@amplitude/wizard 1.0.0-beta.0

package/dist/src/utils/api-key-store.js

@@ -0,0 +1,176 @@
+"use strict";
+/**
+ * api-key-store — Persist and retrieve the Amplitude project API key.
+ *
+ * Storage strategy (tried in order):
+ *   1. macOS Keychain  — `security` CLI, no extra deps
+ *   2. Linux keyring   — `secret-tool` CLI (gnome-keyring / KWallet)
+ *   3. .env.local file — fallback; file is added to .gitignore automatically
+ *
+ * The key is scoped to the project directory so that different projects
+ * can have different API keys on the same machine.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.persistApiKey = persistApiKey;
+exports.clearApiKey = clearApiKey;
+exports.readApiKey = readApiKey;
+exports.readApiKeyWithSource = readApiKeyWithSource;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
+const KEYCHAIN_SERVICE = 'amplitude-wizard';
+const ENV_KEY_NAME = 'AMPLITUDE_API_KEY';
+/** A short stable identifier for the project directory (used as keychain account). */
+function projectHandle(installDir) {
+    return (0, node_crypto_1.createHash)('sha1').update(installDir).digest('hex').slice(0, 12);
+}
+// ── macOS Keychain ────────────────────────────────────────────────────────────
+function keychainRead(account) {
+    try {
+        return (0, node_child_process_1.execSync)(`security find-generic-password -a "${account}" -s "${KEYCHAIN_SERVICE}" -w 2>/dev/null`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function keychainWrite(account, key) {
+    try {
+        (0, node_child_process_1.execSync)(`security add-generic-password -U -a "${account}" -s "${KEYCHAIN_SERVICE}" -w "${key}"`, { stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ── Linux secret-tool ─────────────────────────────────────────────────────────
+function secretToolRead(account) {
+    try {
+        return (0, node_child_process_1.execSync)(`secret-tool lookup service "${KEYCHAIN_SERVICE}" account "${account}" 2>/dev/null`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function secretToolWrite(account, key) {
+    try {
+        // secret-tool requires stdin for the password
+        (0, node_child_process_1.execSync)(`printf '%s' "${key}" | secret-tool store --label="Amplitude API Key" service "${KEYCHAIN_SERVICE}" account "${account}"`, { stdio: ['pipe', 'ignore', 'ignore'] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ── .env.local fallback ───────────────────────────────────────────────────────
+function envRead(installDir) {
+    const envPath = (0, node_path_1.join)(installDir, '.env.local');
+    if (!(0, node_fs_1.existsSync)(envPath))
+        return null;
+    const contents = (0, node_fs_1.readFileSync)(envPath, 'utf8');
+    const match = contents.match(/^AMPLITUDE_API_KEY=(.+)$/m);
+    return match ? match[1].trim() : null;
+}
+function envWrite(installDir, key) {
+    const envPath = (0, node_path_1.join)(installDir, '.env.local');
+    if ((0, node_fs_1.existsSync)(envPath)) {
+        const contents = (0, node_fs_1.readFileSync)(envPath, 'utf8');
+        if (contents.includes(`${ENV_KEY_NAME}=`)) {
+            // Replace existing entry
+            (0, node_fs_1.writeFileSync)(envPath, contents.replace(/^AMPLITUDE_API_KEY=.*$/m, `${ENV_KEY_NAME}=${key}`), 'utf8');
+        }
+        else {
+            (0, node_fs_1.appendFileSync)(envPath, `\n${ENV_KEY_NAME}=${key}\n`, 'utf8');
