@posthog/wizard 2.16.0 → 2.17.0

package/dist/{setup-utils-DdAdxUTV.js → setup-utils-Bpfsap9L.js}

@@ -1,8 +1,11 @@
-import { A as OAUTH_TIMEOUT_MS, B as WIZARD_OAUTH_SCOPES, D as ISSUES_URL, E as DUMMY_PROJECT_API_KEY, I as POSTHOG_PROXY_CLIENT_ID, P as POSTHOG_OAUTH_URL, W as WIZARD_USER_AGENT, k as OAUTH_PORTS, p as getUI, s as logToFile, w as DEFAULT_HOST_URL } from "./debug-C4jRuzny.js";
-import { n as analytics } from "./analytics-DZaUgJte.js";
-import { t as withProgress } from "./telemetry-jn2Daxl2.js";
-import { t as provisionNewAccount } from "./provisioning-C_ETLiZE.js";
-import { r as wizardAbort } from "./wizard-abort-BjLIgu2s.js";
+import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";
+import { A as OAUTH_TIMEOUT_MS, B as WIZARD_OAUTH_SCOPES, D as ISSUES_URL, E as DUMMY_PROJECT_API_KEY, I as POSTHOG_PROXY_CLIENT_ID, P as POSTHOG_OAUTH_URL, W as WIZARD_USER_AGENT, k as OAUTH_PORTS, p as getUI, s as logToFile, w as DEFAULT_HOST_URL } from "./debug-Bx7nvCWW.js";
+import { t as analytics } from "./analytics-DN_Gy87F.js";
+import { t as withProgress } from "./telemetry-ByYtIfW0.js";
+import { n as getCloudUrlFromRegion, r as getHostFromRegion, t as detectRegionFromToken } from "./urls-CTCJIxbR.js";
+import { t as provisionNewAccount } from "./provisioning-C96Kw-9D.js";
+import { i as fetchUserData, r as fetchProjectData } from "./api-serd0SMY.js";
+import { r as wizardAbort } from "./wizard-abort-CY0ibdq1.js";
 import { major, minVersion } from "semver";
 import * as childProcess from "node:child_process";
 import { execSync } from "node:child_process";
@@ -63,7 +66,6 @@ const packageManagers = [
 		buildCommand: "bun run build",
 		runScriptCommand: "bun run",
 		flags: "",
-		forceInstallFlag: "--force",
 		detect: ({ installDir }) => hasLockfile(installDir, "bun.lockb") || hasLockfile(installDir, "bun.lock"),
 		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
 	},
@@ -74,7 +76,6 @@ const packageManagers = [
 		buildCommand: "yarn build",
 		runScriptCommand: "yarn",
 		flags: "--ignore-workspace-root-check",
-		forceInstallFlag: "--force",
 		detect: ({ installDir }) => lockfileHeaderContains(installDir, "yarn.lock", "yarn lockfile v1"),
 		addOverride: (pkgName, pkgVersion, opts) => writeOverride("yarn", pkgName, pkgVersion, opts)
 	},
@@ -85,7 +86,6 @@ const packageManagers = [
 		buildCommand: "yarn build",
 		runScriptCommand: "yarn",
 		flags: "",
-		forceInstallFlag: "--force",
 		detect: ({ installDir }) => lockfileHeaderContains(installDir, "yarn.lock", "__metadata"),
 		addOverride: (pkgName, pkgVersion, opts) => writeOverride("yarn", pkgName, pkgVersion, opts)
 	},
@@ -96,7 +96,6 @@ const packageManagers = [
 		buildCommand: "pnpm build",
 		runScriptCommand: "pnpm",
 		flags: "--ignore-workspace-root-check",
-		forceInstallFlag: "--force",
 		detect: ({ installDir }) => hasLockfile(installDir, "pnpm-lock.yaml"),
 		addOverride: (pkgName, pkgVersion, opts) => writeOverride("pnpm", pkgName, pkgVersion, opts)
 	},
@@ -107,7 +106,6 @@ const packageManagers = [
 		buildCommand: "npm run build",
 		runScriptCommand: "npm run",
 		flags: "",
-		forceInstallFlag: "--force",
 		detect: ({ installDir }) => hasLockfile(installDir, "package-lock.json"),
 		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
 	},
@@ -118,7 +116,6 @@ const packageManagers = [
 		buildCommand: "npx expo build",
 		runScriptCommand: "npx expo run",
 		flags: "",
-		forceInstallFlag: "--force",
 		detect: () => false,
 		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
 	}
@@ -130,36 +127,65 @@ function detectAllPackageManagers({ installDir }) {
 		return matches;
 	});
 }
-//#endregion
-//#region src/utils/urls.ts
-const getUiHostFromHost = (host) => {
-	if (host.includes("us.i.posthog.com")) return "https://us.posthog.com";
-	if (host.includes("eu.i.posthog.com")) return "https://eu.posthog.com";
-	return host;
-};
-const getHostFromRegion = (region) => {
-	if (region === "eu") return "https://eu.i.posthog.com";
-	return "https://us.i.posthog.com";
-};
-const getCloudUrlFromRegion = (region) => {
-	if (region === "eu") return "https://eu.posthog.com";
-	return "https://us.posthog.com";
-};
-async function detectRegionFromToken(accessToken) {
-	const headers = {
-		Authorization: `Bearer ${accessToken}`,
-		"User-Agent": WIZARD_USER_AGENT
-	};
-	const [usResult, euResult] = await Promise.allSettled([axios.get("https://us.posthog.com/api/users/@me/", { headers }), axios.get("https://eu.posthog.com/api/users/@me/", { headers })]);
-	if (usResult.status === "fulfilled") return "us";
-	if (euResult.status === "fulfilled") return "eu";
-	throw new Error("Could not determine cloud region from access token. Please check your PostHog account.");
+/**
+* Per-program scope additions, layered on top of `WIZARD_OAUTH_SCOPES`.
+*
+* Programs not listed here request the unchanged base set. Use this
+* map only for programs that need *more* than the base — never for
+* narrowing, since narrowing risks breaking shared infrastructure
+* (e.g. dropping `llm_gateway:read` would 401 every agent call).
+*
+* Keyed by `ProgramId` so TypeScript catches stale entries when a
+* program is renamed or removed.
+*/
+const PROGRAM_SCOPE_ADDITIONS = { "mcp-tutorial": [
+	"dashboard:read",
+	"insight:read",
+	"notebook:read",
+	"feature_flag:read",
+	"experiment:read",
+	"experiment_saved_metric:read",
+	"survey:read",
+	"session_recording:read",
+	"error_tracking:read",
+	"web_analytics:read",
+	"llm_analytics:read",
+	"cohort:read",
+	"person:read",
+	"annotation:read",
+	"annotation:write",
+	"activity_log:read",
+	"property_definition:read",
+	"event_definition:read",
+	"action:read",
+	"warehouse_table:read",
+	"warehouse_view:read",
+	"alert:read",
+	"subscription:read"
+] };
+/**
+* Resolve the OAuth scope list to request for a given program. Returns
+* `WIZARD_OAUTH_SCOPES` for programs without an addition entry; for
+* programs that do have one, returns the union of base + additions
+* with duplicates dropped (declaration order preserved, base first).
+*
+* `null` / `undefined` programId falls through to the default — same
+* behavior as the historical hardcoded `WIZARD_OAUTH_SCOPES` reference
+* in `askForWizardLogin`, so call sites that haven't been updated to
+* pass a programId continue to work unchanged.
+*/
+function getOAuthScopesForProgram(programId) {
+	const additions = programId && PROGRAM_SCOPE_ADDITIONS[programId] || [];
+	if (additions.length === 0) return WIZARD_OAUTH_SCOPES;
+	const seen = /* @__PURE__ */ new Set();
+	const merged = [];
+	for (const s of [...WIZARD_OAUTH_SCOPES, ...additions]) {
+		if (seen.has(s)) continue;
+		seen.add(s);
+		merged.push(s);
+	}
+	return merged;
 }
-const getLlmGatewayUrlFromHost = (host) => {
-	if (host.includes("localhost")) return "http://localhost:3308/wizard";
-	if (host.includes("eu.posthog.com") || host.includes("eu.i.posthog.com")) return "https://gateway.eu.posthog.com/wizard";
-	return "https://gateway.us.posthog.com/wizard";
-};
 //#endregion
 //#region src/utils/oauth.ts
 const OAUTH_CALLBACK_STYLES = `
@@ -444,137 +470,6 @@ async function performOAuthFlow(config) {
 	throw new Error("OAuth port retry loop exited unexpectedly");
 }
 //#endregion
-//#region src/lib/api.ts
-/**
-* User payload from `/api/users/@me/`. Schema typed for the fields the
-* wizard actually reads + passthrough on everything else so the full
-* upstream response rides through to the session for downstream features
-* (account-aware copy, plan-gated flows, org/team metadata, etc.).
-*
-* Top-level uses `.passthrough()` so unknown fields aren't stripped;
-* the few nested objects we care about (team, organization,
-* organizations[]) do the same so their additional fields survive too.
-*
-* Keep `distinct_id` required — analytics depends on it. Everything
-* else added here is nullish so partial responses don't fail parsing.
-*/
-const ApiUserSchema = z.object({
-	distinct_id: z.string(),
-	uuid: z.string().nullish(),
-	id: z.number().nullish(),
-	email: z.string().nullish(),
-	first_name: z.string().nullish(),
-	last_name: z.string().nullish(),
-	date_joined: z.string().nullish(),
-	is_email_verified: z.boolean().nullish(),
-	is_2fa_enabled: z.boolean().nullish(),
-	is_staff: z.boolean().nullish(),
-	theme_mode: z.string().nullish(),
-	toolbar_mode: z.string().nullish(),
-	hide_mcp_hints: z.boolean().nullish(),
-	role_at_organization: z.string().nullish(),
-	team: z.object({
-		id: z.number(),
-		uuid: z.string().nullish(),
-		organization: z.string().uuid(),
-		api_token: z.string().nullish(),
-		project_id: z.number().nullish(),
-		name: z.string().nullish(),
-		timezone: z.string().nullish()
-	}).passthrough(),
-	organization: z.object({
-		id: z.string().uuid(),
-		name: z.string().nullish(),
-		slug: z.string().nullish(),
-		membership_level: z.number().nullish(),
-		customer_id: z.string().nullish()
-	}).passthrough(),
-	organizations: z.array(z.object({
-		id: z.string().uuid(),
-		name: z.string().nullish(),
-		membership_level: z.number().nullish()
-	}).passthrough())
-}).passthrough();
-/**
-* Single activity log entry the wizard cares about. The PostHog endpoint
-* returns much more — schema kept minimal so changes upstream don't break us.
-*
-* @unused — no current caller after the Phase 6 streaming-agent pivot
-* dropped activity_log polling. Deliberately retained: this is a thin,
-* well-typed wrapper around a stable PostHog endpoint, and we're likely
-* to want it again for a future feature (e.g. "what changed in your
-* project recently"). Re-deriving the schema is more work than letting
-* it sit dormant.
