@glassanalytics/cli 0.0.0-stage → 0.2.1

package/dist/glass.js

@@ -0,0 +1,1631 @@
+#!/usr/bin/env node
+
+// packages/cli/src/index.ts
+import { parseArgs } from "node:util";
+
+// packages/core/src/version.ts
+var GLASS_VERSION = "0.2.1";
+var UPGRADE_COMMAND = "npx @glassanalytics/cli@latest upgrade";
+function parseSemver(version) {
+  const m = /^(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function isNewerThan(a, b) {
+  const pa = parseSemver(a);
+  const pb = parseSemver(b);
+  if (!pa || !pb) return a !== b && a > b;
+  for (let i = 0; i < 3; i++) {
+    const d = pa[i] - pb[i];
+    if (d) return d > 0;
+  }
+  return false;
+}
+
+// packages/cli/src/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+var GLASS_DIR = ".glass";
+function projectRoot(start = process.cwd()) {
+  let dir = resolve(start);
+  let pkg = null;
+  for (; ; ) {
+    if (existsSync(join(dir, GLASS_DIR, "config.json"))) return dir;
+    if (!pkg && existsSync(join(dir, "package.json"))) pkg = dir;
+    const parent = dirname(dir);
+    if (parent === dir) return pkg ?? resolve(start);
+    dir = parent;
+  }
+}
+function glassDir(root = projectRoot()) {
+  return join(root, GLASS_DIR);
+}
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeJson(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function loadConfig(root = projectRoot()) {
+  return readJson(join(glassDir(root), "config.json"));
+}
+function saveConfig(config, root = projectRoot()) {
+  writeJson(join(glassDir(root), "config.json"), config);
+}
+function loadCredentials(root = projectRoot()) {
+  return readJson(join(glassDir(root), "credentials.json"));
+}
+function saveCredentials(credentials, root = projectRoot()) {
+  const dir = glassDir(root);
+  writeJson(join(dir, "credentials.json"), credentials);
+  writeFileSync(join(dir, ".gitignore"), "credentials.json\n");
+}
+function connection() {
+  const config = loadConfig();
+  const credentials = loadCredentials();
+  const host = process.env.GLASS_HOST ?? config?.host;
+  const key2 = process.env.GLASS_API_KEY ?? credentials?.adminKey;
+  if (!host || !key2) {
+    throw new UsageError(
+      "No Glass deployment found here.",
+      "Run `npx @glassanalytics/cli init` in your project, or set GLASS_HOST and GLASS_API_KEY."
+    );
+  }
+  return { host: host.replace(/\/+$/, ""), key: key2, project: process.env.GLASS_PROJECT ?? config?.project };
+}
+var UsageError = class extends Error {
+  hint;
+  constructor(message, hint) {
+    super(message);
+    this.name = "UsageError";
+    this.hint = hint;
+  }
+};
+
+// packages/cli/src/client.ts
+async function call(method, path, body, options = {}) {
+  const conn = options.host && options.key ? { host: options.host, key: options.key } : connection();
+  const res = await (options.fetcher ?? fetch)(`${conn.host}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${conn.key}`, ...body === void 0 ? {} : { "Content-Type": "application/json" } },
+    body: body === void 0 ? void 0 : JSON.stringify(body)
+  }).catch((err) => {
+    throw new UsageError(`Could not reach ${conn.host}: ${err instanceof Error ? err.message : String(err)}`, "Check your network, or run `glass status`.");
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new UsageError(data.error ?? `HTTP ${res.status}`, data.hint);
+  return data;
+}
+function withProject(value) {
+  const project = value.project ?? connection().project;
+  return project ? { ...value, project } : value;
+}
+
+// packages/cli/src/output.ts
+var useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+var wrap = (code) => (s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s;
+var color = {
+  bold: wrap(1),
+  dim: wrap(2),
+  green: wrap(32),
+  red: wrap(31),
+  yellow: wrap(33),
+  cyan: wrap(36)
+};
+function line(text = "") {
+  process.stdout.write(`${text}
+`);
+}
+function ok(text) {
+  line(`${color.green("\u2713")} ${text}`);
+}
+function skip(text) {
+  line(`${color.yellow("\u2013")} ${text}`);
+}
+function fail(text) {
+  process.stderr.write(`${color.red("\u2717")} ${text}
+`);
+}
+function printJson(value) {
+  line(JSON.stringify(value, null, 2));
+}
+function table(headers, rows) {
+  const cells = rows.map((r) => r.map((c) => String(c)));
+  const widths = headers.map((h, i) => Math.min(60, Math.max(h.length, ...cells.map((r) => (r[i] ?? "").length))));
+  const numeric = headers.map((_, i) => rows.length > 0 && rows.every((r) => typeof r[i] === "number"));
+  const fmt = (values) => values.map((v, i) => {
+    const text = v.length > widths[i] ? `${v.slice(0, widths[i] - 1)}\u2026` : v;
+    return numeric[i] ? text.padStart(widths[i]) : text.padEnd(widths[i]);
+  }).join("  ").trimEnd();
+  line(color.dim(fmt(headers)));
+  for (const r of cells) line(fmt(r));
+}
+function pct(value) {
+  return `${(value * 100).toFixed(1)}%`;
+}
+
+// packages/cli/src/commands/data.ts
+var str = (v) => typeof v === "string" ? v : void 0;
+function showSql(sql2, flags2) {
+  if (!flags2.sql || !sql2) return;
+  line();
+  for (const q of sql2) line(color.dim(q));
+}
+function specFromFlags(kind, flags2) {
+  if (typeof flags2.spec === "string") {
+    try {
+      return JSON.parse(flags2.spec);
+    } catch {
+      throw new UsageError("--spec is not valid JSON.");
+    }
+  }
+  const common = { from: str(flags2.from), to: str(flags2.to), breakdown: str(flags2.breakdown) };
+  const filters = typeof flags2.where === "string" ? flags2.where.split(",").map((w) => {
+    const [property, value] = w.split("=");
+    if (!property || value === void 0) throw new UsageError(`--where expects property=value pairs, got "${w}".`);
+    return { property: property.trim(), value: value.trim() };
+  }) : void 0;
+  switch (kind) {
+    case "web":
+      return { from: common.from, to: common.to, filters };
+    case "trends": {
+      const events2 = str(flags2.event)?.split(",") ?? [];
+      if (!events2.length) throw new UsageError("`glass query trends` needs --event <name>[,<name>\u2026]");
+      return { ...common, filters, interval: str(flags2.interval), series: events2.map((event) => ({ event, math: str(flags2.math), property: str(flags2.property) })) };
+    }
+    case "funnel": {
+      const steps = str(flags2.steps)?.split(",") ?? [];
+      if (steps.length < 2) throw new UsageError("`glass query funnel` needs --steps a,b[,c\u2026]");
+      return { ...common, filters, window: str(flags2.window), steps: steps.map((event) => ({ event: event.trim() })) };
+    }
+    case "retention": {
+      const cohort = str(flags2.cohort);
+      if (!cohort) throw new UsageError("`glass query retention` needs --cohort <event> (and optionally --return <event>)");
+      return {
+        from: common.from,
+        to: common.to,
+        filters,
+        cohortEvent: { event: cohort },
+        returnEvent: { event: str(flags2.return) ?? cohort },
+        period: str(flags2.period),
+        periods: flags2.periods ? Number(flags2.periods) : void 0
+      };
+    }
+    default:
+      throw new UsageError(`Unknown query "${kind}".`, "Use web, trends, funnel or retention (or `glass sql`).");
+  }
+}
+async function query(kind, flags2) {
+  if (!kind) throw new UsageError("Which query?", "glass query web|trends|funnel|retention [options]; see `glass help query`.");
+  const result = await call("POST", "/api/query", withProject({ kind, ...specFromFlags(kind, flags2), project: str(flags2.project) }));
+  if (flags2.json) return printJson(result);
+  line(color.bold(result.summary));
+  line();
+  if (kind === "web") {
+    const r = result;
+    table(["Metric", "Value", "Previous"], [
+      ["Visitors", r.totals.visitors, r.previous?.visitors ?? 0],
+      ["Pageviews", r.totals.pageviews, r.previous?.pageviews ?? 0],
+      ["Sessions", r.totals.sessions, r.previous?.sessions ?? 0],
+      ["Bounce rate", pct(r.totals.bounceRate), r.previous ? pct(r.previous.bounceRate) : "\u2013"]
+    ]);
+    line();
+    table(["Top page", "Visitors"], r.breakdowns.pages.slice(0, 8).map((p) => [p.value, p.visitors]));
+    line();
+    table(["Referrer", "Visitors"], r.breakdowns.referrers.slice(0, 8).map((p) => [p.value, p.visitors]));
+  } else if (kind === "trends") {
+    const r = result;
+    table(["Series", "Total"], r.series.map((s) => [s.label, s.total]));
+  } else if (kind === "funnel") {
+    const r = result;
+    table(["Step", "People", "From start", "From previous"], r.steps.map((s) => [s.label, s.count, pct(s.conversionFromStart), pct(s.conversionFromPrevious)]));
+  } else if (kind === "retention") {
+    const r = result;
+    table(
+      ["Cohort", "People", ...r.average.map((_, k) => `${r.period[0]}${k}`)],
+      r.cohorts.map((c) => [new Date(c.start).toISOString().slice(0, 10), c.size, ...c.rates.map((x) => `${Math.round(x * 100)}%`)])
+    );
+  }
+  line();
+  line(color.dim(`Open in dashboard: ${result.dashboard}`));
+  showSql(result.sql, flags2);
+}
+async function sql(statement, flags2) {
+  if (!statement) throw new UsageError('Pass a query: glass sql "SELECT event, COUNT(*) AS n FROM events GROUP BY event"');
+  const r = await call("POST", "/api/sql", withProject({ query: statement, limit: flags2.limit ? Number(flags2.limit) : void 0, project: str(flags2.project) }));
+  if (flags2.json) return printJson(r);
+  table(r.columns, r.rows.map((row) => r.columns.map((c) => typeof row[c] === "number" ? row[c] : String(row[c] ?? ""))));
+  line(color.dim(r.summary));
+}
+async function events(name, flags2) {
+  const project = str(flags2.project);
+  if (name && typeof flags2.describe === "string") {
+    const r2 = await call("PUT", `/api/events/${encodeURIComponent(name)}`, withProject({ description: flags2.describe, project }));
+    return flags2.json ? printJson(r2) : line(`Saved the description of "${name}".`);
+  }
+  if (name) {
+    const q = project ? `?project=${encodeURIComponent(project)}` : "";