+        }
+    }
+    else {
+        (0, node_fs_1.writeFileSync)(envPath, `${ENV_KEY_NAME}=${key}\n`, 'utf8');
+    }
+    // Ensure .gitignore covers .env.local
+    ensureGitignored(installDir, '.env.local');
+}
+function ensureGitignored(installDir, pattern) {
+    const gitignorePath = (0, node_path_1.join)(installDir, '.gitignore');
+    if ((0, node_fs_1.existsSync)(gitignorePath)) {
+        const contents = (0, node_fs_1.readFileSync)(gitignorePath, 'utf8');
+        if (contents.includes(pattern))
+            return;
+        (0, node_fs_1.appendFileSync)(gitignorePath, `\n# Amplitude wizard\n${pattern}\n`, 'utf8');
+    }
+    else {
+        (0, node_fs_1.writeFileSync)(gitignorePath, `# Amplitude wizard\n${pattern}\n`, 'utf8');
+    }
+}
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Persist the Amplitude project API key for this project directory.
+ * Tries keychain first, falls back to .env.local.
+ * Returns which storage was used: 'keychain' | 'env'
+ */
+function persistApiKey(key, installDir) {
+    const account = projectHandle(installDir);
+    if (process.platform === 'darwin' && keychainWrite(account, key)) {
+        return 'keychain';
+    }
+    if (process.platform === 'linux' && secretToolWrite(account, key)) {
+        return 'keychain';
+    }
+    envWrite(installDir, key);
+    return 'env';
+}
+/**
+ * Remove the stored API key for this project directory from the system
+ * keychain (macOS / Linux). Has no effect if no key is stored.
+ */
+function clearApiKey(installDir) {
+    const account = projectHandle(installDir);
+    if (process.platform === 'darwin') {
+        try {
+            (0, node_child_process_1.execSync)(`security delete-generic-password -a "${account}" -s "${KEYCHAIN_SERVICE}" 2>/dev/null`, { stdio: 'ignore' });
+        }
+        catch {
+            // Key wasn't in keychain — ignore
+        }
+    }
+    if (process.platform === 'linux') {
+        try {
+            (0, node_child_process_1.execSync)(`secret-tool clear service "${KEYCHAIN_SERVICE}" account "${account}" 2>/dev/null`, { stdio: 'ignore' });
+        }
+        catch {
+            // Key wasn't in keyring — ignore
+        }
+    }
+}
+/**
+ * Read a previously persisted API key for this project directory.
+ * Returns null if not found in any storage.
+ */
+function readApiKey(installDir) {
+    return readApiKeyWithSource(installDir)?.key ?? null;
+}
+/**
+ * Read a previously persisted API key, also returning which storage was used.
+ * Returns null if not found in any storage.
+ */
+function readApiKeyWithSource(installDir) {
+    const account = projectHandle(installDir);
+    if (process.platform === 'darwin') {
+        const key = keychainRead(account);
+        if (key)
+            return { key, source: 'keychain' };
+    }
+    if (process.platform === 'linux') {
+        const key = secretToolRead(account);
+        if (key)
+            return { key, source: 'keychain' };
+    }
+    // .env.local in the project directory
+    const envKey = envRead(installDir);
+    if (envKey)
+        return { key: envKey, source: 'env' };
+    // Also honour AMPLITUDE_API_KEY from the environment (e.g. already in .env)
+    const envVar = process.env.AMPLITUDE_API_KEY;
+    if (envVar)
+        return { key: envVar, source: 'env' };
+    return null;
+}