-*/
-const ActivityLogEntrySchema = z.object({
-	scope: z.string().nullish(),
-	activity: z.string().nullish(),
-	created_at: z.string().nullish()
-}).passthrough();
-z.object({ results: z.array(ActivityLogEntrySchema) });
-const ApiProjectSchema = z.object({
-	id: z.number(),
-	uuid: z.string().uuid(),
-	organization: z.string().uuid(),
-	api_token: z.string(),
-	name: z.string()
-});
-var ApiError = class extends Error {
-	constructor(message, statusCode, endpoint) {
-		super(message);
-		this.statusCode = statusCode;
-		this.endpoint = endpoint;
-		this.name = "ApiError";
-	}
-};
-async function fetchUserData(accessToken, baseUrl) {
-	try {
-		const response = await axios.get(`${baseUrl}/api/users/@me/`, { headers: {
-			Authorization: `Bearer ${accessToken}`,
-			"User-Agent": WIZARD_USER_AGENT
-		} });
-		return ApiUserSchema.parse(response.data);
-	} catch (error) {
-		const apiError = handleApiError(error, "fetch user data");
-		analytics.captureException(apiError, {
-			endpoint: "/api/users/@me/",
-			baseUrl
-		});
-		throw apiError;
-	}
-}
-async function fetchProjectData(accessToken, projectId, baseUrl) {
-	try {
-		const response = await axios.get(`${baseUrl}/api/projects/${projectId}/`, { headers: {
-			Authorization: `Bearer ${accessToken}`,
-			"User-Agent": WIZARD_USER_AGENT
-		} });
-		return ApiProjectSchema.parse(response.data);
-	} catch (error) {
-		const apiError = handleApiError(error, "fetch project data");
-		analytics.captureException(apiError, {
-			endpoint: `/api/projects/${projectId}/`,
-			baseUrl,
-			projectId
-		});
-		throw apiError;
-	}
-}
-function handleApiError(error, operation) {
-	if (axios.isAxiosError(error)) {
-		const axiosError = error;
-		const status = axiosError.response?.status;
-		const detail = axiosError.response?.data?.detail;
-		const endpoint = axiosError.config?.url;
-		if (status === 401) return new ApiError(`Authentication failed while trying to ${operation}`, status, endpoint);
-		if (status === 403) return new ApiError(`Access denied while trying to ${operation}`, status, endpoint);
-		if (status === 404) return new ApiError(`Resource not found while trying to ${operation}`, status, endpoint);
-		return new ApiError(detail || `Failed to ${operation}`, status, endpoint);
-	}
-	if (error instanceof z.ZodError) return new ApiError(`Invalid response format while trying to ${operation}`);
-	return new ApiError(`Unexpected error while trying to ${operation}: ${error instanceof Error ? error.message : "Unknown error"}`);
-}
-//#endregion
 //#region src/utils/semver.ts
 /**
 * Version strings from package.json that are not semver ranges.
@@ -617,6 +512,15 @@ function createVersionBucket(minMajorVersion) {
 }
 //#endregion
 //#region src/utils/setup-utils.ts
+var setup_utils_exports = /* @__PURE__ */ __exportAll({
+	abort: () => abort,
+	detectOrgAndProject: () => detectOrgAndProject,
+	getOrAskForProjectData: () => getOrAskForProjectData,
+	getPackageDotJson: () => getPackageDotJson,
+	isUsingTypeScript: () => isUsingTypeScript,
+	tryGetPackageJson: () => tryGetPackageJson,
+	updatePackageDotJson: () => updatePackageDotJson
+});
 /** @deprecated Use wizardAbort() directly for new code. */
 async function abort(message, status) {
 	return wizardAbort({
@@ -756,7 +660,8 @@ async function getOrAskForProjectData(_options) {
 	const { host, projectApiKey, accessToken, projectId, cloudRegion, roleAtOrganization, user } = await withProgress("login", () => askForWizardLogin({
 		signup: _options.signup,
 		email: _options.email,
-		region: _options.region
+		region: _options.region,
+		programId: _options.programId
 	}));
 	if (!projectApiKey) {
 		const cloudUrl = getCloudUrlFromRegion(cloudRegion);
@@ -795,7 +700,7 @@ async function fetchProjectDataById(apiKey, projectId, cloudUrl) {
 async function askForWizardLogin(options) {
 	if (options.signup) return askForProvisioningSignup(options.email, options.region);
 	const tokenResponse = await performOAuthFlow({
-		scopes: [...WIZARD_OAUTH_SCOPES],
+		scopes: [...getOAuthScopesForProgram(options.programId)],
 		signup: false
 	});
 	const projectId = tokenResponse.scoped_teams?.[0];
@@ -870,6 +775,6 @@ async function askForProvisioningSignup(email, region) {
 	}
 }
 //#endregion
-export { isUsingTypeScript as a, createVersionBucket as c, extractOAuthCode as d, getCloudUrlFromRegion as f, detectAllPackageManagers as h, getPackageDotJson as i, ApiError as l, getUiHostFromHost as m, detectOrgAndProject as n, tryGetPackageJson as o, getLlmGatewayUrlFromHost as p, getOrAskForProjectData as r, updatePackageDotJson as s, abort as t, handleApiError as u };
+export { createVersionBucket as a, tryGetPackageJson as i, isUsingTypeScript as n, extractOAuthCode as o, setup_utils_exports as r, detectAllPackageManagers as s, getOrAskForProjectData as t };
 
-//# sourceMappingURL=setup-utils-DdAdxUTV.js.map
+//# sourceMappingURL=setup-utils-Bpfsap9L.js.map

package/dist/setup-utils-Bpfsap9L.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-utils-Bpfsap9L.js","names":["fs","path","fs"],"sources":["../src/utils/package-manager.ts","../src/lib/oauth/program-scopes.ts","../src/utils/oauth.ts","../src/utils/semver.ts","../src/utils/setup-utils.ts"],"sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { withProgress } from '../telemetry';\nimport { getPackageDotJson, updatePackageDotJson } from './setup-utils';\nimport type { PackageJson } from './package-json';\nimport { analytics } from './analytics';\nimport type { WizardRunOptions } from './types';\n\ntype InstallDirOpt = Pick<WizardRunOptions, 'installDir'>;\n\nexport interface PackageManager {\n  name: string;\n  label: string;\n  installCommand: string;\n  buildCommand: string;\n  /** Command the manager uses to execute a `package.json` script. */\n  runScriptCommand: string;\n  flags: string;\n  detect: (opts: InstallDirOpt) => boolean;\n  addOverride: (\n    pkgName: string,\n    pkgVersion: string,\n    opts: InstallDirOpt,\n  ) => Promise<void>;\n}\n\nfunction hasLockfile(installDir: string, file: string): boolean {\n  return fs.existsSync(path.join(installDir, file));\n}\n\nfunction lockfileHeaderContains(\n  installDir: string,\n  file: string,\n  needle: string,\n): boolean {\n  try {\n    const head = fs\n      .readFileSync(path.join(installDir, file), 'utf-8')\n      .slice(0, 500);\n    return head.includes(needle);\n  } catch {\n    return false;\n  }\n}\n\ntype OverrideSlot = 'npm' | 'yarn' | 'pnpm';\n\nasync function writeOverride(\n  slot: OverrideSlot,\n  pkgName: string,\n  pkgVersion: string,\n  { installDir }: InstallDirOpt,\n): Promise<void> {\n  const pkg = await getPackageDotJson({ installDir });\n  let next: PackageJson;\n  if (slot === 'yarn') {\n    next = {\n      ...pkg,\n      resolutions: { ...(pkg.resolutions ?? {}), [pkgName]: pkgVersion },\n    };\n  } else if (slot === 'pnpm') {\n    next = {\n      ...pkg,\n      pnpm: {\n        ...(pkg.pnpm ?? {}),\n        overrides: { ...(pkg.pnpm?.overrides ?? {}), [pkgName]: pkgVersion },\n      },\n    };\n  } else {\n    next = {\n      ...pkg,\n      overrides: { ...(pkg.overrides ?? {}), [pkgName]: pkgVersion },\n    };\n  }\n  await updatePackageDotJson(next, { installDir });\n}\n\nexport const BUN: PackageManager = {\n  name: 'bun',\n  label: 'Bun',\n  installCommand: 'bun add',\n  buildCommand: 'bun run build',\n  runScriptCommand: 'bun run',\n  flags: '',\n  detect: ({ installDir }) =>\n    hasLockfile(installDir, 'bun.lockb') || hasLockfile(installDir, 'bun.lock'),\n  addOverride: (pkgName, pkgVersion, opts) =>\n    writeOverride('npm', pkgName, pkgVersion, opts),\n};\n\nexport const YARN_V1: PackageManager = {\n  name: 'yarn',\n  label: 'Yarn V1',\n  installCommand: 'yarn add',\n  buildCommand: 'yarn build',\n  runScriptCommand: 'yarn',\n  flags: '--ignore-workspace-root-check',\n  detect: ({ installDir }) =>\n    lockfileHeaderContains(installDir, 'yarn.lock', 'yarn lockfile v1'),\n  addOverride: (pkgName, pkgVersion, opts) =>\n    writeOverride('yarn', pkgName, pkgVersion, opts),\n};\n\n/** YARN V2/3/4 */\nexport const YARN_V2: PackageManager = {\n  name: 'yarn',\n  label: 'Yarn V2/3/4',\n  installCommand: 'yarn add',\n  buildCommand: 'yarn build',\n  runScriptCommand: 'yarn',\n  flags: '',\n  detect: ({ installDir }) =>\n    lockfileHeaderContains(installDir, 'yarn.lock', '__metadata'),\n  addOverride: (pkgName, pkgVersion, opts) =>\n    writeOverride('yarn', pkgName, pkgVersion, opts),\n};\n\nexport const PNPM: PackageManager = {\n  name: 'pnpm',\n  label: 'pnpm',\n  installCommand: 'pnpm add',\n  buildCommand: 'pnpm build',\n  runScriptCommand: 'pnpm',\n  flags: '--ignore-workspace-root-check',\n  detect: ({ installDir }) => hasLockfile(installDir, 'pnpm-lock.yaml'),\n  addOverride: (pkgName, pkgVersion, opts) =>\n    writeOverride('pnpm', pkgName, pkgVersion, opts),\n};\n\nexport const NPM: PackageManager = {\n  name: 'npm',\n  label: 'npm',\n  installCommand: 'npm add',\n  buildCommand: 'npm run build',\n  runScriptCommand: 'npm run',\n  flags: '',\n  detect: ({ installDir }) => hasLockfile(installDir, 'package-lock.json'),\n  addOverride: (pkgName, pkgVersion, opts) =>\n    writeOverride('npm', pkgName, pkgVersion, opts),\n};\n\n// Expo is selected by upstream config (app.json / app.config.