+    const r2 = await call("GET", `/api/events/${encodeURIComponent(name)}${q}`);
+    if (flags2.json) return printJson(r2);
+    line(color.bold(r2.summary));
+    if (r2.description) line(r2.description);
+    line();
+    if (r2.properties.length) table(["Property", "Type", "Coverage", "Examples"], r2.properties.map((p) => [p.name, p.types.join("|"), pct(p.coverage), p.examples.join(", ")]));
+    return;
+  }
+  const r = await call(
+    "GET",
+    `/api/events?days=${Number(flags2.days ?? 30)}${project ? `&project=${encodeURIComponent(project)}` : ""}`
+  );
+  if (flags2.json) return printJson(r);
+  line(color.bold(r.summary));
+  line();
+  table(["Event", "Count", "Last seen", "Description"], r.events.map((e) => [e.event, e.count, e.lastSeen.slice(0, 16).replace("T", " "), e.description]));
+}
+async function person(id, flags2) {
+  if (!id) throw new UsageError("Pass a person id: glass person <user-id>");
+  const q = str(flags2.project) ? `?project=${encodeURIComponent(str(flags2.project))}` : "";
+  if (flags2.delete) {
+    const r2 = await call("DELETE", `/api/persons/${encodeURIComponent(id)}${q}`);
+    return flags2.json ? printJson(r2) : line(r2.summary);
+  }
+  const r = await call("GET", `/api/persons/${encodeURIComponent(id)}${q}`);
+  if (flags2.json) return printJson(r);
+  line(color.bold(r.summary));
+  for (const [k, v] of Object.entries(r.properties)) line(`  ${k}: ${JSON.stringify(v)}`);
+  line();
+  table(["Time", "Event", "Page"], r.recentEvents.slice(0, 25).map((e) => [e.time.slice(0, 19).replace("T", " "), e.event, e.path]));
+}
+async function replays(sub, arg, flags2) {
+  const project = str(flags2.project);
+  if (sub === "summary" || sub === "show") {
+    if (!arg) throw new UsageError("Pass a session id: glass replays summary <session>");
+    const r2 = await call("GET", `/api/replays/${encodeURIComponent(arg)}/summary${project ? `?project=${project}` : ""}`);
+    return flags2.json ? printJson(r2) : line(r2.transcript);
+  }
+  const params = new URLSearchParams();
+  if (project) params.set("project", project);
+  if (flags2.errors) params.set("with_errors", "true");
+  if (typeof flags2.person === "string") params.set("person", flags2.person);
+  const r = await call("GET", `/api/replays?${params}`);
+  if (flags2.json) return printJson(r);
+  line(color.bold(r.summary));
+  line();
+  table(["Session", "Started", "Person", "Seconds", "Errors", "First page"], r.replays.map((x) => [x.session, x.started.slice(0, 16).replace("T", " "), x.person, x.durationSeconds, x.errors, x.url]));
+}
+async function projects(sub, arg, flags2) {
+  if (sub === "add") {
+    if (!arg) throw new UsageError("Pass an id: glass projects add <id>");
+    const r2 = await call("POST", "/api/projects", { id: arg, name: str(flags2.name) });
+    return flags2.json ? printJson(r2) : line(r2.summary);
+  }
+  const r = await call("GET", "/api/projects");
+  if (flags2.json) return printJson(r);
+  table(["Project", "Name"], r.projects.map((p) => [p.id, p.name]));
+}
+
+// packages/cli/src/commands/flags.ts
+var str2 = (v) => typeof v === "string" ? v : void 0;
+var projectQuery = (flags2) => str2(flags2.project) ? `?project=${encodeURIComponent(str2(flags2.project))}` : "";
+async function flags(sub, key2, flags2) {
+  if (!sub || sub === "list") {
+    const r = await call("GET", `/api/flags${projectQuery(flags2)}`);
+    if (flags2.json) return printJson(r);
+    if (!r.flags.length) return line("No flags yet. Create one: glass flags set new-checkout --rollout 10");
+    table(["Flag", "On", "Rollout", "Variants"], r.flags.map((f) => [f.key, f.enabled ? "yes" : "no", `${f.rollout}%`, (f.variants ?? []).map((v) => v.key).join(", ")]));
+    return;
+  }
+  if (!key2) throw new UsageError(`Pass a flag key: glass flags ${sub} <key>`);
+  if (sub === "delete") {
+    const r = await call("DELETE", `/api/flags/${encodeURIComponent(key2)}${projectQuery(flags2)}`);
+    return flags2.json ? printJson(r) : line(r.summary);
+  }
+  if (sub === "set") {
+    const body = { project: str2(flags2.project) };
+    if (flags2.rollout !== void 0) body.rollout = Number(flags2.rollout);
+    if (flags2.enable) body.enabled = true;
+    if (flags2.disable) body.enabled = false;
+    if (typeof flags2.description === "string") body.description = flags2.description;
+    if (typeof flags2.variants === "string") {
+      body.variants = flags2.variants.split(",").map((v) => {
+        const [k, w] = v.split(":");
+        return { key: k.trim(), weight: Number(w ?? 1) };
+      });
+    }
+    if (typeof flags2.rules === "string") body.rules = JSON.parse(flags2.rules);
+    const r = await call("PUT", `/api/flags/${encodeURIComponent(key2)}`, withProject(body));
+    return flags2.json ? printJson(r) : line(r.summary);
+  }
+  throw new UsageError(`Unknown subcommand "flags ${sub}".`, "Use: glass flags [list | set <key> | delete <key>]");
+}
+async function experiments(sub, key2, rest, flags2) {
+  if (!sub || sub === "list") {
+    const r = await call("GET", `/api/experiments${projectQuery(flags2)}`);
+    if (flags2.json) return printJson(r);
+    if (!r.experiments.length) return line("No experiments yet. Create one: glass experiments create pricing-v2 --goal signup_completed");
+    table(["Experiment", "Status", "Goal"], r.experiments.map((e) => [e.key, e.status, e.goal.event]));
+    return;
+  }
+  if (!key2) throw new UsageError(`Pass an experiment key: glass experiments ${sub} <key>`);
+  if (sub === "create") {
+    const goal = str2(flags2.goal);
+    if (!goal) throw new UsageError("Pass the goal event: --goal signup_completed");
+    const r = await call(
+      "POST",
+      "/api/experiments",
+      withProject({ key: key2, goal: { event: goal, value: str2(flags2.value) }, flag: str2(flags2.flag), hypothesis: str2(flags2.hypothesis), project: str2(flags2.project) })
+    );
+    return flags2.json ? printJson(r) : line(r.summary);
+  }
+  if (sub === "start" || sub === "stop" || sub === "ship") {
+    const variant = rest[0] ?? str2(flags2.variant);
+    if (sub === "ship" && !variant) throw new UsageError("Pass the variant to ship: glass experiments ship <key> <variant>");
+    const r = await call("POST", `/api/experiments/${encodeURIComponent(key2)}/${sub}`, withProject({ variant, project: str2(flags2.project) }));
+    return flags2.json ? printJson(r) : line(r.summary);
+  }
+  if (sub === "results" || sub === "show") {
+    const r = await call("GET", `/api/experiments/${encodeURIComponent(key2)}${projectQuery(flags2)}`);
+    if (flags2.json) return printJson(r);
+    line(color.bold(r.summary));
+    line();
+    table(
+      ["Variant", "Exposed", "Converted", "Rate", "P(beat control)"],
+      r.results.variants.map((v) => [v.variant, v.exposures, v.conversions, pct(v.conversionRate), v.vsControl ? pct(v.vsControl.probabilityToBeatControl) : "control"])
+    );
+    return;
+  }
+  throw new UsageError(`Unknown subcommand "experiments ${sub}".`, "Use: glass experiments [list | create | start | stop | ship | results]");
+}
+
+// packages/cli/src/commands/init.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join6 } from "node:path";
+
+// packages/core/src/ids.ts
+function randomBytes(n) {
+  const bytes = new Uint8Array(n);
+  crypto.getRandomValues(bytes);
+  return bytes;
+}
+function hex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function randomToken(bytes = 32) {
+  return hex(randomBytes(bytes));
+}
+
+// packages/core/src/instrument.ts
+var scriptTag = (o) => `<script defer src="${o.host}/s.js" data-project="${o.project}"></script>`;
+var browserCapture = (event, props) => `window.glass?.capture(${JSON.stringify(event)}${props && Object.keys(props).length ? `, ${JSON.stringify(props)}` : ""});`;
+var moduleCapture = (event, props) => `import { glass } from '@glassanalytics/web';
+
+glass.capture(${JSON.stringify(event)}${props && Object.keys(props).length ? `, ${JSON.stringify(props)}` : ""});`;
+var FRAMEWORKS = {
+  html: {
+    name: "Plain HTML",
+    snippet: (o) => ({ file: "index.html (inside <head>, on every page)", code: scriptTag(o), capture: browserCapture })
+  },
+  nextjs: {
+    name: "Next.js",
+    snippet: (o) => ({
+      file: "app/layout.tsx (App Router) or pages/_app.tsx",
+      code: `import Script from 'next/script';
+
+// inside <body>:
+<Script src="${o.host}/s.js" data-project="${o.project}" strategy="afterInteractive" />`,
+      capture: browserCapture
+    })
+  },
+  astro: {
+    name: "Astro",
+    snippet: (o) => ({ file: "src/layouts/Layout.astro (inside <head>)", code: scriptTag(o).replace("<script", "<script is:inline"), capture: browserCapture })
+  },
+  sveltekit: {
+    name: "SvelteKit",
+    snippet: (o) => ({ file: "src/app.html (inside <head>)", code: scriptTag(o), capture: browserCapture })
+  },
+  nuxt: {
+    name: "Nuxt",
+    snippet: (o) => ({
+      file: "nuxt.config.ts",
+      code: `export default defineNuxtConfig({
+  app: { head: { script: [{ src: '${o.host}/s.js', defer: true, 'data-project': '${o.project}' }] } },
+});`,
+      capture: browserCapture
+    })
+  },
+  remix: {
+    name: "Remix / React Router",
+    snippet: (o) => ({ file: "app/root.tsx (inside <head>)", code: scriptTag(o).replace("defer ", "defer={true} "), capture: browserCapture })
+  },
+  vite: {
+    name: "Vite (React, Vue, Svelte, Solid\u2026)",
+    snippet: (o) => ({
+      file: "src/main.ts (or main.tsx) \u2014 after `npm install @glassanalytics/web`",
+      code: `import { glass } from '@glassanalytics/web';
+
+glass.init({ host: '${o.host}', project: '${o.project}' });`,
+      capture: moduleCapture
+    })
+  },
+  worker: {
+    name: "Cloudflare Worker / server-side",
+    snippet: (o) => ({
+      file: "any server code",
+      code: `// Server-side capture: POST events to Glass.