package/dist/src/utils/bash.d.ts

@@ -0,0 +1,2 @@
+export declare function executeSync(command: string): string;
+export declare function execute(command: string): Promise<string>;

package/dist/src/utils/bash.js

@@ -0,0 +1,53 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeSync = executeSync;
+exports.execute = execute;
+const child_process = __importStar(require("child_process"));
+function executeSync(command) {
+    const output = child_process.execSync(command);
+    return output.toString();
+}
+function execute(command) {
+    return new Promise((resolve, reject) => {
+        child_process.exec(command, (error, stdout, _) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}

package/dist/src/utils/custom-headers.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Builds a list of custom headers for ANTHROPIC_CUSTOM_HEADERS.
+ */
+export declare function createCustomHeaders(): {
+    add(key: string, value: string): void;
+    /** Add a feature flag for Amplitude ($feature/<flagKey>: variant). */
+    addFlag(flagKey: string, variant: string): void;
+    encode(): string;
+};

package/dist/src/utils/custom-headers.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCustomHeaders = createCustomHeaders;
+const constants_1 = require("../lib/constants");
+/**
+ * Builds a list of custom headers for ANTHROPIC_CUSTOM_HEADERS.
+ */
+function createCustomHeaders() {
+    const entries = [];
+    return {
+        add(key, value) {
+            const name = key.startsWith('x-') || key.startsWith('X-') ? key : `X-${key}`;
+            entries.push({ key: name, value });
+        },
+        addFlag(flagKey, variant) {
+            const headerName = constants_1.AMPLITUDE_FLAG_HEADER_PREFIX + flagKey.toUpperCase();
+            entries.push({ key: headerName, value: variant });
+        },
+        encode() {
+            return entries.map(({ key, value }) => `${key}: ${value}`).join('\n');
+        },
+    };
+}

package/dist/src/utils/debug.d.ts

@@ -0,0 +1,23 @@
+export declare function getLogFilePath(): string;
+/**
+ * Configure the log file path and enable/disable state.
+ * Call before initLogFile() to override defaults.
+ */
+export declare function configureLogFile(opts: {
+    path?: string;
+    enabled?: boolean;
+}): void;
+/**
+ * Initialize the log file with a run header.
+ * Call this at the start of each wizard run.
+ * Fails silently to avoid crashing the wizard.
+ */
+export declare function initLogFile(): void;
+/**
+ * Log a message to the log file.
+ * Always writes regardless of debug flag (when logging is enabled).
+ * Fails silently to avoid masking errors in catch blocks.
+ */
+export declare function logToFile(...args: unknown[]): void;
+export declare function debug(...args: unknown[]): void;
+export declare function enableDebugLogs(): void;

package/dist/src/utils/debug.js

@@ -0,0 +1,86 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLogFilePath = getLogFilePath;
+exports.configureLogFile = configureLogFile;
+exports.initLogFile = initLogFile;
+exports.logToFile = logToFile;
+exports.debug = debug;
+exports.enableDebugLogs = enableDebugLogs;
+const chalk_1 = __importDefault(require("chalk"));
+const fs_1 = require("fs");
+const logging_1 = require("./logging");
+const ui_1 = require("../ui");
+let debugEnabled = false;
+let logFilePath = '/tmp/amplitude-wizard.log';
+// Disable file logging in test environments — tests write via Vitest and
+// pollute the shared log with hundreds of synthetic "Wizard failed" entries.
+let logEnabled = process.env.NODE_ENV !== 'test';
+const LOG_MAX_BYTES = 5 * 1024 * 1024; // 5 MB
+function getLogFilePath() {
+    return logFilePath;
+}
+/**
+ * Configure the log file path and enable/disable state.
+ * Call before initLogFile() to override defaults.
+ */
+function configureLogFile(opts) {
+    if (opts.path !== undefined)
+        logFilePath = opts.path;
+    if (opts.enabled !== undefined)
+        logEnabled = opts.enabled;
+}
+/**
+ * Initialize the log file with a run header.
+ * Call this at the start of each wizard run.
+ * Fails silently to avoid crashing the wizard.
+ */
+function initLogFile() {
+    if (!logEnabled)
+        return;
+    try {
+        // Truncate the log if it has grown too large, keeping it manageable.
+        try {
+            if ((0, fs_1.statSync)(logFilePath).size > LOG_MAX_BYTES) {
+                (0, fs_1.truncateSync)(logFilePath, 0);
+            }
+        }
+        catch {
+            // File doesn't exist yet — that's fine
+        }
+        const header = `\n${'='.repeat(60)}\nAmplitude Wizard Run: ${new Date().toISOString()}\n${'='.repeat(60)}\n`;
+        (0, fs_1.appendFileSync)(logFilePath, header);
+    }
+    catch {
+        // Silently ignore - logging is non-critical
+    }
+}
+/**
+ * Log a message to the log file.
+ * Always writes regardless of debug flag (when logging is enabled).
+ * Fails silently to avoid masking errors in catch blocks.
+ */
+function logToFile(...args) {
+    if (!logEnabled)
+        return;
+    try {
+        const timestamp = new Date().toISOString();
+        const msg = args.map((a) => (0, logging_1.prepareMessage)(a)).join(' ');
+        (0, fs_1.appendFileSync)(logFilePath, `[${timestamp}] ${msg}\n`);
+    }
+    catch {
+        // Silently ignore logging failures to avoid masking original errors
+    }
+}
+function debug(...args) {
+    if (!debugEnabled) {
+        return;
+    }
+    const msg = args.map((a) => (0, logging_1.prepareMessage)(a)).join(' ');
+    (0, ui_1.getUI)().log.info(chalk_1.default.dim(msg));
+}
+function enableDebugLogs() {
+    debugEnabled = true;
+}