*) rather than\n// a lockfile, so its detect always returns false here.\nexport const EXPO: PackageManager = {\n  name: 'expo',\n  label: 'Expo',\n  installCommand: 'npx expo install',\n  buildCommand: 'npx expo build',\n  runScriptCommand: 'npx expo run',\n  flags: '',\n  detect: () => false,\n  addOverride: (pkgName, pkgVersion, opts) =>\n    writeOverride('npm', pkgName, pkgVersion, opts),\n};\n\nexport const packageManagers: PackageManager[] = [\n  BUN,\n  YARN_V1,\n  YARN_V2,\n  PNPM,\n  NPM,\n  EXPO,\n];\n\nexport function detectAllPackageManagers({\n  installDir,\n}: InstallDirOpt): PackageManager[] {\n  return withProgress('detect-package-manager', () => {\n    const matches = packageManagers.filter((pm) => pm.detect({ installDir }));\n    if (matches.length === 0) {\n      analytics.setTag('package-manager', 'not-detected');\n    }\n    return matches;\n  });\n}\n","/**\n * OAuth scope resolver — every program starts from the shared\n * `WIZARD_OAUTH_SCOPES` base set and a program can layer additional\n * scopes on top via `PROGRAM_SCOPE_ADDITIONS`.\n *\n *   final scope set = WIZARD_OAUTH_SCOPES ∪ programAdditions\n *\n * Additions are merged in declaration order and deduped, so a program\n * never accidentally weakens the base set — only widens it. Programs\n * not listed in `PROGRAM_SCOPE_ADDITIONS` request the unchanged\n * base set, exactly like before.\n *\n * Today only `McpTutorial` adds anything: read-only on every product\n * surface (feature flags, experiments, surveys, replays, errors, web\n * analytics, LLM analytics, cohorts, persons) plus read/write on\n * annotations. Persistence writes (dashboard:write, insight:write,\n * notebook:write, query:read) come for free from the base set, so the\n * tutorial's \"save as insight / pin to dashboard / add to notebook\"\n * follow-ups keep working.\n *\n * Add a new program override by extending `PROGRAM_SCOPE_ADDITIONS`\n * below — no other call-site changes required as long as the program's\n * `programId` is threaded into `getOrAskForProjectData`.\n */\n\n// IMPORTANT: type-only import. A value import would create a circular\n// dependency (setup-utils → program-scopes → program-registry →\n// posthog-integration → ... → setup-utils), and `Program` would be\n// read as `undefined` at module init. Keep this type-only and reference\n// program IDs by their string-literal value below — TypeScript still\n// catches renames via the `Partial<Record<ProgramId, ...>>` keying.\nimport type { ProgramId } from '@lib/programs/program-registry';\nimport { WIZARD_OAUTH_SCOPES } from '@lib/constants';\n\n/**\n * Extra scopes the MCP tutorial needs on top of `WIZARD_OAUTH_SCOPES`.\n *\n * Mirrors the wizard partner's full OAuth ceiling on the PostHog side\n * (see the comma-delimited list in the wizard OAuth app's\n * `OAuthApplication.scopes`). The tutorial's prompts and follow-ups\n * touch most of the read surface, plus annotation write for the\n * \"PostHog wizard install\" verify-prompt.\n *\n * Already in the base `WIZARD_OAUTH_SCOPES` (and therefore not\n * repeated here):\n *   • user:read, project:read, llm_gateway:read   — auth + gateway\n *   • query:read                                  — HogQL\n *   • dashboard:write, insight:write, notebook:write  — Phase-5 persist\n *\n * Deliberately omitted (writes on read-only product surfaces):\n *   • feature_flag:write, experiment:write, survey:write,\n *     cohort:write, session_recording:write, error_tracking:write,\n *     alert:write, subscription:write\n */\nexport const MCP_TUTORIAL_SCOPE_ADDITIONS = [\n  // Explicit reads on the persistence surfaces. `*:write` usually\n  // implies read on PostHog, but the consent flow grants exactly the\n  // strings requested — explicit reads avoid a 403 when the agent\n  // lists existing dashboards/insights/notebooks before saving.\n  'dashboard:read',\n  'insight:read',\n  'notebook:read',\n\n  // Read on every product surface the tutorial demos.\n  'feature_flag:read',\n  'experiment:read',\n  'experiment_saved_metric:read',\n  'survey:read',\n  'session_recording:read',\n  'error_tracking:read',\n  'web_analytics:read',\n  'llm_analytics:read',\n  'cohort:read',\n  'person:read',\n\n  // Annotation read + write — the verify prompt's \"annotate today\"\n  // is the only mutation the tutorial performs outside the\n  // dashboard/insight/notebook persistence triplet.\n  'annotation:read',\n  'annotation:write',\n\n  // Metadata / exploration reads — for \"break down by user property\",\n  // \"did that change land alongside a deploy\", autocapture actions,\n  // etc. Otherwise the agent 403s on the supporting catalog calls\n  // even though the parent query has `query:read`.\n  'activity_log:read',\n  'property_definition:read',\n  'event_definition:read',\n  'action:read',\n\n  // Data warehouse reads — for the data-role cross-sells that join\n  // event data with Stripe / Salesforce / S3.\n  'warehouse_table:read',\n  'warehouse_view:read',\n\n  // Inspection-only — we don't write alerts or subscriptions, but the\n  // model might want to read existing ones (e.g. \"is there already an\n  // alert on this metric?\").\n  'alert:read',\n  'subscription:read',\n] as const;\n\n/**\n * Per-program scope additions, layered on top of `WIZARD_OAUTH_SCOPES`.\n *\n * Programs not listed here request the unchanged base set. Use this\n * map only for programs that need *more* than the base — never for\n * narrowing, since narrowing risks breaking shared infrastructure\n * (e.g. dropping `llm_gateway:read` would 401 every agent call).\n *\n * Keyed by `ProgramId` so TypeScript catches stale entries when a\n * program is renamed or removed.\n */\nconst PROGRAM_SCOPE_ADDITIONS: Partial<Record<ProgramId, readonly string[]>> = {\n  // String literal (not `Program.McpTutorial`) to avoid a runtime cycle\n  // with `program-registry.ts`. The `Partial<Record<ProgramId, ...>>`\n  // key constraint catches renames at compile time — if `mcpTutorialConfig.id`\n  // ever changes, this line will fail to type-check.\n  'mcp-tutorial': MCP_TUTORIAL_SCOPE_ADDITIONS,\n};\n\n/**\n * Resolve the OAuth scope list to request for a given program. Returns\n * `WIZARD_OAUTH_SCOPES` for programs without an addition entry; for\n * programs that do have one, returns the union of base + additions\n * with duplicates dropped (declaration order preserved, base first).\n *\n * `null` / `undefined` programId falls through to the default — same\n * behavior as the historical hardcoded `WIZARD_OAUTH_SCOPES` reference\n * in `askForWizardLogin`, so call sites that haven't been updated to\n * pass a programId continue to work unchanged.\n */\nexport function getOAuthScopesForProgram(\n  programId: ProgramId | null | undefined,\n): readonly string[] {\n  const additions = (programId && PROGRAM_SCOPE_ADDITIONS[programId]) || [];\n  if (additions.length === 0) {\n    return WIZARD_OAUTH_SCOPES;\n  }\n  // Dedupe while preserving order; base scopes appear first so the\n  // consent screen shows them in their familiar slot.\n  const seen = new Set<string>();\n  const merged: string[] = [];\n  for (const s of [...WIZARD_OAUTH_SCOPES, ...additions]) {\n    if (seen.has(s)) continue;\n    seen.add(s);\n    merged.push(s);\n  }\n  return merged;\n}\n","import * as crypto from 'node:crypto';\nimport * as http from 'node:http';\nimport { execSync } from 'node:child_process';\nimport axios from 'axios';\nimport { logToFile } from './debug';\nimport opn from 'opn';\nimport { z } from 'zod';\nimport { getUI } from '@ui';\nimport {\n  IS_DEV,\n  ISSUES_URL,\n  OAUTH_PORTS,\n  OAUTH_TIMEOUT_MS,\n  POSTHOG_DEV_CLIENT_ID,\n  POSTHOG_OAUTH_URL,\n  POSTHOG_PROXY_CLIENT_ID,\n  WIZARD_USER_AGENT,\n} from '@lib/constants';\nimport { NODE_ENV } from '@env';\nimport { abort } from './setup-utils';\nimport { analytics } from './analytics';\n\nconst OAUTH_CALLBACK_STYLES = `\n  <style>\n    * {\n      font-family: monospace;\n      background-color: #1b0a00;\n      color: #F7A502;\n      font-weight: medium;\n      font-size: 24px;\n      margin: .25rem;\n    }\n\n    .blink {\n      animation: blink-animation 1s steps(2, start) infinite;\n    }\n\n    @keyframes blink-animation {\n      to {\n        opacity: 0;\n      }\n    }\n  </style>\n`;\n\nconst OAuthTokenResponseSchema = z.object({\n  access_token: z.string(),\n  expires_in: z.number(),\n  token_type: z.string(),\n  scope: z.string(),\n  refresh_token: z.string().optional(),\n  scoped_teams: z.array(z.number()).optional(),\n  scoped_organizations: z.array(z.string()).optional(),\n});\n\nexport type OAuthTokenResponse = z.infer<typeof OAuthTokenResponseSchema>;\n\ninterface OAuthConfig {\n  scopes: string[];\n  signup?: boolean;\n}\n\nfunction getLocalOAuthOrigin(port: number): string {\n  return `http://localhost:${port}`;\n}\n\nfunction getCallbackUrl(port: number): string {\n  return `${getLocalOAuthOrigin(port)}/callback`;\n}\n\nfunction getLocalLoginUrl(port: number): string {\n  return `${getLocalOAuthOrigin(port)}/authorize`;\n}\n\nfunction getLocalSignupUrl(port: number): string {\n  return `${getLocalLoginUrl(port)}?signup=true`;\n}\n\n/**\n * Extract an OAuth authorization code from raw user input. Accepts either the\n * bare code, the full callback URL the browser was redirected to\n * (`http://localhost:8239/callback?code=abc123&...