+await fetch('${o.host}/e', {
+  method: 'POST',
+  body: JSON.stringify({ project: '${o.project}', events: [{ id: crypto.randomUUID(), event: 'order_paid', ts: Date.now(), distinct_id: userId, user_id: userId, props: { amount: 42 } }] }),
+});`,
+      capture: (event, props) => `await fetch(GLASS_HOST + '/e', { method: 'POST', body: JSON.stringify({ project: GLASS_PROJECT, events: [{ id: crypto.randomUUID(), event: ${JSON.stringify(event)}, ts: Date.now(), distinct_id: userId, user_id: userId, props: ${JSON.stringify(props ?? {})} }] }) });`
+    })
+  }
+};
+function detectFramework(pkg) {
+  if (!pkg) return "html";
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const has = (name) => Object.hasOwn(deps, name);
+  if (has("next")) return "nextjs";
+  if (has("astro")) return "astro";
+  if (has("@sveltejs/kit")) return "sveltekit";
+  if (has("nuxt")) return "nuxt";
+  if (has("@remix-run/react") || has("react-router")) return "remix";
+  if (has("vite")) return "vite";
+  if (has("wrangler") || has("hono")) return "worker";
+  return "html";
+}
+var EVENT_NAMING_GUIDE = 'Name events object_action in snake_case and past tense (signup_completed, plan_upgraded, invite_sent). Put variable details in properties ({ plan: "pro" }), never in the event name. Never send emails, names or other personal data as properties.';
+var EVENT_DOCUMENTATION_GUIDE = 'After a custom event is shipping, call define_event (or `glass events <name> --describe "\u2026"`). The description must say how and when the event is fired (which user action or code path). Document every property with what it means and which values to expect (e.g. description: "Fired when the user finishes checkout after payment succeeds."; properties: { plan: "Chosen plan id (free|pro|enterprise)", amount: "Charge in the account currency" }). list_events returns undocumented custom events \u2014 document those before relying on them in funnels or trends.';
+
+// packages/cli/src/agent-files.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join2 } from "node:path";
+var START = "<!-- glass:start -->";
+var END = "<!-- glass:end -->";
+function agentsSection(o) {
+  return `${START}
+## Analytics (Glass)
+
+This project uses Glass for analytics, session replay, feature flags and A/B tests. It runs in our own Cloudflare account; deployment config is in \`.glass/\`.
+
+- Dashboard: ${o.host}/app (print the key with \`npx @glassanalytics/cli key\`)
+- MCP server \`glass\` is configured in \`.mcp.json\`. Start with the \`overview\` tool, then \`list_events\` for exact event names.
+- Terminal: \`npx @glassanalytics/cli query web --from -7d\`, \`npx @glassanalytics/cli sql "SELECT \u2026"\`, \`npx @glassanalytics/cli --help\`
+
+Tracking (project \`${o.project}\`):
+- Install (${o.snippet.file}): \`${o.snippet.code.split("\n").pop()}\`
+- Custom events: \`glass.capture('signup_completed', { plan: 'pro' })\`. After login: \`glass.identify(user.id, { plan })\`.
+- ${EVENT_NAMING_GUIDE}
+- After adding an event and deploying, confirm it arrives: \`npx @glassanalytics/cli events <name>\` (or MCP \`describe_event\`).
+- ${EVENT_DOCUMENTATION_GUIDE}
+- Prefer MCP \`define_event\` so you can set both the event description and each property's meaning in one call.
+- Feature flags: \`glass.flag('key')\` returns "on", a variant key, or null. Create with \`npx @glassanalytics/cli flags set <key> --rollout 10\`.
+
+Upgrades (the Worker version is pinned in \`.glass/config.json\`):
+- \`.github/workflows/glass.yml\` deploys whatever \`.glass/\` holds when it changes on the default branch. If that file is missing, run \`npx @glassanalytics/cli ci\` and add the \`CLOUDFLARE_API_TOKEN\` repository secret.
+- To upgrade: \`npx @glassanalytics/cli@latest upgrade\` stages the new Worker and migrations into \`.glass/\` without deploying. Commit and push (or open a PR); CI deploys. Ask before pushing if pushes also deploy the site.
+- Do not deploy Glass from a laptop (\`glass upgrade --local\`, wrangler) once the workflow exists, and never commit \`.glass/credentials.json\`.
+- \`glass upgrade\` refuses to replace a newer Worker with an older CLI. If it does, use \`@latest\`; do not pass \`--allow-downgrade\`.
+${END}`;
+}
+function upsertSection(path, section, createIfMissing) {
+  const exists = existsSync2(path);
+  if (!exists && !createIfMissing) return false;
+  const current = exists ? readFileSync2(path, "utf8") : "";
+  const pattern = new RegExp(`${START}[\\s\\S]*?${END}`);
+  const next = pattern.test(current) ? current.replace(pattern, section) : `${current.trimEnd()}${current.trim() ? "\n\n" : ""}${section}
+`;
+  writeFileSync2(path, next);
+  return true;
+}
+function skillFile(o) {
+  return `---
+name: glass
+description: Use when adding analytics events, answering questions about traffic, signups, conversion, retention or errors, debugging what a user did in a session, or creating feature flags and A/B tests in this project.
+---
+
+# Glass analytics
+
+Glass is deployed at ${o.host} (project \`${o.project}\`). Prefer the \`glass\` MCP tools; the CLI (\`npx @glassanalytics/cli \u2026\`) does the same things.
+
+## Answer a question about usage
+
+1. \`overview\` for the period (visitors, top pages, errors, events that moved). If it (or MCP init) says an upgrade is available, tell the user; with their go-ahead, follow "Upgrade Glass" below.
+2. \`list_events\` to get exact event names \u2014 never guess them.
+3. The right query: \`query_trends\` (counts over time), \`query_funnel\` (conversion through steps), \`query_retention\` (who comes back), \`sql\` when nothing else fits.
+4. Report numbers with the dashboard link and SQL from the result.
+
+## Add tracking
+
+1. \`instrument\` with the event name returns the exact code for this framework.
+2. ${EVENT_NAMING_GUIDE}
+3. After deploying, \`describe_event\` (or \`npx @glassanalytics/cli events <name>\`) confirms events arrive with the expected properties.
+4. Always \`define_event\` next. ${EVENT_DOCUMENTATION_GUIDE}
+
+## First session on a project
+
+1. \`overview\` then \`list_events\`.
+2. For every name in \`undocumented\`, read the code that fires it (or ask), then \`define_event\` with how/when it fires and property meanings.
+3. Do not invent funnel or trend queries against undocumented custom events until those descriptions exist.
+
+## Debug a user problem
+
+1. \`query_funnel\` with a breakdown (browser, device, utm_source) to find where people drop.
+2. \`list_replays\` with \`with_errors: true\` (or a \`person\`) to find affected sessions.
+3. \`summarise_replay\` to read what happened: pages, labelled clicks, rage clicks, errors.
+
+## Upgrade Glass
+
+1. \`npx @glassanalytics/cli@latest upgrade\`. With \`.github/workflows/glass.yml\` present this only stages \`.glass/\` (Worker, migrations, pinned version); nothing deploys.
+2. No workflow yet? \`npx @glassanalytics/cli ci\` writes it; the repo needs secret \`CLOUDFLARE_API_TOKEN\` (\`gh secret set CLOUDFLARE_API_TOKEN\`).