package/dist/src/utils/environment.d.ts

@@ -0,0 +1,4 @@
+import type { WizardOptions } from './types';
+export declare function isNonInteractiveEnvironment(): boolean;
+export declare function readEnvironment(): Record<string, unknown>;
+export declare function detectEnvVarPrefix(options: WizardOptions): Promise<string>;

package/dist/src/utils/environment.js

@@ -0,0 +1,76 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNonInteractiveEnvironment = isNonInteractiveEnvironment;
+exports.readEnvironment = readEnvironment;
+exports.detectEnvVarPrefix = detectEnvVarPrefix;
+const read_env_1 = __importDefault(require("read-env"));
+const setup_utils_1 = require("./setup-utils");
+const fast_glob_1 = __importDefault(require("fast-glob"));
+const constants_1 = require("../lib/constants");
+function isNonInteractiveEnvironment() {
+    if (constants_1.IS_DEV) {
+        return false;
+    }
+    if (!process.stdout.isTTY || !process.stderr.isTTY) {
+        return true;
+    }
+    return false;
+}
+function readEnvironment() {
+    const result = (0, read_env_1.default)('AMPLITUDE_WIZARD');
+    return result;
+}
+async function detectEnvVarPrefix(options) {
+    const packageJson = await (0, setup_utils_1.tryGetPackageJson)(options);
+    if (!packageJson)
+        return 'VITE_PUBLIC_';
+    const deps = { ...packageJson.dependencies, ...packageJson.devDependencies };
+    const has = (name) => name in deps;
+    const hasAnyFile = async (patterns) => {
+        const matches = await (0, fast_glob_1.default)(patterns, {
+            cwd: options.installDir,
+            absolute: false,
+            onlyFiles: true,
+            ignore: ['**/node_modules/**'],
+        });
+        return matches.length > 0;
+    };
+    // --- Next.js
+    if (has('next') || (await hasAnyFile(['**/next.config.{js,ts,mjs,cjs}']))) {
+        return 'NEXT_PUBLIC_';
+    }
+    // --- Create React App
+    if (has('react-scripts') ||
+        has('create-react-app') ||
+        (await hasAnyFile(['**/config-overrides.js']))) {
+        return 'REACT_APP_';
+    }
+    // --- Vite (vanilla, TanStack, Solid, etc.)
+    // Note: Vite does not need PUBLIC_ but we use it to follow the docs, to improve the chances of an LLM getting it right.
+    if (has('vite') || (await hasAnyFile(['**/vite.config.{js,ts,mjs,cjs}']))) {
+        return 'VITE_PUBLIC_';
+    }
+    // --- SvelteKit
+    if (has('@sveltejs/kit') ||
+        (await hasAnyFile(['**/svelte.config.{js,ts}']))) {
+        return 'PUBLIC_';
+    }
+    // --- TanStack Start (uses Vite)
+    if (has('@tanstack/start') ||
+        (await hasAnyFile(['**/tanstack.config.{js,ts}']))) {
+        return 'VITE_PUBLIC_';
+    }
+    // --- SolidStart (uses Vite)
+    if (has('solid-start') || (await hasAnyFile(['**/solid.config.{js,ts}']))) {
+        return 'VITE_PUBLIC_';
+    }
+    // --- Astro
+    if (has('astro') || (await hasAnyFile(['**/astro.config.{js,ts,mjs}']))) {
+        return 'PUBLIC_';
+    }
+    // We default to Vite if we can't detect a specific framework, since it's the most commonly used.
+    return 'VITE_PUBLIC_';
+}