`), or just the query\n * string. Returns null when no code can be found.\n *\n * This backs the manual-entry fallback: in headless/remote environments the\n * browser can't reach the wizard's local callback server, so the user copies\n * the failed callback URL (or the code from it) back into the terminal.\n */\nexport function extractOAuthCode(input: string): string | null {\n  const trimmed = input.trim();\n  if (!trimmed) return null;\n\n  // Full URL — pull the `code` query param.\n  let looksLikeUrl = false;\n  try {\n    const url = new URL(trimmed);\n    looksLikeUrl = true;\n    const code = url.searchParams.get('code');\n    if (code) return code;\n  } catch {\n    // Not a parseable URL — fall through to the looser checks below.\n  }\n\n  // A pasted query string or `code=...` fragment.\n  const match = trimmed.match(/[?&]?code=([^&\\s]+)/);\n  if (match) return decodeURIComponent(match[1]);\n\n  // A URL with no code is invalid — don't mistake the whole URL for a code.\n  if (looksLikeUrl) return null;\n\n  // Otherwise treat the whole input as the bare code (no embedded whitespace).\n  if (!/\\s/.test(trimmed)) return trimmed;\n\n  return null;\n}\n\nfunction generateCodeVerifier(): string {\n  return crypto.randomBytes(32).toString('base64url');\n}\n\nfunction generateCodeChallenge(verifier: string): string {\n  return crypto.createHash('sha256').update(verifier).digest('base64url');\n}\n\nasync function startCallbackServer(\n  authUrl: string,\n  signupUrl: string,\n  port: number,\n): Promise<{\n  port: number;\n  server: http.Server;\n  waitForCallback: () => Promise<string>;\n}> {\n  return new Promise((resolve, reject) => {\n    let callbackResolve: (code: string) => void;\n    let callbackReject: (error: Error) => void;\n\n    const waitForCallback = () =>\n      new Promise<string>((res, rej) => {\n        callbackResolve = res;\n        callbackReject = rej;\n      });\n\n    const server = http.createServer((req, res) => {\n      if (!req.url) {\n        res.writeHead(400);\n        res.end();\n        return;\n      }\n      const url = new URL(req.url, getLocalOAuthOrigin(port));\n\n      if (url.pathname === '/authorize') {\n        const isSignup = url.searchParams.get('signup') === 'true';\n        const redirectUrl = isSignup ? signupUrl : authUrl;\n        res.writeHead(302, { Location: redirectUrl });\n        res.end();\n        return;\n      }\n\n      const code = url.searchParams.get('code');\n      const error = url.searchParams.get('error');\n\n      if (error) {\n        const isAccessDenied = error === 'access_denied';\n        res.writeHead(isAccessDenied ? 200 : 400, {\n          'Content-Type': 'text/html; charset=utf-8',\n        });\n        res.end(`\n          <html>\n            <head>\n              <meta charset=\"UTF-8\">\n              <title>PostHog wizard - Authorization ${\n                isAccessDenied ? 'cancelled' : 'failed'\n              }</title>\n              ${OAUTH_CALLBACK_STYLES}\n            </head>\n            <body>\n              <p>${\n                isAccessDenied\n                  ? 'Authorization cancelled.'\n                  : `Authorization failed.`\n              }</p>\n              <p>Return to your terminal. This window will close automatically.</p>\n              <script>window.close();</script>\n            </body>\n          </html>\n        `);\n        callbackReject(new Error(`OAuth error: ${error}`));\n        return;\n      }\n\n      if (code) {\n        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });\n        res.end(`\n          <html>\n            <head>\n              <meta charset=\"UTF-8\">\n              <title>PostHog wizard is ready</title>\n              ${OAUTH_CALLBACK_STYLES}\n            </head>\n            <body>\n              <p>PostHog login complete!</p>\n              <p>Return to your terminal: the wizard is hard at work on your project<span class=\"blink\">█</span></p>\n              <script>window.close();</script>\n            </body>\n          </html>\n        `);\n        callbackResolve(code);\n      } else {\n        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });\n        res.end(`\n          <html>\n            <head>\n              <meta charset=\"UTF-8\">\n              <title>PostHog wizard - Invalid request</title>\n              ${OAUTH_CALLBACK_STYLES}\n            </head>\n            <body>\n              <p>Invalid request - no authorization code received.</p>\n              <p>You can close this window.</p>\n            </body>\n          </html>\n        `);\n      }\n    });\n\n    server.listen(port, () => {\n      resolve({ port, server, waitForCallback });\n    });\n\n    server.on('error', reject);\n  });\n}\n\nfunction getPortProcessInfo(port: number): {\n  command: string;\n  pid: string;\n  port: number;\n  user: string;\n} {\n  try {\n    const output = execSync(`lsof -i :${port} -sTCP:LISTEN 2>/dev/null`, {\n      encoding: 'utf-8',\n      timeout: 3000,\n    }).trim();\n    const lines = output.split('\\n');\n    // First line is header, second is the process\n    if (lines.length < 2)\n      return { command: 'unknown', pid: 'unknown', port, user: 'unknown' };\n    const fields = lines[1].split(/\\s+/);\n    // lsof columns: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME\n    const command = fields[0] ?? 'unknown';\n    const pid = fields[1] ?? 'unknown';\n    const user = fields[2] ?? 'unknown';\n    return { command, pid, port, user };\n  } catch {\n    return { command: 'unknown', pid: 'unknown', port, user: 'unknown' };\n  }\n}\n\nfunction isPortInUseError(error: unknown): boolean {\n  return (\n    error instanceof Error &&\n    'code' in error &&\n    (error as NodeJS.ErrnoException).code === 'EADDRINUSE'\n  );\n}\n\nasync function exchangeCodeForToken(\n  code: string,\n  codeVerifier: string,\n  callbackUrl: string,\n): Promise<OAuthTokenResponse> {\n  const clientId = IS_DEV ? POSTHOG_DEV_CLIENT_ID : POSTHOG_PROXY_CLIENT_ID;\n\n  const response = await axios.post(\n    `${POSTHOG_OAUTH_URL}/oauth/token`,\n    {\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: callbackUrl,\n      client_id: clientId,\n      code_verifier: codeVerifier,\n    },\n    {\n      headers: {\n        'Content-Type': 'application/json',\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    },\n  );\n\n  return OAuthTokenResponseSchema.parse(response.data);\n}\n\nexport async function performOAuthFlow(\n  config: OAuthConfig,\n): Promise<OAuthTokenResponse> {\n  const clientId = IS_DEV ? POSTHOG_DEV_CLIENT_ID : POSTHOG_PROXY_CLIENT_ID;\n  const codeVerifier = generateCodeVerifier();\n  const codeChallenge = generateCodeChallenge(codeVerifier);\n  let shouldRetry = false;\n\n  do {\n    shouldRetry = false;\n    let lastProcessInfo: {\n      command: string;\n      pid: string;\n      port: number;\n      user: string;\n    } | null = null;\n\n    for (const port of OAUTH_PORTS) {\n      const callbackUrl = getCallbackUrl(port);\n      const authUrl = new URL(`${POSTHOG_OAUTH_URL}/oauth/authorize`);\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('redirect_uri', callbackUrl);\n      authUrl.searchParams.set('response_type', 'code');\n      authUrl.searchParams.set('code_challenge', codeChallenge);\n      authUrl.searchParams.set('code_challenge_method', 'S256');\n      authUrl.searchParams.set('scope', config.scopes.join(' '));\n      authUrl.searchParams.set('required_access_level', 'project');\n\n      const signupUrl = new URL(\n        `${POSTHOG_OAUTH_URL}/signup?next=${encodeURIComponent(\n          authUrl.toString(),\n        )}`,\n      );\n      const localSignupUrl = getLocalSignupUrl(port);\n      const localLoginUrl = getLocalLoginUrl(port);\n      const urlToOpen = config.signup ? localSignupUrl : localLoginUrl;\n\n      logToFile(`[oauth] attempting callback server on port ${port}`);\n\n      let server: http.Server;\n      let waitForCallback: () => Promise<string>;\n      try {\n        ({ server, waitForCallback } = await startCallbackServer(\n          authUrl.toString(),\n          signupUrl.toString(),\n          port,\n        ));\n      } catch (e) {\n        if (!isPortInUseError(e)) throw e;\n        lastProcessInfo = getPortProcessInfo(port);\n        continue;\n      }\n\n      logToFile('[oauth] callback server ready, showing login URL');\n\n      getUI().setLoginUrl(urlToOpen);\n      // The localhost proxy above only works on this machine. Surface the\n      // direct PostHog authorize URL too, for the manual-paste modal — on a\n      // remote/headless box the user opens it from another machine, where\n      // localhost:<port> is unreachable.\n      getUI().setAuthorizeUrl(\n        config.signup ? signupUrl.toString() : authUrl.toString(),\n      );\n\n      if (NODE_ENV !