+3. Commit \`.glass/\` and push to the default branch (or open a PR). The Glass workflow migrates D1 and deploys.
+4. \`npx @glassanalytics/cli status\` confirms the new version is live.
+
+## Run an experiment
+
+1. \`create_experiment\` with a goal event (creates a control/test flag).
+2. In code: \`if (glass.flag('<key>') === 'test') { \u2026 }\` \u2014 reading the flag records the exposure.
+3. \`update_experiment\` with \`action: "start"\`; later \`experiment_results\`; ship the winner with \`action: "ship"\`.
+`;
+}
+function upsertMcpConfig(path) {
+  let config = {};
+  if (existsSync2(path)) {
+    try {
+      config = JSON.parse(readFileSync2(path, "utf8"));
+    } catch {
+      return false;
+    }
+  }
+  config.mcpServers = { ...config.mcpServers, glass: { command: "npx", args: ["-y", "@glassanalytics/cli", "mcp"] } };
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify(config, null, 2)}
+`);
+  return true;
+}
+function writeAgentFiles(o) {
+  const written = [];
+  const section = agentsSection(o);
+  if (upsertSection(join2(o.root, "AGENTS.md"), section, true)) written.push("AGENTS.md");
+  if (upsertSection(join2(o.root, "CLAUDE.md"), section, false)) written.push("CLAUDE.md");
+  const skill = join2(o.root, ".claude", "skills", "glass", "SKILL.md");
+  mkdirSync2(dirname2(skill), { recursive: true });
+  writeFileSync2(skill, skillFile(o));
+  written.push(".claude/skills/glass/SKILL.md");
+  if (upsertMcpConfig(join2(o.root, ".mcp.json"))) written.push(".mcp.json");
+  if (existsSync2(join2(o.root, ".cursor")) && upsertMcpConfig(join2(o.root, ".cursor", "mcp.json"))) written.push(".cursor/mcp.json");
+  return written;
+}
+
+// packages/cli/src/ci.ts
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
+var CI_WORKFLOW_PATH = ".github/workflows/glass.yml";
+var CI_SECRET = "CLOUDFLARE_API_TOKEN";
+var MARKER = "# Generated by `glass ci`.";
+function inCi(env = process.env) {
+  return env.CI === "true" || env.CI === "1" || env.GITHUB_ACTIONS === "true";
+}
+function hasCiWorkflow(root) {
+  return existsSync3(join3(root, CI_WORKFLOW_PATH));
+}
+function defaultBranch(root) {
+  const git = (args) => {
+    try {
+      return execFileSync("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    } catch {
+      return "";
+    }
+  };
+  const head = git(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]).replace(/^origin\//, "");
+  return head || git(["branch", "--show-current"]) || "main";
+}
+function ciWorkflow(o) {
+  return `${MARKER} Deploys the Glass analytics Worker from .glass/.
+#
+# The version is pinned in .glass/config.json. To upgrade:
+#   npx @glassanalytics/cli@latest upgrade   # stages the new Worker into .glass/
+#   git commit .glass && git push            # this workflow migrates and deploys it
+#
+# Needs repository secret ${o.secret}: a Cloudflare API token with
+# Workers Scripts Edit, D1 Edit, Workers R2 Storage Edit, Account Settings Read
+# (and Zone Workers Routes Edit if .glass/config.json has a route).
+# Worker secrets (API keys) are set by \`glass init\` and survive deploys.
+name: Glass
+
+on:
+  push:
+    branches: [${o.branch}]
+    paths: ['.glass/**', '${CI_WORKFLOW_PATH}']
+  workflow_dispatch:
+
+concurrency:
+  group: glass-deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Deploy the Glass version pinned in .glass/config.json
+        run: |
+          version="$(node -p "require('./.glass/config.json').version")"
+          npx -y "@glassanalytics/cli@\${version}" upgrade --ci
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.${o.secret} }}
+`;
+}
+function writeCiWorkflow(root, options = {}) {
+  const branch = options.branch ?? defaultBranch(root);
+  const secret = options.secret ?? CI_SECRET;
+  const path = join3(root, CI_WORKFLOW_PATH);
+  const next = ciWorkflow({ branch, secret });
+  if (existsSync3(path)) {
+    const current = readFileSync3(path, "utf8");
+    if (!current.startsWith(MARKER)) return { path: CI_WORKFLOW_PATH, status: "kept", branch, secret };
+    if (current === next) return { path: CI_WORKFLOW_PATH, status: "kept", branch, secret };
+    writeFileSync3(path, next);
+    return { path: CI_WORKFLOW_PATH, status: "updated", branch, secret };
+  }
+  mkdirSync3(dirname3(path), { recursive: true });
+  writeFileSync3(path, next);
+  return { path: CI_WORKFLOW_PATH, status: "created", branch, secret };
+}
+function ciNextSteps(o) {
+  return [
+    `Add repository secret ${o.secret} (a Cloudflare API token; same scopes as init): gh secret set ${o.secret}`,
+    `Commit .glass/ (not credentials.json, which is git-ignored) and ${CI_WORKFLOW_PATH}, then push to ${o.branch}.`,
+    "Upgrade later with `npx @glassanalytics/cli@latest upgrade`: it stages the new version into .glass/ without deploying. Commit and push; the workflow deploys it.",
+    "Do not deploy Glass from a laptop once this workflow exists. `glass upgrade --local` overrides that for emergencies only."
+  ];
+}
+
+// packages/cli/src/cloudflare/provision.ts
+import { copyFileSync, mkdirSync as mkdirSync4, readdirSync, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join4 } from "node:path";
+
+// packages/core/src/events.ts
+var EVENT_COLUMNS = [
+  "id",
+  "project",
+  "event",
+  "ts_ms",
+  "distinct_id",
+  "user_id",
+  "person_id",
+  "session_id",
+  "url",
+  "host",
+  "path",
+  "referrer",
+  "referrer_host",
+  "title",
+  "utm_source",
+  "utm_medium",
+  "utm_campaign",
+  "utm_term",
+  "utm_content",
+  "country",
+  "region",
+  "city",
+  "device",
+  "browser",
+  "os",
+  "flags",
+  "props",
+  "person_props",
+  "lib",
+  "received_ms"
+];
+
+// packages/core/src/lake.ts
+var INTEGER_COLUMNS = /* @__PURE__ */ new Set(["ts_ms", "received_ms"]);
+var OPTIONAL_COLUMNS = /* @__PURE__ */ new Set(["user_id"]);
+var LAKE_TABLES = {
+  events: {
+    stream: "glass_events",
+    fields: [
+      ...EVENT_COLUMNS.map(
+        (name) => ({
+          name,
+          type: INTEGER_COLUMNS.has(name) ? "int64" : "string",
+          required: !OPTIONAL_COLUMNS.has(name)
+        })
+      ),
+      { name: "ts", type: "timestamp", required: true }
+    ]
+  },
+  identities: {
+    stream: "glass_identities",
+    fields: [
+      { name: "project", type: "string", required: true },
+      { name: "distinct_id", type: "string", required: true },
+      { name: "person_id", type: "string", required: true },
+      { name: "created_at", type: "int64", required: true }
+    ]
+  }
+};
+function streamSchemaFile(table2) {
+  return { fields: [...LAKE_TABLES[table2].fields] };
+}
+
+// packages/cli/src/cloudflare/wrangler.ts
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+var WranglerError = class extends Error {
+  result;
+  args;
+  constructor(args, result) {
+    const output = `${result.stderr}
+${result.stdout}`.trim().split("\n").slice(-12).join("\n");
+    super(`wrangler ${args.slice(0, 3).join(" ")} failed:
+${output}`);
+    this.args = args;
+    this.result = result;
+  }
+  get output() {
+    return `${this.result.stdout}
+${this.result.stderr}`;
+  }
+};
+function wranglerCommand() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    return { cmd: process.execPath, prefix: [require2.resolve("wrangler/bin/wrangler.js")] };
+  } catch {
+    return { cmd: process.platform === "win32" ? "npx.cmd" : "npx", prefix: ["--yes", "wrangler@4"] };
+  }
+}
+function createWrangler(auth, cwd) {
+  const { cmd, prefix } = wranglerCommand();
+  return {
+    run(args, options = {}) {
+      return new Promise((resolve2, reject) => {
+        const child = spawn(cmd, [...prefix, ...args], {
+          cwd,
+          env: {
+            ...process.env,
+            CLOUDFLARE_API_TOKEN: auth.token,
+            CLOUDFLARE_ACCOUNT_ID: auth.accountId,
+            CI: "1",
+            WRANGLER_SEND_METRICS: "false"
+          },
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (d) => {
+          stdout += d.toString();
+        });
+        child.stderr.on("data", (d) => {
+          stderr += d.toString();
+        });
+        child.on("error", reject);
+        child.on("close", (code) => resolve2({ code: code ?? 1, stdout, stderr }));
+        if (options.input !== void 0) child.stdin.write(options.input);
+        child.stdin.end();
+      });
+    }
+  };
+}
+async function must(wrangler, args, options) {
+  const result = await wrangler.run(args, options);
+  if (result.code !== 0) throw new WranglerError(args, result);
+  return result.stdout;
+}
+function parseJsonOutput(stdout) {
+  const start = stdout.search(/[[{]/);
+  if (start < 0) throw new Error(`Expected JSON from wrangler, got: ${stdout.slice(0, 200)}`);
+  return JSON.parse(stdout.slice(start));
+}
+
+// packages/cli/src/cloudflare/provision.ts
+var isAlreadyExists = (err) => err instanceof WranglerError && /already exists|already own|10004|11009/i.test(err.output);
+var isR2Disabled = (err) => err instanceof WranglerError && /enable R2|R2 (is|has) not been enabled|purchase R2|10042/i.test(err.output);