package/dist/src/utils/file-utils.d.ts

@@ -0,0 +1,2 @@
+import type { WizardOptions } from './types';
+export declare function getDotGitignore({ installDir, }: Pick<WizardOptions, 'installDir'>): string | undefined;

package/dist/src/utils/file-utils.js

@@ -0,0 +1,16 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDotGitignore = getDotGitignore;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+function getDotGitignore({ installDir, }) {
+    const gitignorePath = path_1.default.join(installDir, '.gitignore');
+    const gitignoreExists = fs_1.default.existsSync(gitignorePath);
+    if (gitignoreExists) {
+        return gitignorePath;
+    }
+    return undefined;
+}

package/dist/src/utils/get-api-key.d.ts

@@ -0,0 +1,17 @@
+import type { AmplitudeZone } from '../lib/constants.js';
+/**
+ * Resolve the Amplitude project API key for a given install directory.
+ *
+ * Resolution order:
+ *   1. Local storage — keychain / .env.local / AMPLITUDE_API_KEY env var
+ *   2. Amplitude backend — fetches org/workspace data with the provided
+ *      OAuth id_token and picks the lowest-ranked environment's API key
+ *
+ * Returns null only if both sources come up empty.
+ */
+export declare function getAPIKey(params: {
+    installDir: string;
+    idToken: string;
+    zone: AmplitudeZone;
+    workspaceId?: string;
+}): Promise<string | null>;

package/dist/src/utils/get-api-key.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAPIKey = getAPIKey;
+const api_key_store_js_1 = require("./api-key-store.js");
+const api_js_1 = require("../lib/api.js");
+const debug_js_1 = require("./debug.js");
+/**
+ * Resolve the Amplitude project API key for a given install directory.
+ *
+ * Resolution order:
+ *   1. Local storage — keychain / .env.local / AMPLITUDE_API_KEY env var
+ *   2. Amplitude backend — fetches org/workspace data with the provided
+ *      OAuth id_token and picks the lowest-ranked environment's API key
+ *
+ * Returns null only if both sources come up empty.
+ */
+async function getAPIKey(params) {
+    const { installDir, idToken, zone, workspaceId } = params;
+    // ── 1. Local storage ────────────────────────────────────────────────────────
+    const stored = (0, api_key_store_js_1.readApiKeyWithSource)(installDir);
+    if (stored)
+        return stored.key;
+    // ── 2. Amplitude backend ────────────────────────────────────────────────────
+    try {
+        const userInfo = await (0, api_js_1.fetchAmplitudeUser)(idToken, zone);
+        let foundWorkspace = false;
+        let foundEnvWithKey = false;
+        for (const org of userInfo.orgs) {
+            const workspace = workspaceId
+                ? org.workspaces.find((ws) => ws.id === workspaceId)
+                : org.workspaces[0];
+            if (!workspace?.environments)
+                continue;
+            foundWorkspace = true;
+            const envsWithKey = workspace.environments
+                .filter((env) => env.app?.apiKey)
+                .sort((a, b) => a.rank - b.rank);
+            if (envsWithKey.length > 0)
+                foundEnvWithKey = true;
+            const apiKey = envsWithKey[0]?.app?.apiKey;
+            if (apiKey)
+                return apiKey;
+        }
+        (0, debug_js_1.logToFile)(`[getAPIKey] no key found: ${userInfo.orgs.length} org(s), foundWorkspace=${foundWorkspace}, foundEnvWithKey=${foundEnvWithKey}`);
+    }
+    catch (err) {
+        (0, debug_js_1.logToFile)(`[getAPIKey] backend fetch failed: ${err instanceof Error ? err.constructor.name : 'unknown'}`);
+    }
+    return null;
+}