== 'test') {\n        opn(urlToOpen, { wait: false }).catch(() => {\n          // opn throws in environments without a browser\n        });\n      }\n\n      const loginSpinner = getUI().spinner();\n      loginSpinner.start('Waiting for authorization...');\n\n      try {\n        // Race the local callback server against a manually-pasted code. The\n        // manual path is the fallback for headless/remote shells where the\n        // browser can't reach localhost — the user opens the auth screen's\n        // paste modal and submits the callback URL or code by hand.\n        const code = await Promise.race([\n          waitForCallback(),\n          getUI().waitForManualAuthCode(),\n          new Promise<never>((_, reject) =>\n            setTimeout(\n              () => reject(new Error('Authorization timed out')),\n              OAUTH_TIMEOUT_MS,\n            ),\n          ),\n        ]);\n\n        const token = await exchangeCodeForToken(\n          code,\n          codeVerifier,\n          callbackUrl,\n        );\n\n        server.close();\n        getUI().setLoginUrl(null);\n        getUI().setAuthorizeUrl(null);\n        loginSpinner.stop('Authorization complete!');\n\n        return token;\n      } catch (e) {\n        loginSpinner.stop('Authorization failed.');\n        server.close();\n\n        const error = e instanceof Error ? e : new Error('Unknown error');\n\n        if (error.message.includes('timeout')) {\n          getUI().log.error('Authorization timed out. Please try again.');\n        } else if (error.message.includes('access_denied')) {\n          getUI().log.info(\n            `Authorization was cancelled.\\n\\nYou denied access to PostHog. To use the wizard, you need to authorize access to your PostHog account.\\n\\nYou can try again by re-running the wizard.`,\n          );\n        } else {\n          getUI().log.error(\n            `Authorization failed:\\n\\n${error.message}\\n\\nIf you think this is a bug in the PostHog wizard, please create an issue:\\n${ISSUES_URL}`,\n          );\n        }\n\n        const oauthErrorCode = error.message.startsWith('OAuth error: ')\n          ? error.message.slice('OAuth error: '.length)\n          : error.message.includes('timeout')\n          ? 'timeout'\n          : 'unknown';\n\n        analytics.captureException(error, {\n          step: 'oauth_flow',\n          oauth_error_code: oauthErrorCode,\n          client_id: clientId,\n          requested_scopes: config.scopes.join(' '),\n          // Collapse OAuth callback failures of the same kind into one issue\n          // instead of fragmenting by each user's install path in the stack trace.\n          $exception_fingerprint: `wizard_oauth_${oauthErrorCode}`,\n        });\n\n        await abort();\n        throw error;\n      }\n    }\n\n    if (!lastProcessInfo) {\n      throw new Error('No OAuth callback ports configured');\n    }\n\n    await getUI().showPortConflict(lastProcessInfo);\n    shouldRetry = true;\n  } while (shouldRetry);\n\n  throw new Error('OAuth port retry loop exited unexpectedly');\n}\n","import {\n  major,\n  minVersion,\n  satisfies,\n  subset,\n  valid,\n  validRange,\n} from 'semver';\n\n/**\n * Version strings from package.json that are not semver ranges.\n * URLs, git refs, dist-tags, local paths, workspace protocol, npm aliases, etc.\n * These should be rejected early — we can't determine a clear version from them.\n */\nfunction isNonSemverVersion(version: string): boolean {\n  const v = version.trim();\n  return (\n    v === '' ||\n    v.startsWith('http://') ||\n    v.startsWith('https://') ||\n    v.startsWith('git+') ||\n    v.startsWith('git://') ||\n    v.startsWith('file:') ||\n    v.startsWith('npm:') ||\n    v.startsWith('workspace:') ||\n    v.startsWith('/') ||\n    v.includes('/') // user/repo shorthand\n  );\n}\n\nexport function versionSatisfiesRange({\n  version,\n  acceptableVersions,\n  canBeLatest,\n}: {\n  version: string;\n  acceptableVersions: string;\n  canBeLatest: boolean;\n}): boolean {\n  if (version === 'latest') return canBeLatest;\n  if (isNonSemverVersion(version)) return false;\n\n  const concrete = valid(version);\n  if (concrete !== null) {\n    return satisfies(concrete, acceptableVersions);\n  }\n\n  const userRange = validRange(version);\n  if (userRange === null) return false;\n  return subset(userRange, acceptableVersions);\n}\n\n/**\n * Creates a version bucket function for analytics.\n * Converts versions like \"1.2.3\" to \"1.x\" for grouping in analytics.\n *\n * @param minMajorVersion - Optional minimum major version threshold.\n *   Versions below this will be bucketed as \"<{min}.0.0\"\n *\n * @example\n * const getVersionBucket = createVersionBucket(); // no minimum\n * getVersionBucket(\"1.2.3\") // \"1.x\"\n *\n * const getVersionBucket = createVersionBucket(11);\n * getVersionBucket(\"15.3.0\") // \"15.x\"\n * getVersionBucket(\"10.0.0\") // \"<11.0.0\"\n */\nexport function createVersionBucket(minMajorVersion?: number) {\n  return (version: string | undefined): string => {\n    if (!version) {\n      return 'none';\n    }\n\n    if (isNonSemverVersion(version)) {\n      return 'unknown';\n    }\n\n    try {\n      const minVer = minVersion(version);\n      if (!minVer) {\n        return 'invalid';\n      }\n      const majorVersion = major(minVer);\n      if (minMajorVersion !== undefined && majorVersion < minMajorVersion) {\n        return `<${minMajorVersion}.0.0`;\n      }\n      return `${majorVersion}.x`;\n    } catch {\n      return 'unknown';\n    }\n  };\n}\n","import * as childProcess from 'node:child_process';\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport { basename, isAbsolute, join, relative } from 'node:path';\nimport { promisify } from 'node:util';\n\nimport { withProgress } from '../telemetry';\nimport { debug } from './debug';\nimport type { PackageJson } from './package-json';\nimport {\n  type PackageManager,\n  detectAllPackageManagers,\n  NPM as npm,\n} from './package-manager';\nimport type { CloudRegion, WizardRunOptions } from './types';\nimport { getDeclaredVersion } from './package-json';\nimport {\n  DEFAULT_HOST_URL,\n  DUMMY_PROJECT_API_KEY,\n  ISSUES_URL,\n} from '@lib/constants';\nimport { getOAuthScopesForProgram } from '@lib/oauth/program-scopes';\nimport type { ProgramId } from '@lib/programs/program-registry';\nimport { analytics } from './analytics';\nimport { getUI } from '@ui';\nimport {\n  getCloudUrlFromRegion,\n  getHostFromRegion,\n  detectRegionFromToken,\n} from './urls';\nimport { performOAuthFlow } from './oauth';\nimport { provisionNewAccount } from './provisioning';\nimport { fetchUserData, fetchProjectData, type ApiUser } from '@lib/api';\nimport { versionSatisfiesRange } from './semver';\nimport { wizardAbort } from './wizard-abort';\n\ninterface ProjectData {\n  projectApiKey: string;\n  accessToken: string;\n  host: string;\n  distinctId: string;\n  projectId: number;\n  /**\n   * Optional `role_at_organization` from `/api/users/@me/`. Drives the\n   * role-tailored prompt suggestions on the McpSuggestedPromptsScreen. Null\n   * for signup flows (no role picked yet) and older accounts.\n   */\n  roleAtOrganization?: string | null;\n  /**\n   * Full user payload from `/api/users/@me/`. Carried through so\n   * `getOrAskForProjectData` can forward it to the session as\n   * `session.apiUser`. Null when the request failed or the CI key\n   * lacked permissions.\n   */\n  user?: ApiUser | null;\n}\n\nexport interface CliSetupConfig {\n  filename: string;\n  name: string;\n  gitignore: boolean;\n\n  likelyAlreadyHasAuthToken(contents: string): boolean;\n  tokenContent(authToken: string): string;\n\n  likelyAlreadyHasOrgAndProject(contents: string): boolean;\n  orgAndProjContent(org: string, project: string): string;\n\n  likelyAlreadyHasUrl?(contents: string): boolean;\n  urlContent?(url: string): string;\n}\n\nexport interface CliSetupConfigContent {\n  authToken: string;\n  org?: string;\n  project?: string;\n  url?: string;\n}\n\n/** @deprecated Use wizardAbort() directly for new code. */\nexport async function abort(message?: string, status?: number): Promise<never> {\n  return wizardAbort({ message, exitCode: status });\n}\n\nexport function isInGitRepo(): boolean {\n  try {\n    childProcess.execSync('git rev-parse --show-toplevel', {\n      stdio: 'ignore',\n    });\n  } catch {\n    return false;\n  }\n  return true;\n}\n\nconst FREEMAIL_DOMAINS = new Set([\n  'gmail.com',\n  'googlemail.com',\n  'hotmail.com',\n  'outlook.com',\n  'yahoo.com',\n  'icloud.com',\n  'me.com',\n  'mail.com',\n  'protonmail.com',\n  'proton.me',\n  'live.com',\n  'aol.com',\n  'yandex.com',\n  'zoho.com',\n  'gmx.com',\n  'fastmail.com',\n]);\n\nfunction parseGitRemote(): { org: string; repo: string } | null {\n  try {\n    const url = childProcess\n      .execSync('git remote get-url origin', {\n        stdio: ['ignore', 'pipe', 'ignore'],\n      })\n      .toString()\n      .trim();\n    // git@github.com:acme-corp/my-app.git or https://github.com/acme-corp/my-app.git\n    const match = url.match(/[/:]([\\w.-]+)\\/([\\w.-]+?)(?:\\.git)?$/);\n    if (match) return { org: match[1], repo: match[2] };\n  } catch {\n    // not in a git repo or no remote\n  }\n  return null;\n}\n\nexport function detectOrgAndProject(email: string): {\n  orgName: string | undefined;\n  projectName: string | undefined;\n} {\n  const remote = parseGitRemote();\n\n  // Project name: git repo name > directory name\n  const projectName = remote?.repo || basename(process.cwd()) || undefined;\n\n  // Org name: git remote org > email domain (skip freemail)\n  let orgName: string | undefined;\n  if (remote?.org) {\n    orgName = remote.org;\n  } else {\n    const domain = email.split('@')[1]?.toLowerCase();\n    if (domain && !FREEMAIL_DOMAINS.has(domain)) {\n      orgName = domain.split('.')