+async function ensureD1(wrangler, name, eu, report) {
+  const find = async () => parseJsonOutput(await must(wrangler, ["d1", "list", "--json"])).find((db2) => db2.name === name);
+  let db = await find();
+  if (db) {
+    report("ok", `D1 database "${name}"`, "exists");
+  } else {
+    await must(wrangler, ["d1", "create", name, ...eu ? ["--jurisdiction", "eu"] : []]);
+    db = await find();
+    if (!db) throw new Error(`Created D1 database "${name}" but could not find it afterwards.`);
+    report("created", `D1 database "${name}"`);
+  }
+  return { name, id: db.uuid };
+}
+async function ensureBucket(wrangler, bucket, eu, report, purpose) {
+  try {
+    await must(wrangler, ["r2", "bucket", "create", bucket, ...eu ? ["--jurisdiction", "eu"] : []]);
+    report("created", `R2 bucket "${bucket}" for ${purpose}`);
+    return true;
+  } catch (err) {
+    if (isAlreadyExists(err)) {
+      report("ok", `R2 bucket "${bucket}" for ${purpose}`, "exists");
+      return true;
+    }
+    if (isR2Disabled(err)) return false;
+    throw err;
+  }
+}
+async function findByName(wrangler, kind, name) {
+  const args = kind ? ["pipelines", kind, "list", "--json", "--per-page", "100"] : ["pipelines", "list", "--json", "--per-page", "100"];
+  const items = parseJsonOutput(await must(wrangler, args));
+  return items.find((i) => i.name === name);
+}
+async function ensureLake(wrangler, options, report) {
+  if (!await ensureBucket(wrangler, options.bucket, options.eu, report, "event lake")) {
+    throw new Error("Lake mode needs R2. Enable R2 in the Cloudflare dashboard, then run `glass init --lake` again.");
+  }
+  let enabled = false;
+  for (const args of [
+    ["r2", "bucket", "catalog", "enable", options.bucket],
+    ["basin", "catalog", "enable", options.bucket]
+  ]) {
+    const r = await wrangler.run(args);
+    if (r.code === 0 || /already enabled/i.test(r.stdout + r.stderr)) {
+      enabled = true;
+      break;
+    }
+  }
+  if (!enabled) throw new Error(`Could not enable the data catalog on "${options.bucket}". Enable it in the R2 dashboard, then re-run.`);
+  report("ok", `Data catalog on "${options.bucket}"`);
+  const streams = {};
+  for (const table2 of Object.keys(LAKE_TABLES)) {
+    const streamName = LAKE_TABLES[table2].stream;
+    const sinkName = `${streamName}_sink`;
+    let stream = await findByName(wrangler, "streams", streamName);
+    if (!stream) {
+      const schemaPath = join4(options.dir, "schemas", `${table2}.json`);
+      mkdirSync4(join4(options.dir, "schemas"), { recursive: true });
+      writeFileSync4(schemaPath, `${JSON.stringify(streamSchemaFile(table2), null, 2)}
+`);
+      await must(wrangler, ["pipelines", "streams", "create", streamName, "--schema-file", schemaPath, "--http-enabled", "false"]);
+      stream = await findByName(wrangler, "streams", streamName);
+      if (!stream) throw new Error(`Created stream "${streamName}" but could not find it.`);
+      report("created", `Pipelines stream "${streamName}"`);
+    }
+    streams[table2] = stream.id;
+    if (!await findByName(wrangler, "sinks", sinkName)) {
+      await must(wrangler, [
+        "pipelines",
+        "sinks",
+        "create",
+        sinkName,
+        "--type",
+        "r2-data-catalog",
+        "--bucket",
+        options.bucket,
+        "--namespace",
+        options.namespace,
+        "--table",
+        table2,
+        "--catalog-token",
+        options.token,
+        "--roll-interval",
+        "60"
+      ]);
+      report("created", `Iceberg table "${options.namespace}.${table2}"`);
+    }
+    if (!await findByName(wrangler, null, streamName)) {
+      await must(wrangler, ["pipelines", "create", streamName, "--sql", `INSERT INTO ${sinkName} SELECT * FROM ${streamName}`]);
+      report("created", `Pipeline "${streamName}"`);
+    }
+  }
+  return { bucket: options.bucket, namespace: options.namespace, streams };
+}
+function renderWranglerConfig(config) {
+  const vars = { GLASS_STORE: config.store };
+  if (config.lake) {
+    vars.LAKE_BUCKET = config.lake.bucket;
+    vars.LAKE_NAMESPACE = config.lake.namespace;
+    vars.CF_ACCOUNT_ID = config.accountId;
+  }
+  if (config.route) vars.GLASS_PUBLIC_URL = `https://${config.route.replace(/\/\*$/, "")}`;
+  const wrangler = {
+    name: config.name,
+    main: "worker.js",
+    compatibility_date: "2026-10-01",
+    workers_dev: true,
+    d1_databases: [{ binding: "DB", database_name: config.d1.name, database_id: config.d1.id, migrations_dir: "migrations" }],
+    vars,
+    triggers: { crons: ["17 3 * * *"] },
+    observability: { enabled: true }
+  };
+  if (config.replay) wrangler.r2_buckets = [{ binding: "REPLAYS", bucket_name: config.replay.bucket }];
+  if (config.lake) {
+    wrangler.pipelines = [
+      { binding: "EVENTS_STREAM", stream: config.lake.streams.events },
+      { binding: "IDENTITIES_STREAM", stream: config.lake.streams.identities }
+    ];
+  }
+  if (config.route) {
+    const zone = config.route.split("/")[0].split(".").slice(-2).join(".");
+    wrangler.routes = [{ pattern: config.route, zone_name: zone }];
+  }
+  return `// Generated by \`glass\`. Edit .glass/config.json and run \`glass upgrade\` instead of editing this file.
+${JSON.stringify(wrangler, null, 2)}
+`;
+}
+function installWorkerFiles(dir, bundleDir) {
+  mkdirSync4(join4(dir, "migrations"), { recursive: true });
+  copyFileSync(join4(bundleDir, "worker.js"), join4(dir, "worker.js"));
+  for (const file of readdirSync(join4(bundleDir, "migrations"))) {
+    copyFileSync(join4(bundleDir, "migrations", file), join4(dir, "migrations", file));
+  }
+}
+async function deploy(wrangler, configPath) {
+  const out = await must(wrangler, ["deploy", "--config", configPath]);
+  return /https:\/\/[\w.-]+\.workers\.dev/.exec(out)?.[0] ?? null;
+}
+async function migrate(wrangler, database, configPath) {
+  await must(wrangler, ["d1", "migrations", "apply", database, "--remote", "--config", configPath]);
+}
+async function putSecrets(wrangler, secrets, configPath, dir) {
+  const file = join4(dir, ".secrets.tmp.json");
+  writeFileSync4(file, JSON.stringify(secrets), { mode: 384 });
+  try {
+    await must(wrangler, ["secret", "bulk", file, "--config", configPath]);
+  } finally {
+    rmSync(file, { force: true });
+  }
+}
+async function listAccounts(token, fetcher = fetch) {
+  const res = await fetcher("https://api.cloudflare.com/client/v4/accounts?per_page=50", { headers: { Authorization: `Bearer ${token}` } });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.success) {
+    throw new Error(`Cloudflare rejected the API token: ${body.errors?.[0]?.message ?? `HTTP ${res.status}`}`);
+  }
+  return body.result ?? [];
+}
+var TOKEN_SCOPES = [
+  "Account \u203A Workers Scripts \u203A Edit",
+  "Account \u203A D1 \u203A Edit",
+  "Account \u203A Workers R2 Storage \u203A Edit",
+  "Account \u203A Account Settings \u203A Read",
+  "Zone \u203A Workers Routes \u203A Edit (only with --route)",
+  "Account \u203A Pipelines \u203A Edit, Workers R2 Data Catalog \u203A Edit, Workers R2 SQL \u203A Read (only with --lake)"
+];
+
+// packages/cli/src/prompt.ts
+import { createInterface } from "node:readline/promises";
+var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !process.env.CI);
+async function ask(question, options) {
+  if (!interactive()) {
+    if (options.default !== void 0) return options.default;
+    throw new UsageError(`Missing ${options.flag}.`, `Pass ${options.flag} (this terminal is not interactive).`);
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+  if (options.secret) {
+    const write = rl._writeToOutput.bind(rl);
+    rl._writeToOutput = (s) => write(s.startsWith(question) ? s : "*");
+  }
+  const suffix = options.default ? ` (${options.default})` : "";
+  const answer = (await rl.question(`${question}${suffix}: `)).trim();
+  rl.close();
+  if (options.secret) process.stdout.write("\n");
+  return answer || options.default || "";
+}
+async function choose(question, items, label, flag) {
+  if (items.length === 1) return items[0];
+  if (!interactive()) throw new UsageError(`Several options for ${flag}: ${items.map(label).join(", ")}.`, `Pass ${flag}.`);
+  items.forEach((item2, i) => process.stdout.write(`  ${i + 1}. ${label(item2)}
+`));
+  const answer = Number(await ask(question, { flag, default: "1" }));
+  const item = items[answer - 1];
+  if (!item) throw new UsageError(`Pick a number from 1 to ${items.length}.`);
+  return item;
+}
+
+// packages/cli/src/commands/upgrade.ts
+import { existsSync as existsSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+import { fileURLToPath } from "node:url";
+function workerBundleDir() {
+  const candidates = [new URL("./worker/", import.meta.url), new URL("../../../worker/dist/", import.meta.url)];
+  for (const c of candidates) {
+    const dir = fileURLToPath(c);
+    if (existsSync4(join5(dir, "worker.js")) && existsSync4(join5(dir, "migrations"))) return dir;
+  }