package/dist/src/utils/logging.d.ts

@@ -0,0 +1,9 @@
+export declare function prepareMessage(msg: unknown): string;
+export declare function l(msg: string): void;
+export declare function nl(): void;
+export declare function green(msg: string): void;
+export declare function red(msg: string): void;
+export declare function dim(msg: string): void;
+export declare function yellow(msg: string): void;
+export declare function cyan(msg: string): void;
+export declare function debug(msg: unknown): void;

package/dist/src/utils/logging.js

@@ -0,0 +1,48 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareMessage = prepareMessage;
+exports.l = l;
+exports.nl = nl;
+exports.green = green;
+exports.red = red;
+exports.dim = dim;
+exports.yellow = yellow;
+exports.cyan = cyan;
+exports.debug = debug;
+const chalk_1 = __importDefault(require("chalk"));
+function prepareMessage(msg) {
+    if (typeof msg === 'string') {
+        return msg;
+    }
+    if (msg instanceof Error) {
+        return `${msg.stack || ''}`;
+    }
+    return JSON.stringify(msg, null, '\t');
+}
+function l(msg) {
+    console.log(msg);
+}
+function nl() {
+    return l('');
+}
+function green(msg) {
+    return l(chalk_1.default.green(prepareMessage(msg)));
+}
+function red(msg) {
+    return l(chalk_1.default.red(prepareMessage(msg)));
+}
+function dim(msg) {
+    return l(chalk_1.default.dim(prepareMessage(msg)));
+}
+function yellow(msg) {
+    return l(chalk_1.default.yellow(prepareMessage(msg)));
+}
+function cyan(msg) {
+    return l(chalk_1.default.cyan(prepareMessage(msg)));
+}
+function debug(msg) {
+    return l(chalk_1.default.italic.yellow(prepareMessage(msg)));
+}

package/dist/src/utils/oauth.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Amplitude OAuth2/PKCE flow — adapted from Amplitude wizard's oauth.ts but
+ * hitting Amplitude's auth endpoints (same as the ampli CLI).
+ *
+ * Key difference from Amplitude: checks ~/.ampli.json for an existing ampli CLI
+ * session first, so users who ran `ampli login` can skip re-authenticating.
+ */
+import { z } from 'zod';
+import { type AmplitudeZone } from '../lib/constants.js';
+declare const OAuthTokenResponseSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    id_token: z.ZodString;
+    refresh_token: z.ZodString;
+    token_type: z.ZodString;
+    expires_in: z.ZodNumber;
+}, z.core.$strip>;
+export type OAuthTokenResponse = z.infer<typeof OAuthTokenResponseSchema>;
+export interface AmplitudeAuthResult {
+    idToken: string;
+    accessToken: string;
+    refreshToken: string;
+    zone: AmplitudeZone;
+}
+/**
+ * Performs the Amplitude OAuth2/PKCE flow.
+ *
+ * 1. Checks ~/.ampli.json for a valid existing session (shared with ampli CLI),
+ *    unless forceFresh is true (used for new projects with no local ampli.json).
+ * 2. If none, opens the browser to auth.amplitude.com and awaits callback.
+ * 3. Stores the resulting tokens back to ~/.ampli.json.
+ */
+export declare function performAmplitudeAuth(options: {
+    zone?: AmplitudeZone;
+    /** Skip cached credentials and require fresh browser auth. */
+    forceFresh?: boolean;
+}): Promise<AmplitudeAuthResult>;
+/**
+ * Exchanges a stored refresh token for a new access token.
+ * Uses the same /oauth2/token endpoint as the initial auth-code exchange.
+ */
+export declare function refreshAccessToken(refreshToken: string, zone?: AmplitudeZone): Promise<{
+    accessToken: string;
+    idToken: string;
+    refreshToken: string;
+    expiresAt: string;
+}>;
+export type OAuthConfig = {
+    scopes: string[];
+    signup?: boolean;
+};
+/** @deprecated Use performAmplitudeAuth() directly. */
+export declare function performOAuthFlow(_config: OAuthConfig): Promise<OAuthTokenResponse>;
+export {};