[0];\n    }\n  }\n\n  return { orgName, projectName };\n}\n\nexport function getUncommittedOrUntrackedFiles(): string[] {\n  let gitStatus: string;\n  try {\n    gitStatus = childProcess\n      .execSync('git status --porcelain=v1', {\n        // we only care about stdout\n        stdio: ['ignore', 'pipe', 'ignore'],\n      })\n      .toString();\n  } catch {\n    return [];\n  }\n\n  const result: string[] = [];\n  for (const rawLine of gitStatus.split(os.EOL)) {\n    const line = rawLine.trim();\n    if (!line) continue;\n    const match = /^\\S+\\s+(\\S+)/.exec(line);\n    result.push(`- ${match?.[1]}`);\n  }\n  return result;\n}\n\nexport async function isReact19Installed({\n  installDir,\n}: Pick<WizardRunOptions, 'installDir'>): Promise<boolean> {\n  try {\n    const packageJson = await tryGetPackageJson({ installDir });\n    if (!packageJson) return false;\n    const reactVersion = getDeclaredVersion('react', packageJson);\n\n    if (!reactVersion) {\n      return false;\n    }\n\n    return versionSatisfiesRange({\n      version: reactVersion,\n      acceptableVersions: '>=19.0.0',\n      canBeLatest: true,\n    });\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Installs or updates a package with the user's package manager.\n *\n * IMPORTANT: This function modifies the `package.json`! Be sure to re-read\n * it if you make additional modifications to it after calling this function!\n */\nexport async function installPackage({\n  packageName,\n  alreadyInstalled,\n  packageNameDisplayLabel,\n  packageManager,\n  integration,\n  installDir,\n}: {\n  packageName: string;\n  alreadyInstalled: boolean;\n  packageNameDisplayLabel?: string;\n  packageManager?: PackageManager;\n  integration?: string;\n  installDir: string;\n}): Promise<{ packageManager?: PackageManager }> {\n  return withProgress('install-package', async () => {\n    const sdkInstallSpinner = getUI().spinner();\n\n    const pkgManager =\n      packageManager || (await getPackageManager({ installDir }));\n\n    const isReact19 = await isReact19Installed({ installDir });\n    const legacyPeerDepsFlag =\n      isReact19 && pkgManager.name === 'npm' ? '--legacy-peer-deps' : '';\n\n    sdkInstallSpinner.start(\n      `${alreadyInstalled ? 'Updating' : 'Installing'} ${\n        packageNameDisplayLabel ?? packageName\n      } with ${pkgManager.label}.`,\n    );\n\n    const execAsync = promisify(childProcess.exec);\n    const installCommand =\n      `${pkgManager.installCommand} ${packageName} ${pkgManager.flags} ${legacyPeerDepsFlag}`.trim();\n\n    try {\n      await execAsync(installCommand, { cwd: installDir });\n    } catch (e) {\n      const { stdout = '', stderr = '' } = (e ?? {}) as {\n        stdout?: string;\n        stderr?: string;\n      };\n      fs.writeFileSync(\n        join(\n          process.cwd(),\n          `posthog-wizard-installation-error-${Date.now()}.log`,\n        ),\n        JSON.stringify({ stdout, stderr }),\n        { encoding: 'utf8' },\n      );\n      sdkInstallSpinner.stop('Installation failed.');\n      getUI().log.error(\n        // eslint-disable-next-line @typescript-eslint/restrict-template-expressions\n        `Encountered the following error during installation:\\n\\n${e}\\n\\nThe wizard has created a \\`posthog-wizard-installation-error-*.log\\` file. If you think this issue is caused by the PostHog wizard, create an issue on GitHub and include the log file's content:\\n${ISSUES_URL}`,\n      );\n      await abort();\n    }\n\n    sdkInstallSpinner.stop(\n      `${alreadyInstalled ? 'Updated' : 'Installed'} ${\n        packageNameDisplayLabel ?? packageName\n      } with ${pkgManager.label}.`,\n    );\n\n    analytics.wizardCapture('package installed', {\n      package_name: packageName,\n      package_manager: pkgManager.name,\n      integration,\n    });\n\n    return { packageManager: pkgManager };\n  });\n}\n\n/**\n * Get package.json or abort the wizard if not found.\n * Only use where package.json is required (e.g., package install, overrides).\n * For detection/version-checks, use tryGetPackageJson() instead.\n */\nexport async function getPackageDotJson({\n  installDir,\n}: Pick<WizardRunOptions, 'installDir'>): Promise<PackageJson> {\n  const pkgPath = join(installDir, 'package.json');\n\n  let raw: string;\n  try {\n    raw = await fs.promises.readFile(pkgPath, 'utf8');\n  } catch {\n    getUI().log.error(\n      'Could not find package.json. Make sure to run the wizard in the root of your app!',\n    );\n    await abort();\n    return {};\n  }\n\n  try {\n    const parsed = JSON.parse(raw) as PackageJson | null;\n    return parsed ?? {};\n  } catch {\n    getUI().log.error(\n      `Unable to parse your package.json. Make sure it has a valid format!`,\n    );\n    await abort();\n    return {};\n  }\n}\n\n/**\n * Try to get package.json, returning null if it doesn't exist.\n * Use this for detection purposes where missing package.json is expected (e.g., Python projects).\n */\nexport async function tryGetPackageJson({\n  installDir,\n}: Pick<WizardRunOptions, 'installDir'>): Promise<PackageJson | null> {\n  try {\n    const packageJsonFileContents = await fs.promises.readFile(\n      join(installDir, 'package.json'),\n      'utf8',\n    );\n    return JSON.parse(packageJsonFileContents) as PackageJson;\n  } catch {\n    return null;\n  }\n}\n\nexport async function updatePackageDotJson(\n  packageDotJson: PackageJson,\n  { installDir }: Pick<WizardRunOptions, 'installDir'>,\n): Promise<void> {\n  const pkgPath = join(installDir, 'package.json');\n  const serialized = JSON.stringify(packageDotJson, null, 2);\n\n  try {\n    await fs.promises.writeFile(pkgPath, serialized, {\n      encoding: 'utf8',\n      flag: 'w',\n    });\n    return;\n  } catch {\n    getUI().log.error(`Unable to update your package.json.`);\n    await abort();\n  }\n}\n\n/**\n * Detect and return the package manager. Pure — no prompts.\n * Falls back to first detected or npm if ambiguous.\n */\n// eslint-disable-next-line @typescript-eslint/require-await\nexport async function getPackageManager(\n  options: Pick<WizardRunOptions, 'installDir'> & { ci?: boolean },\n): Promise<PackageManager> {\n  const detectedPackageManagers = detectAllPackageManagers({\n    installDir: options.installDir,\n  });\n\n  if (detectedPackageManagers.length >= 1) {\n    const selected = detectedPackageManagers[0];\n    analytics.setTag('package-manager', selected.name);\n    return selected;\n  }\n\n  // No package manager detected — default to npm\n  analytics.setTag('package-manager', npm.name);\n  return npm;\n}\n\nexport function isUsingTypeScript({\n  installDir,\n}: Pick<WizardRunOptions, 'installDir'>): boolean {\n  try {\n    fs.accessSync(join(installDir, 'tsconfig.json'));\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Get project data for the wizard via OAuth or CI API key.\n */\nexport async function getOrAskForProjectData(\n  _options: Pick<WizardRunOptions, 'signup' | 'ci' | 'apiKey' | 'projectId'> & {\n    email?: string;\n    region?: CloudRegion;\n    /** Optional — picks the OAuth scope set via\n     *  `getOAuthScopesForProgram`. Omitted → default\n     *  `WIZARD_OAUTH_SCOPES`. Threaded into `askForWizardLogin`. */\n    programId?: ProgramId | null;\n  },\n): Promise<{\n  host: string;\n  projectApiKey: string;\n  accessToken: string;\n  projectId: number;\n  cloudRegion: CloudRegion;\n  roleAtOrganization: string | null;\n  user: ApiUser | null;\n}> {\n  // CI mode: bypass OAuth, use personal API key for LLM gateway\n  if (_options.ci && _options.apiKey) {\n    getUI().log.info('Using provided API key (CI mode - OAuth bypassed)');\n\n    const cloudRegion = await detectRegionFromToken(_options.apiKey);\n    const host = getHostFromRegion(cloudRegion);\n    const cloudUrl = getCloudUrlFromRegion(cloudRegion);\n\n    const projectData =\n      _options.projectId != null\n        ? await fetchProjectDataById(\n            _options.apiKey,\n            _options.projectId,\n            cloudUrl,\n          )\n        : await fetchProjectDataWithApiKey(_options.apiKey, cloudUrl);\n\n    // Best-effort user fetch — CI flows may run with project-scoped keys\n    // that 403 on /api/users/@me/, so swallow errors and continue with\n    // a null user (and null role).