+  throw new UsageError("The Worker bundle is missing.", "If you are working on Glass itself, run `pnpm build` first.");
+}
+async function liveVersion(host, fetcher) {
+  if (!host) return null;
+  try {
+    const res = await fetcher(`${host}/health`, { signal: AbortSignal.timeout(5e3) });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return typeof body.version === "string" ? body.version : null;
+  } catch {
+    return null;
+  }
+}
+async function upgrade(options, deps = {}) {
+  const root = deps.root ?? projectRoot();
+  const env = deps.env ?? process.env;
+  const config = loadConfig(root);
+  if (!config) throw new UsageError("No Glass deployment in this project.", "Run `npx @glassanalytics/cli init` first.");
+  const ci2 = options.ci ?? inCi(env);
+  const credentials = loadCredentials(root);
+  if (!credentials && !ci2) throw new UsageError("No .glass/credentials.json in this project.", "Run `npx @glassanalytics/cli init` again to restore keys, or deploy from CI (`glass upgrade --ci`), which leaves Worker secrets as they are.");
+  const dir = glassDir(root);
+  const bundle = deps.bundleDir ?? workerBundleDir();
+  const live = await liveVersion(config.host, deps.fetcher ?? fetch);
+  const deployed = [config.version, live].filter((v) => Boolean(v)).sort((a, b) => isNewerThan(a, b) ? -1 : 1)[0];
+  if (deployed && isNewerThan(deployed, GLASS_VERSION) && !options.allowDowngrade) {
+    throw new UsageError(
+      `This deployment runs Glass ${deployed}, which is newer than this CLI (${GLASS_VERSION}). Nothing was changed.`,
+      `Run \`${UPGRADE_COMMAND}\` (or npx @glassanalytics/cli@${deployed} or later). --allow-downgrade forces the older Worker.`
+    );
+  }
+  const from = config.version;
+  if (hasCiWorkflow(root) && !ci2 && !options.local) {
+    installWorkerFiles(dir, bundle);
+    config.version = GLASS_VERSION;
+    writeFileSync5(join5(dir, "wrangler.jsonc"), renderWranglerConfig(config));
+    saveConfig(config, root);
+    const branch = defaultBranch(root);
+    if (options.json) {
+      printJson({ from, to: GLASS_VERSION, staged: true, deploy: CI_WORKFLOW_PATH, next: `Commit .glass/ and push to ${branch}` });
+      return;
+    }
+    ok(`Staged Glass ${from === GLASS_VERSION ? GLASS_VERSION : `${from} \u2192 ${GLASS_VERSION}`} in .glass/ (nothing deployed)`);
+    line(`  Commit .glass/ and push to ${branch}; ${CI_WORKFLOW_PATH} migrates and deploys it.`);
+    line(color.dim("  Deploying from this machine instead: glass upgrade --local"));
+    return;
+  }
+  const token = options.token ?? env.CLOUDFLARE_API_TOKEN ?? (ci2 ? void 0 : await ask("Cloudflare API token", { flag: "--token (or CLOUDFLARE_API_TOKEN)", secret: true }));
+  if (!token) throw new UsageError("CLOUDFLARE_API_TOKEN is not set.", `In CI, map the repository secret to it (see ${CI_WORKFLOW_PATH}).`);
+  const wrangler = (deps.wrangler ?? createWrangler)({ token, accountId: config.accountId }, root);
+  const report = (status2, label, detail) => {
+    if (options.json) return;
+    (status2 === "skipped" ? skip : ok)(`${label}${detail ? color.dim(` (${detail})`) : ""}`);
+  };
+  if (!config.replay && await ensureBucket(wrangler, `${config.name}-replays`, config.eu, report, "session replay")) {
+    config.replay = { bucket: `${config.name}-replays` };
+  }
+  installWorkerFiles(dir, bundle);
+  const configPath = join5(dir, "wrangler.jsonc");
+  writeFileSync5(configPath, renderWranglerConfig(config));
+  await migrate(wrangler, config.d1.name, configPath);
+  report("ok", "Migrations applied");
+  await deploy(wrangler, configPath);
+  if (credentials) {
+    await putSecrets(
+      wrangler,
+      {
+        GLASS_ADMIN_KEY: credentials.adminKey,
+        GLASS_READ_KEY: credentials.readKey,
+        GLASS_SALT_SECRET: credentials.saltSecret
+        // CF_API_TOKEN (lake mode) is set by init and left alone here, so a narrower token you set stays.
+      },
+      configPath,
+      dir
+    );
+  } else {
+    report("skipped", "Worker secrets", "no credentials.json here; the keys set by init stay in place");
+  }
+  config.version = GLASS_VERSION;
+  saveConfig(config, root);
+  if (options.json) printJson({ from, to: GLASS_VERSION, host: config.host, replay: Boolean(config.replay), staged: false });
+  else ok(`Glass ${from === GLASS_VERSION ? GLASS_VERSION : `${from} upgraded to ${GLASS_VERSION}`} is live at ${config.host}`);
+  if (!ci2 && !hasCiWorkflow(root) && !options.json) {
+    line(color.dim(`  Tip: \`glass ci\` writes ${CI_WORKFLOW_PATH} so future upgrades deploy from CI instead of this machine.`));
+  }
+}
+function ci(options, deps = {}) {
+  const root = deps.root ?? projectRoot();
+  if (!loadConfig(root)) throw new UsageError("No Glass deployment in this project.", "Run `npx @glassanalytics/cli init` first.");
+  const result = writeCiWorkflow(root, { branch: options.branch, secret: options.secret });
+  const next = ciNextSteps(result);
+  if (options.json) {
+    printJson({ ...result, next });
+    return;
+  }
+  (result.status === "kept" ? skip : ok)(`${result.path} ${result.status === "kept" ? "already exists (left as is)" : result.status}`);
+  line();
+  line(color.bold("Finish CI setup"));
+  for (const [i, step] of next.entries()) line(`  ${i + 1}. ${step}`);
+}
+async function status(options) {
+  const conn = connection();
+  const config = loadConfig();
+  const health = await call("GET", "/health");
+  const events2 = await call("GET", `/api/events?days=1${conn.project ? `&project=${conn.project}` : ""}`).catch(() => ({ events: [] }));
+  const total = events2.events.reduce((a, e) => a + e.count, 0);
+  const last = events2.events.map((e) => e.lastSeen).sort().at(-1);
+  const mcp = existsSync4(join5(projectRoot(), ".mcp.json"));
+  const cliMismatch = health.version !== GLASS_VERSION;
+  const npmNewer = Boolean(health.latest && isNewerThan(health.latest, health.version));
+  const upgradeAvailable = Boolean(health.upgradeAvailable) || cliMismatch || npmNewer;
+  const upgradeCommand = health.upgradeCommand ?? UPGRADE_COMMAND;
+  const result = {
+    host: conn.host,
+    project: conn.project,
+    version: health.version,
+    latest: health.latest ?? null,
+    cliVersion: GLASS_VERSION,
+    store: health.store,
+    replay: health.replay,
+    eventsLast24h: total,
+    lastEvent: last ?? null,
+    mcpConfigured: mcp,
+    upgradeAvailable,
+    upgradeCommand,
+    account: config?.accountId
+  };
+  if (options.json) return printJson(result);
+  ok(`Worker reachable at ${conn.host} (Glass ${health.version}, ${health.store} store)`);
+  (total ? ok : skip)(total ? `${total.toLocaleString("en-US")} events in the last 24 hours, latest ${last}` : "No events in the last 24 hours. Is the snippet installed?");
+  (health.replay ? ok : skip)(health.replay ? "Session replay enabled" : "Session replay disabled (no R2 bucket); `glass upgrade` retries");
+  (mcp ? ok : skip)(mcp ? "MCP server configured in .mcp.json" : "No .mcp.json; run `glass init` again to write agent files");
+  if (health.latest && isNewerThan(health.latest, health.version)) {
+    skip(`Glass ${health.latest} is available (this deployment is ${health.version}). Run: ${upgradeCommand}`);
+  } else if (cliMismatch) {
+    skip(`This CLI is Glass ${GLASS_VERSION}; the Worker runs ${health.version}. Run: ${upgradeCommand}`);
+  } else {
+    ok(`Up to date (Glass ${health.version})`);
+  }
+}
+function key(options) {
+  const conn = connection();
+  const credentials = loadCredentials();
+  const value = options.read ? credentials?.readKey : conn.key;
+  if (options.json) return printJson({ host: conn.host, project: conn.project, dashboard: `${conn.host}/app`, key: value });
+  line(`Dashboard: ${conn.host}/app`);
+  line(`${options.read ? "Read-only key" : "Admin key"}: ${value}`);
+  line(color.dim(options.read ? "Safe to share for viewing." : "Full access. Use `glass key --read` for a key that can only view."));
+}
+
+// packages/cli/src/commands/init.ts
+function defaultProjectId(root) {
+  try {
+    const pkg = JSON.parse(readFileSync4(join6(root, "package.json"), "utf8"));
+    const id = (pkg.name ?? "").replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+    if (id) return id.slice(0, 63);
+  } catch {
+  }
+  return "default";
+}
+function readPackageJson(root) {
+  try {
+    return JSON.parse(readFileSync4(join6(root, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function waitForWorker(host, key2, fetcher, pollMs) {
+  for (let attempt = 0; attempt < 20; attempt++) {
+    try {
+      const res = await fetcher(`${host}/api`, { headers: { Authorization: `Bearer ${key2}` } });
+      if (res.ok) return;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+  throw new UsageError(`The Worker at ${host} did not come up.`, "Run `glass status` in a minute; if it persists, `glass upgrade` redeploys.");
+}
+async function init(options, deps = {}) {
+  const root = deps.root ?? projectRoot();
+  const dir = glassDir(root);
+  const fetcher = deps.fetcher ?? fetch;
