand(rawSource, options) {
   const spinner = createSpinner("Adding skill...").start();
@@ -51170,7 +52599,7 @@ async function skillsAddCommand(rawSource, options) {
     }
     spinner.text = "Resolving entry file...";
     const entryFile = await resolveEntryFile(options.file);
-    const content = await readFile27(entryFile, "utf-8");
+    const content = await readFile28(entryFile, "utf-8");
     const lines = content.split("\n");
     const alreadyImported = lines.some((line) => {
       const usePath = extractUsePath(line);
@@ -51282,7 +52711,7 @@ async function skillsAddCommand(rawSource, options) {
       ConsoleOutput.dryRun(`Would update ${LOCKFILE_PATH}`);
       return;
     }
-    await writeFile11(entryFile, updatedContent, "utf-8");
+    await writeFile12(entryFile, updatedContent, "utf-8");
     await saveLockfile(lockfile);
     spinner.succeed("Skill added");
     ConsoleOutput.newline();
@@ -51298,7 +52727,7 @@ async function skillsRemoveCommand(name, options) {
   const spinner = createSpinner("Removing skill...").start();
   try {
     const entryFile = await resolveEntryFile();
-    const content = await readFile27(entryFile, "utf-8");
+    const content = await readFile28(entryFile, "utf-8");
     const lines = content.split("\n");
     const parsed = parse(content, { filename: entryFile, tolerant: true });
     if (!parsed.ast || parsed.errors.length > 0) {
@@ -51378,7 +52807,7 @@ async function skillsRemoveCommand(name, options) {
       return;
     }
     lines.splice(lineIndex, candidate.endIndex - lineIndex + 1);
-    await writeFile11(entryFile, lines.join("\n"), "utf-8");
+    await writeFile12(entryFile, lines.join("\n"), "utf-8");
     if (removedPath in lockfile.dependencies && !hasSameImportRemaining) {
       delete lockfile.dependencies[removedPath];
     }
@@ -51414,7 +52843,7 @@ async function skillsListCommand() {
   const spinner = createSpinner("Loading skills...").start();
   try {
     const entryFile = await resolveEntryFile();
-    const content = await readFile27(entryFile, "utf-8");
+    const content = await readFile28(entryFile, "utf-8");
     const lines = content.split("\n");
     const skills2 = [];
     for (const line of lines) {
@@ -51582,9 +53011,13 @@ async function skillsUpdateCommand(name, options) {
 
 // packages/cli/src/cli.ts
 var __filename4 = fileURLToPath4(import.meta.url);
-var __dirname4 = dirname26(__filename4);
+var __dirname4 = dirname27(__filename4);
+var CLI_VERSION = getPackageVersion(__dirname3, "./package.json");
 var program = new Command();
-program.name("prs").description("PromptScript CLI - Standardize AI instructions").version(getPackageVersion(__dirname3, "./package.json")).option("--verbose", "Enable verbose output").option("--debug", "Enable debug output (includes verbose)").option("--quiet", "Suppress non-error output").hook("preAction", async (thisCommand, actionCommand) => {
+program.name("prs").description("PromptScript CLI - Standardize AI instructions").version(CLI_VERSION).option("--verbose", "Enable verbose output").option("--debug", "Enable debug output (includes verbose)").option("--quiet", "Suppress non-error output").hook("preAction", async (thisCommand, actionCommand) => {
+  if (actionCommand.name() === "__telemetry-flush" && process.env["PROMPTSCRIPT_TELEMETRY_FLUSH"] === "1") {
+    return;
+  }
   const opts = thisCommand.opts();
   if (opts["quiet"]) {
     setContext({ logLevel: 0 /* Quiet */ });
@@ -51598,7 +53031,8 @@ program.name("prs").description("PromptScript CLI - Standardize AI instructions"
   } else if (process.env["PROMPTSCRIPT_VERBOSE"] === "1" || process.env["PROMPTSCRIPT_VERBOSE"] === "true") {
     setContext({ logLevel: 2 /* Verbose */ });
   }
-  if (actionCommand.name() === "update-check") {
+  await prepareCliTelemetry(actionCommand, CLI_VERSION);
+  if (actionCommand.name() === "update-check" || actionCommand.name() === "telemetry" || actionCommand.name() === "__telemetry-flush") {
     return;
   }
   const currentVersion = getPackageVersion(__dirname3, "./package.json");
@@ -51607,6 +53041,8 @@ program.name("prs").description("PromptScript CLI - Standardize AI instructions"
       printUpdateNotification(updateInfo);
     }
   });
+}).hook("postAction", () => {
+  finishCliTelemetry();
 });
 program.command("init").description("Initialize PromptScript in current directory").option("-n, --name <name>", "Project name (auto-detected from package.json, etc.)").option("-t, --team <team>", "Team namespace").option("--inherit <path>", "Inheritance path (e.g., @company/team)").option("--registry <path>", "Registry path").option("--targets <targets...>", "Target AI tools (for example: github, claude, cursor)").option("-i, --interactive", "Force interactive mode").option("-y, --yes", "Skip prompts; requires explicit, detected, or configured targets").option("-f, --force", "Force reinitialize even if already initialized").option("-m, --migrate", "Deprecated: run migration during initialization").option("--auto-import", "Automatically import existing instruction files (static)").option("--backup", "Create .prs-backup/ before replacing files").option("--dry-run", "Preview files without writing").option("--no-hooks", "Skip auto-compile hook installation for AI tools").action((opts) => {
   if (opts.migrate) {
@@ -51628,6 +53064,8 @@ program.command("pull").description("Pull updates from registry").option("-f, --
 program.command("diff").description("Show diff for compiled output").option("-t, --target <target>", "Specific target").option("-a, --all", "Show diff for all targets at once").option("--full", "Show full diff without truncation").option("--no-pager", "Disable pager output").option("--color", "Force colored output").option("--no-color", "Disable colored output").action(diffCommand);
 program.command("check").description("Check configuration and dependencies health").action(checkCommand);
 program.command("update-check").description("Check for CLI updates").action(updateCheckCommand);
+program.command("telemetry").argument("<action>", "Action: status, enable, or disable").description("Manage anonymous usage telemetry").action(telemetryCommand);
+program.command("__telemetry-flush", { hidden: true }).description("Flush queued anonymous telemetry").action(flushCliTelemetry);
 program.command("serve").description("Start local development server for playground").option("-p, --port <port>", "Port to listen on", "3000").option("--host <host>", "Host to bind to", "127.0.0.1").option("--read-only", "Disable file modifications").option("--cors-origin <origin>", "Allowed CORS origin", "https://getpromptscript.dev").action(async (opts) => {
   const { serveCommand: serveCommand2 } = await Promise.resolve().then(() => (init_serve(), serve_exports));
   await serveCommand2(opts);
@@ -51653,11 +53091,18 @@ skills.command("list").description("List skills imported in the current project"
 skills.command("update [name]").description("Update lock entries for markdown-sourced skills").option("--dry-run", "Preview changes without writing").option("--skip-validation", "Skip SKILL.md frontmatter validation (not recommended)").option("--strict", "Treat validation warnings as errors").action((name, opts) => skillsUpdateCommand(name, opts));
 var registry = program.command("registry").description("Manage PromptScript registries");
 registerRegistryCommands(registry);
-function run(args = process.argv) {
-  program.parse(args);
+async function run(args = process.argv) {
+  try {
+    await program.parseAsync(args);
+  } catch (error) {
+    finishCliTelemetry("error");
+    throw error;
+  } finally {
+    finishCliTelemetry();
+  }
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  run();
+  await run();
 }
 
 // packages/cli/src/index.ts