+  const existing = loadConfig(root);
+  const quiet = Boolean(options.json);
+  const steps = [];
+  const report = (status2, label, detail) => {
+    steps.push({ status: status2, label, detail });
+    if (quiet) return;
+    const text = `${label}${detail ? color.dim(` (${detail})`) : status2 === "created" ? color.dim(" (created)") : ""}`;
+    if (status2 === "skipped") skip(text);
+    else ok(text);
+  };
+  if (!quiet) {
+    line(color.bold("Glass: analytics in your own Cloudflare account"));
+    line();
+  }
+  const token = options.token ?? process.env.CLOUDFLARE_API_TOKEN ?? await ask("Cloudflare API token", { flag: "--token (or CLOUDFLARE_API_TOKEN)", secret: true });
+  if (!token) throw new UsageError("A Cloudflare API token is required.", `Create one at https://dash.cloudflare.com/profile/api-tokens with: ${TOKEN_SCOPES.join("; ")}.`);
+  const accounts = await listAccounts(token, fetcher).catch((err) => {
+    throw new UsageError(err instanceof Error ? err.message : String(err), "Check the token, or create a new one at https://dash.cloudflare.com/profile/api-tokens");
+  });
+  const accountId = options.account ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? existing?.accountId;
+  const account = accountId ? accounts.find((a) => a.id === accountId) ?? { id: accountId, name: accountId } : await choose("Which account?", accounts, (a) => `${a.name} (${a.id})`, "--account");
+  if (!account) throw new UsageError("This token cannot see any Cloudflare accounts.", `Give it account permissions: ${TOKEN_SCOPES.join("; ")}.`);
+  report("ok", `Cloudflare token works (account ${account.name})`);
+  const name = options.name ?? existing?.name ?? "glass";
+  const project = options.project ?? existing?.project ?? defaultProjectId(root);
+  const lake = options.lake ?? existing?.store === "lake";
+  const eu = options.eu ?? existing?.eu ?? false;
+  const route = options.route ?? existing?.route ?? null;
+  const wantReplay = options.replay ?? true;
+  if (options.dryRun) {
+    const plan = {
+      account: account.id,
+      worker: name,
+      project,
+      store: lake ? "lake" : "d1",
+      eu,
+      route,
+      replay: wantReplay,
+      resources: [
+        `D1 database "${name}"`,
+        wantReplay ? `R2 bucket "${name}-replays"` : null,
+        lake ? `R2 bucket "${name}-data" with data catalog, Pipelines streams/sinks for events and identities` : null
+      ].filter(Boolean),
+      files: [".glass/config.json", ".glass/wrangler.jsonc", ".glass/worker.js", ".glass/migrations/", ".glass/credentials.json (git-ignored)", "AGENTS.md", ".claude/skills/glass/SKILL.md", ".mcp.json", ...options.ci === false ? [] : [CI_WORKFLOW_PATH]]
+    };
+    if (quiet) printJson(plan);
+    else {
+      line();
+      line("Dry run: nothing was changed. This would create:");
+      for (const r of plan.resources) line(`  ${r}`);
+      line(`and deploy Worker "${name}" for project "${project}", writing ${plan.files.join(", ")}.`);
+    }
+    return;
+  }
+  const wrangler = (deps.wrangler ?? createWrangler)({ token, accountId: account.id }, root);
+  try {
+    const d1 = await ensureD1(wrangler, name, eu, report);
+    let replay = null;
+    if (wantReplay) {
+      const bucket = `${name}-replays`;
+      if (await ensureBucket(wrangler, bucket, eu, report, "session replay")) replay = { bucket };
+      else report("skipped", "Session replay", "R2 is not enabled on this account; enable it in the Cloudflare dashboard, then run `glass upgrade`");
+    } else {
+      report("skipped", "Session replay", "disabled with --no-replay");
+    }
+    const lakeConfig = lake ? await ensureLake(wrangler, { bucket: `${name}-data`, namespace: "glass", token, eu, dir }, report) : null;
+    const config = {
+      name,
+      accountId: account.id,
+      host: existing?.host ?? "",
+      project,
+      store: lake ? "lake" : "d1",
+      d1,
+      replay,
+      lake: lakeConfig,
+      route,
+      eu,
+      version: GLASS_VERSION
+    };
+    const credentials = loadCredentials(root) ?? { adminKey: randomToken(), readKey: randomToken(), saltSecret: randomToken() };
+    installWorkerFiles(dir, deps.bundleDir ?? workerBundleDir());
+    const configPath = join6(dir, "wrangler.jsonc");
+    writeFileSync6(configPath, renderWranglerConfig(config));
+    saveCredentials(credentials, root);
+    await migrate(wrangler, d1.name, configPath);
+    report("ok", "Database migrated");
+    const url = await deploy(wrangler, configPath);
+    config.host = route ? `https://${route.replace(/\/\*$/, "")}` : url ?? config.host;
+    if (!config.host) throw new UsageError("Deployed, but could not read the Worker URL.", "Enable a workers.dev subdomain in the Cloudflare dashboard (Workers & Pages), then run `glass upgrade`.");
+    await putSecrets(
+      wrangler,
+      {
+        GLASS_ADMIN_KEY: credentials.adminKey,
+        GLASS_READ_KEY: credentials.readKey,
+        GLASS_SALT_SECRET: credentials.saltSecret,
+        ...lake ? { CF_API_TOKEN: token } : {}
+      },
+      configPath,
+      dir
+    );
+    saveConfig(config, root);
+    report("ok", `Worker deployed at ${config.host}`);
+    await waitForWorker(config.host, credentials.adminKey, fetcher, deps.pollMs ?? 1500);
+    await call("POST", "/api/projects", { id: project }, { host: config.host, key: credentials.adminKey, fetcher });
+    report("ok", `Project "${project}" ready`);
+    const auth = { host: config.host, key: credentials.adminKey, fetcher };
+    await call("POST", "/e", { project, events: [{ id: randomToken(16), event: "$install_check", ts: Date.now(), distinct_id: "glass-cli" }] }, auth);
+    if (lake) {
+      report("ok", "Test event sent", "the lake shows events within about two minutes");
+    } else {
+      const seen = await call("GET", `/api/events?days=1&project=${encodeURIComponent(project)}`, void 0, auth);
+      if (seen.events.some((e) => e.event === "$install_check")) report("ok", "Test event received");
+      else report("skipped", "Test event not visible yet", "run `glass status` in a minute");
+    }
+    const framework = detectFramework(readPackageJson(root));
+    const snippet = FRAMEWORKS[framework].snippet({ host: config.host, project });
+    const written = options.agentFiles === false ? [] : writeAgentFiles({ root, host: config.host, project, snippet });
+    const workflow = options.ci === false ? null : writeCiWorkflow(root);
+    if (workflow && workflow.status !== "kept") written.push(workflow.path);
+    const ci2 = workflow ? { workflow: workflow.path, status: workflow.status, branch: workflow.branch, secret: workflow.secret, next: ciNextSteps(workflow) } : null;
+    if (quiet) {
+      printJson({ host: config.host, project, dashboard: `${config.host}/app`, framework, snippet, written, ci: ci2, steps });
+      return;
+    }
+    line();
+    line(color.bold(`Next: add Glass to your site (${FRAMEWORKS[framework].name})`));
+    line();
+    line(color.dim(`  ${snippet.file}`));
+    for (const l of snippet.code.split("\n")) line(`  ${l}`);
+    line();
+    line(`Then track what matters: ${color.cyan("glass.capture('signup_completed', { plan: 'pro' })")}`);
+    if (written.length) {
+      line();
+      line(color.bold("Written for your agent"));
+      for (const f of written) line(`  ${f}`);
+      line(`  .glass/ ${color.dim("(deployment config: commit it; credentials.json is git-ignored)")}`);
+    }
+    if (ci2) {
+      line();
+      line(color.bold("Upgrades deploy from CI"));
+      line(color.dim(`  ${ci2.workflow} deploys the version pinned in .glass/config.json. Agents: finish these steps now.`));
+      for (const [i, step] of ci2.next.entries()) line(`  ${i + 1}. ${step}`);
+    }
+    line();
+    line(`Dashboard: ${color.cyan(`${config.host}/app`)} ${color.dim("(sign in with the key from `npx @glassanalytics/cli key`)")}`);
+  } catch (err) {
+    if (err instanceof WranglerError && /Authentication|not authorized|permission|10000|9109/i.test(err.output)) {
+      throw new UsageError(`Cloudflare refused a request: ${err.message.split("\n")[0]}`, `The API token needs: ${TOKEN_SCOPES.join("; ")}.`);
+    }
+    throw err;
+  }
+}
+
+// packages/cli/src/commands/mcp.ts
+import { createInterface as createInterface2 } from "node:readline";
+async function mcpBridge(options = {}) {
+  const conn = connection();
+  const fetcher = options.fetcher ?? fetch;
+  const output = options.output ?? process.stdout;
+  const rl = createInterface2({ input: options.input ?? process.stdin, crlfDelay: Number.POSITIVE_INFINITY });
+  const pending = [];
+  const send = (message) => output.write(`${JSON.stringify(message)}
+`);
+  const forward = async (lineText) => {
+    let message;
+    try {
+      message = JSON.parse(lineText);
+    } catch {
+      send({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } });
+      return;
+    }
+    try {
+      const res = await fetcher(`${conn.host}/mcp`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${conn.key}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: lineText
+      });
+      if (res.status === 202 || message.id === void 0) return;
+      const text = await res.text();
+      if (!res.ok && !text.startsWith("{")) {
+        send({ jsonrpc: "2.0", id: message.id ?? null, error: { code: -32603, message: `Glass returned HTTP ${res.status}: ${text.slice(0, 200)}` } });
+        return;
+      }
+      output.write(`${text.replace(/\n/g, "")}
+`);
+    } catch (err) {
+      send({ jsonrpc: "2.0", id: message.id ?? null, error: { code: -32603, message: `Could not reach ${conn.host}: ${err instanceof Error ? err.message : String(err)}` } });
+    }
+  };
+  for await (const lineText of rl) {
+    if (lineText.trim()) pending.push(forward(lineText));
+  }
+  await Promise.all(pending);
+}
+
+// packages/cli/src/upgrade-check.ts
+var checked = false;
+async function warnIfOutdated(options = {}) {
+  if (checked || options.json) return;
+  checked = true;
+  try {
+    const health = await call("GET", "/health");
+    const command = health.upgradeCommand ?? UPGRADE_COMMAND;
+    if (health.upgradeAvailable && health.latest) {
+      skip(`Glass ${health.latest} is available (this deployment is ${health.version}). Run: ${command}`);
+      return;
+    }
+    if (health.version !== GLASS_VERSION) {
+      skip(`Worker is Glass ${health.version}; this CLI is ${GLASS_VERSION}. Run: ${command}`);
+    }
+  } catch {
+  }
+}
+
+// packages/cli/src/index.ts
+var HELP = `${color.bold("glass")} ${GLASS_VERSION}: agent-first analytics in your own Cloudflare account
+
+${color.bold("Set up")}
+  glass init                     Deploy Glass and wire it into this project
+    --token <token>                Cloudflare API token (or CLOUDFLARE_API_TOKEN)
+    --account <id>                 Cloudflare account id (or CLOUDFLARE_ACCOUNT_ID)
+    --project <id>                 Project id (default: package.json name)
+    --name <name>                  Worker and resource name (default: glass)
+    --route <host/_glass/*>        Also serve from your domain, e.g. acme.com/_glass/*
+    --lake                         Store events in Iceberg on R2 (Pipelines + Basin SQL)
+    --eu                           Keep data in the EU jurisdiction
+    --no-replay                    Skip session replay storage
+    --no-agent-files               Don't write AGENTS.md, SKILL.md or .mcp.json
+    --no-ci                        Don't write .github/workflows/glass.yml
+    --dry-run                      Show what would be created
+  glass upgrade                  Move to this CLI's version of Glass and migrate
+                                   With .github/workflows/glass.yml: stage into .glass/ only;
+                                   commit and push, and CI deploys it
+    --ci                           Deploy as CI (no prompts; default when CI=true)
+    --local                        Deploy from here even though a CI workflow exists
+    --allow-downgrade              Replace a newer deployed Worker with this older one
+  glass ci [--branch main]       Write the workflow that deploys Glass from CI
+    --secret <name>                Repo secret with the Cloudflare token (default CLOUDFLARE_API_TOKEN)
+  glass status                   Check the deployment end to end
+  glass key [--read]             Print the dashboard URL and API key
+
+${color.bold("Ask questions")}
+  glass query web [--from -7d]
+  glass query trends --event signup_completed [--math unique_persons] [--interval week] [--breakdown browser]
+  glass query funnel --steps '$pageview,signup_started,signup_completed' [--window 1d] [--breakdown utm_source]
+  glass query retention --cohort signup_completed [--return '$pageview'] [--period week]
+  glass query <kind> --spec '<json>'   Any spec; see GET /api/schema
+    common: --from, --to, --where prop=value[,\u2026], --project, --sql (print SQL)
+  glass sql "SELECT \u2026"           Read-only SQL against your events
+  glass events [name]            Tracked events, or one event's properties
+    --describe "<text>"            How/when the event fires (document custom events)
+  glass person <id> [--delete]   One person's properties and events (or erase them)
+  glass replays [--errors]       Recorded sessions
+  glass replays summary <id>     A session as a text transcript
+
+${color.bold("Flags and experiments")}
+  glass flags [list]
+  glass flags set <key> [--rollout 25] [--variants control:50,test:50] [--enable|--disable] [--rules '<json>']
+  glass flags delete <key>
+  glass experiments [list]
+  glass experiments create <key> --goal <event> [--flag <key>] [--hypothesis "\u2026"]
+  glass experiments start|stop <key>
+  glass experiments ship <key> <variant>
+  glass experiments results <key>
+
+${color.bold("Agents")}
+  glass mcp                      MCP server over stdio (what .mcp.json runs)
+
+Environment: GLASS_HOST, GLASS_API_KEY and GLASS_PROJECT override .glass/ settings.
+Docs: https://github.com/ISNIT0/glass-analytics`;
+var STRING_OPTIONS = [
+  "token",
+  "account",
+  "project",
+  "name",
+  "route",
+  "branch",
+  "secret",
+  "from",
+  "to",
+  "event",
+  "math",
+  "property",
+  "interval",
+  "breakdown",
+  "steps",
+  "window",
+  "cohort",
+  "return",
+  "period",
+  "periods",
+  "spec",
+  "where",
+  "limit",
+  "days",
+  "describe",
+  "person",
+  "rollout",
+  "variants",
+  "rules",
+  "description",
+  "goal",
+  "flag",
+  "value",
+  "hypothesis",
+  "variant"
+];
+var BOOLEAN_OPTIONS = ["json", "lake", "eu", "no-replay", "no-agent-files", "no-ci", "ci", "local", "allow-downgrade", "dry-run", "read", "sql", "errors", "enable", "disable", "delete"];
+async function main(argv) {
+  const { values, positionals } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    strict: false,
+    options: {
+      ...Object.fromEntries(STRING_OPTIONS.map((o) => [o, { type: "string" }])),
+      ...Object.fromEntries(BOOLEAN_OPTIONS.map((o) => [o, { type: "boolean" }])),
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" }
+    }
+  });
+  const flags2 = values;
+  const [command, sub, arg, ...rest] = positionals;
+  if (flags2.version) return line(GLASS_VERSION);
+  if (!command || command === "help" || flags2.help && !command) return line(HELP);
+  const skipUpgradeWarn = /* @__PURE__ */ new Set(["init", "upgrade", "deploy", "ci", "status", "doctor", "mcp", "key"]);
+  if (command && !skipUpgradeWarn.has(command)) {
+    await warnIfOutdated({ json: Boolean(flags2.json) });
+  }
+  switch (command) {
+    case "init":
+      return init({
+        token: str3(flags2.token),
+        account: str3(flags2.account),
+        project: str3(flags2.project),
+        name: str3(flags2.name),
+        route: str3(flags2.route),
+        lake: flags2.lake === true ? true : void 0,
+        eu: flags2.eu === true ? true : void 0,
+        replay: flags2["no-replay"] ? false : void 0,
+        agentFiles: flags2["no-agent-files"] ? false : void 0,
+        ci: flags2["no-ci"] ? false : void 0,
+        dryRun: Boolean(flags2["dry-run"]),
+        json: Boolean(flags2.json)
+      });
+    case "upgrade":
+    case "deploy":
+      return upgrade({
+        token: str3(flags2.token),
+        json: Boolean(flags2.json),
+        ci: flags2.ci === true ? true : void 0,
+        local: Boolean(flags2.local),
+        allowDowngrade: Boolean(flags2["allow-downgrade"])
+      });
+    case "ci":
+      return ci({ branch: str3(flags2.branch), secret: str3(flags2.secret), json: Boolean(flags2.json) });
+    case "status":
+    case "doctor":
+      return status({ json: Boolean(flags2.json) });
+    case "key":
+      return key({ read: Boolean(flags2.read), json: Boolean(flags2.json) });
+    case "query":
+      return query(sub, flags2);
+    case "sql":
+      return sql(sub, flags2);
+    case "events":
+      return events(sub, flags2);
+    case "person":
+    case "persons":
+      return person(sub, flags2);
+    case "replays":
+      return replays(sub, arg, flags2);
+    case "projects":
+      return projects(sub, arg, flags2);
+    case "flags":
+      return flags(sub, arg, flags2);
+    case "experiments":
+      return experiments(sub, arg, rest, flags2);
+    case "mcp":
+      return mcpBridge();
+    default:
+      throw new UsageError(`Unknown command "${command}".`, "Run `glass help` for the list of commands.");
+  }
+}
+function str3(v) {
+  return typeof v === "string" ? v : void 0;
+}
+var invoked = process.argv[1] ?? "";
+if (/glass(\.js)?$|cli[\\/]src[\\/]index\.ts$/.test(invoked)) {
+  main(process.argv.slice(2)).catch((err) => {
+    if (err instanceof UsageError) {
+      fail(err.message);
+      if (err.hint) process.stderr.write(`  ${err.hint}
+`);
+    } else {
+      fail(err instanceof Error ? err.message : String(err));
+      if (process.env.GLASS_DEBUG && err instanceof Error) process.stderr.write(`${err.stack}
+`);
+    }
+    process.exitCode = 1;
+  });
+}
+export {
+  main
+};