\n    let user: ApiUser | null = null;\n    let roleAtOrganization: string | null = null;\n    try {\n      user = await fetchUserData(_options.apiKey, cloudUrl);\n      roleAtOrganization = user.role_at_organization ?? null;\n    } catch {\n      // best-effort\n    }\n\n    return {\n      host,\n      projectApiKey: projectData.api_token,\n      accessToken: _options.apiKey,\n      projectId: projectData.id,\n      cloudRegion,\n      roleAtOrganization,\n      user,\n    };\n  }\n\n  const {\n    host,\n    projectApiKey,\n    accessToken,\n    projectId,\n    cloudRegion,\n    roleAtOrganization,\n    user,\n  } = await withProgress('login', () =>\n    askForWizardLogin({\n      signup: _options.signup,\n      email: _options.email,\n      region: _options.region,\n      programId: _options.programId,\n    }),\n  );\n\n  if (!projectApiKey) {\n    const cloudUrl = getCloudUrlFromRegion(cloudRegion);\n    getUI().log.error(`Didn't receive a project token. This shouldn't happen :(\n\nPlease let us know if you think this is a bug in the wizard:\n${ISSUES_URL}`);\n\n    getUI().log\n      .info(`In the meantime, we'll add a dummy project token (\"${DUMMY_PROJECT_API_KEY}\") for you to replace later.\nYou can find your project token here:\n${cloudUrl}/settings/project#variables`);\n  }\n\n  return {\n    accessToken,\n    host: host || DEFAULT_HOST_URL,\n    projectApiKey: projectApiKey || DUMMY_PROJECT_API_KEY,\n    projectId,\n    cloudRegion,\n    roleAtOrganization: roleAtOrganization ?? null,\n    user: user ?? null,\n  };\n}\n\nasync function fetchProjectDataWithApiKey(\n  apiKey: string,\n  cloudUrl: string,\n): Promise<{ api_token: string; id: number }> {\n  const userData = await fetchUserData(apiKey, cloudUrl);\n  const projectId = userData.team?.id;\n\n  if (!projectId) {\n    throw new Error(\n      'Could not determine project ID from API key. Please ensure your API key has access to a project in this cloud region.',\n    );\n  }\n\n  const projectData = await fetchProjectData(apiKey, projectId, cloudUrl);\n  return {\n    api_token: projectData.api_token,\n    id: projectId,\n  };\n}\n\nasync function fetchProjectDataById(\n  apiKey: string,\n  projectId: number,\n  cloudUrl: string,\n): Promise<{ api_token: string; id: number }> {\n  const projectData = await fetchProjectData(apiKey, projectId, cloudUrl);\n  return {\n    api_token: projectData.api_token,\n    id: projectId,\n  };\n}\n\nasync function askForWizardLogin(options: {\n  signup: boolean;\n  email?: string;\n  region?: CloudRegion;\n  /** Used to pick the right scope set via `getOAuthScopesForProgram`.\n   *  Omitted → default `WIZARD_OAUTH_SCOPES`. */\n  programId?: ProgramId | null;\n}): Promise<ProjectData & { cloudRegion: CloudRegion }> {\n  if (options.signup) {\n    return askForProvisioningSignup(options.email, options.region);\n  }\n\n  const tokenResponse = await performOAuthFlow({\n    scopes: [...getOAuthScopesForProgram(options.programId)],\n    signup: false,\n  });\n\n  const projectId = tokenResponse.scoped_teams?.[0];\n\n  if (projectId === undefined) {\n    const error = new Error(\n      'No project access granted. Please authorize with project-level access.',\n    );\n    analytics.captureException(error, {\n      step: 'wizard_login',\n      has_scoped_teams: !!tokenResponse.scoped_teams,\n    });\n    getUI().log.error(error.message);\n    await abort();\n  }\n\n  const cloudRegion = await detectRegionFromToken(tokenResponse.access_token);\n  const cloudUrl = getCloudUrlFromRegion(cloudRegion);\n  const host = getHostFromRegion(cloudRegion);\n\n  const projectData = await fetchProjectData(\n    tokenResponse.access_token,\n    projectId!,\n    cloudUrl,\n  );\n  const userData = await fetchUserData(tokenResponse.access_token, cloudUrl);\n\n  const data = {\n    accessToken: tokenResponse.access_token,\n    projectApiKey: projectData.api_token,\n    host,\n    distinctId: userData.distinct_id,\n    projectId: projectId!,\n    cloudRegion,\n    roleAtOrganization: userData.role_at_organization ?? null,\n    user: userData,\n  };\n\n  getUI().log.success('Login complete.');\n  analytics.setTag('opened-wizard-link', true);\n  analytics.setDistinctId(data.distinctId);\n\n  return data;\n}\n\nasync function askForProvisioningSignup(\n  email?: string,\n  region?: CloudRegion,\n): Promise<ProjectData & { cloudRegion: CloudRegion }> {\n  if (!email || !email.includes('@')) {\n    getUI().log.error(\n      'Email is required for signup. Use --email your@email.com with --signup.',\n    );\n    await abort();\n    throw new Error('unreachable');\n  }\n\n  const spinner = getUI().spinner();\n  spinner.start('Creating your PostHog account...');\n\n  try {\n    const provisionRegion = (region ?? 'us').toUpperCase() as 'US' | 'EU';\n    const { orgName, projectName } = detectOrgAndProject(email);\n    const result = await provisionNewAccount(email, '', provisionRegion, {\n      orgName,\n      projectName,\n    });\n\n    spinner.stop('Account created!');\n    getUI().log.success('Welcome to PostHog!');\n\n    const host = result.host;\n    const cloudRegion: CloudRegion = host.includes('eu.') ? 'eu' : 'us';\n\n    analytics.setTag('provisioning-signup', true);\n\n    return {\n      accessToken: result.accessToken,\n      projectApiKey: result.projectApiKey,\n      host,\n      distinctId: email,\n      projectId: parseInt(result.projectId, 10) || 0,\n      cloudRegion,\n    };\n  } catch (error) {\n    spinner.stop('Account creation failed.');\n    const message = error instanceof Error ? error.message : 'Unknown error';\n\n    if (message.includes('already associated')) {\n      getUI().log.info(\n        'This email already has a PostHog account. Switching to login flow...',\n      );\n      return askForWizardLogin({ signup: false });\n    }\n\n    getUI().log.error(`Failed to create account: ${message}`);\n    analytics.captureException(\n      error instanceof Error ? error : new Error(message),\n      { step: 'provisioning_signup' },\n    );\n    await abort();\n    throw error;\n  }\n}\n\n/**\n * Creates a new config file with the given filepath and codeSnippet.\n */\nexport async function createNewConfigFile(\n  filepath: string,\n  codeSnippet: string,\n  { installDir }: Pick<WizardRunOptions, 'installDir'>,\n  moreInformation?: string,\n): Promise<boolean> {\n  if (!isAbsolute(filepath)) {\n    debug(`createNewConfigFile: filepath is not absolute: ${filepath}`);\n    return false;\n  }\n\n  const prettyFilename = relative(installDir, filepath);\n\n  try {\n    await fs.promises.writeFile(filepath, codeSnippet);\n\n    getUI().log.success(`Added new ${prettyFilename} file.`);\n\n    if (moreInformation) {\n      getUI().log.info(moreInformation);\n    }\n\n    return true;\n  } catch (e) {\n    debug(e);\n    getUI().log.warn(\n      `Could not create a new ${prettyFilename} file. Please create one manually and follow the instructions below.`,\n    );\n  }\n\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0BA,SAAS,YAAY,YAAoB,MAAuB;AAC9D,QAAOA,KAAG,WAAWC,OAAK,KAAK,YAAY,KAAK,CAAC;;AAGnD,SAAS,uBACP,YACA,MACA,QACS;AACT,KAAI;AAIF,SAHaD,KACV,aAAaC,OAAK,KAAK,YAAY,KAAK,EAAE,QAAQ,CAClD,MAAM,GAAG,IAAI,CACJ,SAAS,OAAO;SACtB;AACN,SAAO;;;AAMX,eAAe,cACb,MACA,SACA,YACA,EAAE,cACa;CACf,MAAM,MAAM,MAAM,kBAAkB,EAAE,YAAY,CAAC;CACnD,IAAI;AACJ,KAAI,SAAS,OACX,QAAO;EACL,GAAG;EACH,aAAa;GAAE,GAAI,IAAI,eAAe,EAAE;IAAI,UAAU;GAAY;EACnE;UACQ,SAAS,OAClB,QAAO;EACL,GAAG;EACH,MAAM;GACJ,GAAI,IAAI,QAAQ,EAAE;GAClB,WAAW;IAAE,GAAI,IAAI,MAAM,aAAa,EAAE;KAAI,UAAU;IAAY;GACrE;EACF;KAED,QAAO;EACL,GAAG;EACH,WAAW;GAAE,GAAI,IAAI,aAAa,EAAE;IAAI,UAAU;GAAY;EAC/D;AAEH,OAAM,qBAAqB,MAAM,EAAE,YAAY,CAAC;;AAiFlD,MAAa,kBAAoC;CA9Ed;EACjC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,YAAY,YAAY,YAAY,IAAI,YAAY,YAAY,WAAW;EAC7E,cAAc,SAAS,YAAY,SACjC,cAAc,OAAO,SAAS,YAAY,KAAK;EAClD;CAEsC;EACrC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,uBAAuB,YAAY,aAAa,mBAAmB;EACrE,cAAc,SAAS,YAAY,SACjC,cAAc,QAAQ,SAAS,YAAY,KAAK;EACnD;CAGsC;EACrC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,uBAAuB,YAAY,aAAa,aAAa;EAC/D,cAAc,SAAS,YAAY,SACjC,cAAc,QAAQ,SAAS,YAAY,KAAK;EACnD;CAEmC;EAClC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBAAiB,YAAY,YAAY,iBAAiB;EACrE,cAAc,SAAS,YAAY,SACjC,cAAc,QAAQ,SAAS,YAAY,KAAK;EACnD;CAEkC;EACjC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBAAiB,YAAY,YAAY,oBAAoB;EACxE,cAAc,SAAS,YAAY,SACjC,cAAc,OAAO,SAAS,YAAY,KAAK;EAClD;CAImC;EAClC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,cAAc;EACd,cAAc,SAAS,YAAY,SACjC,cAAc,OAAO,SAAS,YAAY,KAAK;EAClD;CASA;AAED,SAAgB,yBAAyB,EACvC,cACkC;AAClC,QAAO,aAAa,gCAAgC;EAClD,MAAM,UAAU,gBAAgB,QAAQ,OAAO,GAAG,OAAO,EAAE,YAAY,CAAC,CAAC;AACzE,MAAI,QAAQ,WAAW,EACrB,WAAU,OAAO,mBAAmB,eAAe;AAErD,SAAO;GACP;;;;;;;;;;;;;AC5DJ,MAAM,0BAAyE,EAK7E,gBAhE0C;CAK1C;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAKA;CACA;CAMA;CACA;CACA;CACA;CAIA;CACA;CAKA;CACA;CACD,EAmBA;;;;;;;;;;;;AAaD,SAAgB,yBACd,WACmB;CACnB,MAAM,YAAa,aAAa,wBAAwB,cAAe,EAAE;AACzE,KAAI,UAAU,WAAW,EACvB,QAAO;CAIT,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAM,SAAmB,EAAE;AAC3B,MAAK,MAAM,KAAK,CAAC,GAAG,qBAAqB,GAAG,UAAU,EAAE;AACtD,MAAI,KAAK,IAAI,EAAE,CAAE;AACjB,OAAK,IAAI,EAAE;AACX,SAAO,KAAK,EAAE;;AAEhB,QAAO;;;;AC9HT,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;AAuB9B,MAAM,2BAA2B,EAAE,OAAO;CACxC,cAAc,EAAE,QAAQ;CACxB,YAAY,EAAE,QAAQ;CACtB,YAAY,EAAE,QAAQ;CACtB,OAAO,EAAE,QAAQ;CACjB,eAAe,EAAE,QAAQ,CAAC,UAAU;CACpC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC5C,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,CAAC;AASF,SAAS,oBAAoB,MAAsB;AACjD,QAAO,oBAAoB;;AAG7B,SAAS,eAAe,MAAsB;AAC5C,QAAO,GAAG,oBAAoB,KAAK,CAAC;;AAGtC,SAAS,iBAAiB,MAAsB;AAC9C,QAAO,GAAG,oBAAoB,KAAK,CAAC;;AAGtC,SAAS,kBAAkB,MAAsB;AAC/C,QAAO,GAAG,iBAAiB,KAAK,CAAC;;;;;;;;;;;;AAanC,SAAgB,iBAAiB,OAA8B;CAC7D,MAAM,UAAU,MAAM,MAAM;AAC5B,KAAI,CAAC,QAAS,QAAO;CAGrB,IAAI,eAAe;AACnB,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,iBAAe;EACf,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;AACzC,MAAI,KAAM,QAAO;SACX;CAKR,MAAM,QAAQ,QAAQ,MAAM,sBAAsB;AAClD,KAAI,MAAO,QAAO,mBAAmB,MAAM,GAAG;AAG9C,KAAI,aAAc,QAAO;AAGzB,KAAI,CAAC,KAAK,KAAK,QAAQ,CAAE,QAAO;AAEhC,QAAO;;AAGT,SAAS,uBAA+B;AACtC,QAAO,OAAO,YAAY,GAAG,CAAC,SAAS,YAAY;;AAGrD,SAAS,sBAAsB,UAA0B;AACvD,QAAO,OAAO,WAAW,SAAS,CAAC,OAAO,SAAS,CAAC,OAAO,YAAY;;AAGzE,eAAe,oBACb,SACA,WACA,MAKC;AACD,QAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI;EACJ,IAAI;EAEJ,MAAM,wBACJ,IAAI,SAAiB,KAAK,QAAQ;AAChC,qBAAkB;AAClB,oBAAiB;IACjB;EAEJ,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ;AAC7C,OAAI,CAAC,IAAI,KAAK;AACZ,QAAI,UAAU,IAAI;AAClB,QAAI,KAAK;AACT;;GAEF,MAAM,MAAM,IAAI,IAAI,IAAI,KAAK,oBAAoB,KAAK,CAAC;AAEvD,OAAI,IAAI,aAAa,cAAc;IAEjC,MAAM,cADW,IAAI,aAAa,IAAI,SAAS,KAAK,SACrB,YAAY;AAC3C,QAAI,UAAU,KAAK,EAAE,UAAU,aAAa,CAAC;AAC7C,QAAI,KAAK;AACT;;GAGF,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;GACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,OAAI,OAAO;IACT,MAAM,iBAAiB,UAAU;AACjC,QAAI,UAAU,iBAAiB,MAAM,KAAK,EACxC,gBAAgB,4BACjB,CAAC;AACF,QAAI,IAAI;;;;sDAKA,iBAAiB,cAAc,SAChC;gBACC,sBAAsB;;;mBAItB,iBACI,6BACA,wBACL;;;;;UAKL;AACF,mCAAe,IAAI,MAAM,gBAAgB,QAAQ,CAAC;AAClD;;AAGF,OAAI,MAAM;AACR,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,QAAI,IAAI;;;;;gBAKA,sBAAsB;;;;;;;;UAQ5B;AACF,oBAAgB,KAAK;UAChB;AACL,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,QAAI,IAAI;;;;;gBAKA,sBAAsB;;;;;;;UAO5B;;IAEJ;AAEF,SAAO,OAAO,YAAY;AACxB,WAAQ;IAAE;IAAM;IAAQ;IAAiB,CAAC;IAC1C;AAEF,SAAO,GAAG,SAAS,OAAO;GAC1B;;AAGJ,SAAS,mBAAmB,MAK1B;AACA,KAAI;EAKF,MAAM,QAJS,SAAS,YAAY,KAAK,4BAA4B;GACnE,UAAU;GACV,SAAS;GACV,CAAC,CAAC,MAAM,CACY,MAAM,KAAK;AAEhC,MAAI,MAAM,SAAS,EACjB,QAAO;GAAE,SAAS;GAAW,KAAK;GAAW;GAAM,MAAM;GAAW;EACtE,MAAM,SAAS,MAAM,GAAG,MAAM,MAAM;AAKpC,SAAO;GAAE,SAHO,OAAO,MAAM;GAGX,KAFN,OAAO,MAAM;GAEF;GAAM,MADhB,OAAO,MAAM;GACS;SAC7B;AACN,SAAO;GAAE,SAAS;GAAW,KAAK;GAAW;GAAM,MAAM;GAAW;;;AAIxE,SAAS,iBAAiB,OAAyB;AACjD,QACE,iBAAiB,SACjB,UAAU,SACT,MAAgC,SAAS;;AAI9C,eAAe,qBACb,MACA,cACA,aAC6B;CAC7B,MAAM,WAA4C;CAElD,MAAM,WAAW,MAAM,MAAM,KAC3B,GAAG,kBAAkB,eACrB;EACE,YAAY;EACZ;EACA,cAAc;EACd,WAAW;EACX,eAAe;EAChB,EACD,EACE,SAAS;EACP,gBAAgB;EAChB,cAAc;EACf,EACF,CACF;AAED,QAAO,yBAAyB,MAAM,SAAS,KAAK;;AAGtD,eAAsB,iBACpB,QAC6B;CAC7B,MAAM,WAA4C;CAClD,MAAM,eAAe,sBAAsB;CAC3C,MAAM,gBAAgB,sBAAsB,aAAa;CACzD,IAAI,cAAc;AAElB,IAAG;AACD,gBAAc;EACd,IAAI,kBAKO;AAEX,OAAK,MAAM,QAAQ,aAAa;GAC9B,MAAM,cAAc,eAAe,KAAK;GACxC,MAAM,UAAU,IAAI,IAAI,GAAG,kBAAkB,kBAAkB;AAC/D,WAAQ,aAAa,IAAI,aAAa,SAAS;AAC/C,WAAQ,aAAa,IAAI,gBAAgB,YAAY;AACrD,WAAQ,aAAa,IAAI,iBAAiB,OAAO;AACjD,WAAQ,aAAa,IAAI,kBAAkB,cAAc;AACzD,WAAQ,aAAa,IAAI,yBAAyB,OAAO;AACzD,WAAQ,aAAa,IAAI,SAAS,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1D,WAAQ,aAAa,IAAI,yBAAyB,UAAU;GAE5D,MAAM,YAAY,IAAI,IACpB,GAAG,kBAAkB,eAAe,mBAClC,QAAQ,UAAU,CACnB,GACF;GACD,MAAM,iBAAiB,kBAAkB,KAAK;GAC9C,MAAM,gBAAgB,iBAAiB,KAAK;GAC5C,MAAM,YAAY,OAAO,SAAS,iBAAiB;AAEnD,aAAU,8CAA8C,OAAO;GAE/D,IAAI;GACJ,IAAI;AACJ,OAAI;AACF,KAAC,CAAE,QAAQ,mBAAoB,MAAM,oBACnC,QAAQ,UAAU,EAClB,UAAU,UAAU,EACpB,KACD;YACM,GAAG;AACV,QAAI,CAAC,iBAAiB,EAAE,CAAE,OAAM;AAChC,sBAAkB,mBAAmB,KAAK;AAC1C;;AAGF,aAAU,mDAAmD;AAE7D,UAAO,CAAC,YAAY,UAAU;AAK9B,UAAO,CAAC,gBACN,OAAO,SAAS,UAAU,UAAU,GAAG,QAAQ,UAAU,CAC1D;AAGC,OAAI,WAAW,EAAE,MAAM,OAAO,CAAC,CAAC,YAAY,GAE1C;GAGJ,MAAM,eAAe,OAAO,CAAC,SAAS;AACtC,gBAAa,MAAM,+BAA+B;AAElD,OAAI;IAgBF,MAAM,QAAQ,MAAM,qBAXP,MAAM,QAAQ,KAAK;KAC9B,iBAAiB;KACjB,OAAO,CAAC,uBAAuB;KAC/B,IAAI,SAAgB,GAAG,WACrB,iBACQ,uBAAO,IAAI,MAAM,0BAA0B,CAAC,EAClD,iBACD,CACF;KACF,CAAC,EAIA,cACA,YACD;AAED,WAAO,OAAO;AACd,WAAO,CAAC,YAAY,KAAK;AACzB,WAAO,CAAC,gBAAgB,KAAK;AAC7B,iBAAa,KAAK,0BAA0B;AAE5C,WAAO;YACA,GAAG;AACV,iBAAa,KAAK,wBAAwB;AAC1C,WAAO,OAAO;IAEd,MAAM,QAAQ,aAAa,QAAQ,oBAAI,IAAI,MAAM,gBAAgB;AAEjE,QAAI,MAAM,QAAQ,SAAS,UAAU,CACnC,QAAO,CAAC,IAAI,MAAM,6CAA6C;aACtD,MAAM,QAAQ,SAAS,gBAAgB,CAChD,QAAO,CAAC,IAAI,KACV,wLACD;QAED,QAAO,CAAC,IAAI,MACV,4BAA4B,MAAM,QAAQ,iFAAiF,aAC5H;IAGH,MAAM,iBAAiB,MAAM,QAAQ,WAAW,gBAAgB,GAC5D,MAAM,QAAQ,MAAM,GAAuB,GAC3C,MAAM,QAAQ,SAAS,UAAU,GACjC,YACA;AAEJ,cAAU,iBAAiB,OAAO;KAChC,MAAM;KACN,kBAAkB;KAClB,WAAW;KACX,kBAAkB,OAAO,OAAO,KAAK,IAAI;KAGzC,wBAAwB,gBAAgB;KACzC,CAAC;AAEF,UAAM,OAAO;AACb,UAAM;;;AAIV,MAAI,CAAC,gBACH,OAAM,IAAI,MAAM,qCAAqC;AAGvD,QAAM,OAAO,CAAC,iBAAiB,gBAAgB;AAC/C,gBAAc;UACP;AAET,OAAM,IAAI,MAAM,4CAA4C;;;;;;;;;AC7a9D,SAAS,mBAAmB,SAA0B;CACpD,MAAM,IAAI,QAAQ,MAAM;AACxB,QACE,MAAM,MACN,EAAE,WAAW,UAAU,IACvB,EAAE,WAAW,WAAW,IACxB,EAAE,WAAW,OAAO,IACpB,EAAE,WAAW,SAAS,IACtB,EAAE,WAAW,QAAQ,IACrB,EAAE,WAAW,OAAO,IACpB,EAAE,WAAW,aAAa,IAC1B,EAAE,WAAW,IAAI,IACjB,EAAE,SAAS,IAAI;;;;;;;;;;;;;;;;;AAyCnB,SAAgB,oBAAoB,iBAA0B;AAC5D,SAAQ,YAAwC;AAC9C,MAAI,CAAC,QACH,QAAO;AAGT,MAAI,mBAAmB,QAAQ,CAC7B,QAAO;AAGT,MAAI;GACF,MAAM,SAAS,WAAW,QAAQ;AAClC,OAAI,CAAC,OACH,QAAO;GAET,MAAM,eAAe,MAAM,OAAO;AAClC,OAAI,oBAAoB,KAAA,KAAa,eAAe,gBAClD,QAAO,IAAI,gBAAgB;AAE7B,UAAO,GAAG,aAAa;UACjB;AACN,UAAO;;;;;;;;;;;;;;;;ACRb,eAAsB,MAAM,SAAkB,QAAiC;AAC7E,QAAO,YAAY;EAAE;EAAS,UAAU;EAAQ,CAAC;;AAcnD,MAAM,mBAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,iBAAuD;AAC9D,KAAI;EAQF,MAAM,QAPM,aACT,SAAS,6BAA6B,EACrC,OAAO;GAAC;GAAU;GAAQ;GAAS,EACpC,CAAC,CACD,UAAU,CACV,MAAM,CAES,MAAM,uCAAuC;AAC/D,MAAI,MAAO,QAAO;GAAE,KAAK,MAAM;GAAI,MAAM,MAAM;GAAI;SAC7C;AAGR,QAAO;;AAGT,SAAgB,oBAAoB,OAGlC;CACA,MAAM,SAAS,gBAAgB;CAG/B,MAAM,cAAc,QAAQ,QAAQ,SAAS,QAAQ,KAAK,CAAC,IAAI,KAAA;CAG/D,IAAI;AACJ,KAAI,QAAQ,IACV,WAAU,OAAO;MACZ;EACL,MAAM,SAAS,MAAM,MAAM,IAAI,CAAC,IAAI,aAAa;AACjD,MAAI,UAAU,CAAC,iBAAiB,IAAI,OAAO,CACzC,WAAU,OAAO,MAAM,IAAI,CAAC;;AAIhC,QAAO;EAAE;EAAS;EAAa;;;;;;;AAqIjC,eAAsB,kBAAkB,EACtC,cAC6D;CAC7D,MAAM,UAAU,KAAK,YAAY,eAAe;CAEhD,IAAI;AACJ,KAAI;AACF,QAAM,MAAMC,KAAG,SAAS,SAAS,SAAS,OAAO;SAC3C;AACN,SAAO,CAAC,IAAI,MACV,oFACD;AACD,QAAM,OAAO;AACb,SAAO,EAAE;;AAGX,KAAI;AAEF,SADe,KAAK,MAAM,IAAI,IACb,EAAE;SACb;AACN,SAAO,CAAC,IAAI,MACV,sEACD;AACD,QAAM,OAAO;AACb,SAAO,EAAE;;;;;;;AAQb,eAAsB,kBAAkB,EACtC,cACoE;AACpE,KAAI;EACF,MAAM,0BAA0B,MAAMA,KAAG,SAAS,SAChD,KAAK,YAAY,eAAe,EAChC,OACD;AACD,SAAO,KAAK,MAAM,wBAAwB;SACpC;AACN,SAAO;;;AAIX,eAAsB,qBACpB,gBACA,EAAE,cACa;CACf,MAAM,UAAU,KAAK,YAAY,eAAe;CAChD,MAAM,aAAa,KAAK,UAAU,gBAAgB,MAAM,EAAE;AAE1D,KAAI;AACF,QAAMA,KAAG,SAAS,UAAU,SAAS,YAAY;GAC/C,UAAU;GACV,MAAM;GACP,CAAC;AACF;SACM;AACN,SAAO,CAAC,IAAI,MAAM,sCAAsC;AACxD,QAAM,OAAO;;;AA2BjB,SAAgB,kBAAkB,EAChC,cACgD;AAChD,KAAI;AACF,OAAG,WAAW,KAAK,YAAY,gBAAgB,CAAC;AAChD,SAAO;SACD;AACN,SAAO;;;;;;AAOX,eAAsB,uBACpB,UAgBC;AAED,KAAI,SAAS,MAAM,SAAS,QAAQ;AAClC,SAAO,CAAC,IAAI,KAAK,oDAAoD;EAErE,MAAM,cAAc,MAAM,sBAAsB,SAAS,OAAO;EAChE,MAAM,OAAO,kBAAkB,YAAY;EAC3C,MAAM,WAAW,sBAAsB,YAAY;EAEnD,MAAM,cACJ,SAAS,aAAa,OAClB,MAAM,qBACJ,SAAS,QACT,SAAS,WACT,SACD,GACD,MAAM,2BAA2B,SAAS,QAAQ,SAAS;EAKjE,IAAI,OAAuB;EAC3B,IAAI,qBAAoC;AACxC,MAAI;AACF,UAAO,MAAM,cAAc,SAAS,QAAQ,SAAS;AACrD,wBAAqB,KAAK,wBAAwB;UAC5C;AAIR,SAAO;GACL;GACA,eAAe,YAAY;GAC3B,aAAa,SAAS;GACtB,WAAW,YAAY;GACvB;GACA;GACA;GACD;;CAGH,MAAM,EACJ,MACA,eACA,aACA,WACA,aACA,oBACA,SACE,MAAM,aAAa,eACrB,kBAAkB;EAChB,QAAQ,SAAS;EACjB,OAAO,SAAS;EAChB,QAAQ,SAAS;EACjB,WAAW,SAAS;EACrB,CAAC,CACH;AAED,KAAI,CAAC,eAAe;EAClB,MAAM,WAAW,sBAAsB,YAAY;AACnD,SAAO,CAAC,IAAI,MAAM;;;EAGpB,aAAa;AAEX,SAAO,CAAC,IACL,KAAK,sDAAsD,sBAAsB;;EAEtF,SAAS,6BAA6B;;AAGtC,QAAO;EACL;EACA,MAAM,QAAQ;EACd,eAAe,iBAAA;EACf;EACA;EACA,oBAAoB,sBAAsB;EAC1C,MAAM,QAAQ;EACf;;AAGH,eAAe,2BACb,QACA,UAC4C;CAE5C,MAAM,aADW,MAAM,cAAc,QAAQ,SAAS,EAC3B,MAAM;AAEjC,KAAI,CAAC,UACH,OAAM,IAAI,MACR,wHACD;AAIH,QAAO;EACL,YAFkB,MAAM,iBAAiB,QAAQ,WAAW,SAAS,EAE9C;EACvB,IAAI;EACL;;AAGH,eAAe,qBACb,QACA,WACA,UAC4C;AAE5C,QAAO;EACL,YAFkB,MAAM,iBAAiB,QAAQ,WAAW,SAAS,EAE9C;EACvB,IAAI;EACL;;AAGH,eAAe,kBAAkB,SAOuB;AACtD,KAAI,QAAQ,OACV,QAAO,yBAAyB,QAAQ,OAAO,QAAQ,OAAO;CAGhE,MAAM,gBAAgB,MAAM,iBAAiB;EAC3C,QAAQ,CAAC,GAAG,yBAAyB,QAAQ,UAAU,CAAC;EACxD,QAAQ;EACT,CAAC;CAEF,MAAM,YAAY,cAAc,eAAe;AAE/C,KAAI,cAAc,KAAA,GAAW;EAC3B,MAAM,wBAAQ,IAAI,MAChB,yEACD;AACD,YAAU,iBAAiB,OAAO;GAChC,MAAM;GACN,kBAAkB,CAAC,CAAC,cAAc;GACnC,CAAC;AACF,SAAO,CAAC,IAAI,MAAM,MAAM,QAAQ;AAChC,QAAM,OAAO;;CAGf,MAAM,cAAc,MAAM,sBAAsB,cAAc,aAAa;CAC3E,MAAM,WAAW,sBAAsB,YAAY;CACnD,MAAM,OAAO,kBAAkB,YAAY;CAE3C,MAAM,cAAc,MAAM,iBACxB,cAAc,cACd,WACA,SACD;CACD,MAAM,WAAW,MAAM,cAAc,cAAc,cAAc,SAAS;CAE1E,MAAM,OAAO;EACX,aAAa,cAAc;EAC3B,eAAe,YAAY;EAC3B;EACA,YAAY,SAAS;EACV;EACX;EACA,oBAAoB,SAAS,wBAAwB;EACrD,MAAM;EACP;AAED,QAAO,CAAC,IAAI,QAAQ,kBAAkB;AACtC,WAAU,OAAO,sBAAsB,KAAK;AAC5C,WAAU,cAAc,KAAK,WAAW;AAExC,QAAO;;AAGT,eAAe,yBACb,OACA,QACqD;AACrD,KAAI,CAAC,SAAS,CAAC,MAAM,SAAS,IAAI,EAAE;AAClC,SAAO,CAAC,IAAI,MACV,0EACD;AACD,QAAM,OAAO;AACb,QAAM,IAAI,MAAM,cAAc;;CAGhC,MAAM,UAAU,OAAO,CAAC,SAAS;AACjC,SAAQ,MAAM,mCAAmC;AAEjD,KAAI;EACF,MAAM,mBAAmB,UAAU,MAAM,aAAa;EACtD,MAAM,EAAE,SAAS,gBAAgB,oBAAoB,MAAM;EAC3D,MAAM,SAAS,MAAM,oBAAoB,OAAO,IAAI,iBAAiB;GACnE;GACA;GACD,CAAC;AAEF,UAAQ,KAAK,mBAAmB;AAChC,SAAO,CAAC,IAAI,QAAQ,sBAAsB;EAE1C,MAAM,OAAO,OAAO;EACpB,MAAM,cAA2B,KAAK,SAAS,MAAM,GAAG,OAAO;AAE/D,YAAU,OAAO,uBAAuB,KAAK;AAE7C,SAAO;GACL,aAAa,OAAO;GACpB,eAAe,OAAO;GACtB;GACA,YAAY;GACZ,WAAW,SAAS,OAAO,WAAW,GAAG,IAAI;GAC7C;GACD;UACM,OAAO;AACd,UAAQ,KAAK,2BAA2B;EACxC,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AAEzD,MAAI,QAAQ,SAAS,qBAAqB,EAAE;AAC1C,UAAO,CAAC,IAAI,KACV,uEACD;AACD,UAAO,kBAAkB,EAAE,QAAQ,OAAO,CAAC;;AAG7C,SAAO,CAAC,IAAI,MAAM,6BAA6B,UAAU;AACzD,YAAU,iBACR,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,QAAQ,EACnD,EAAE,MAAM,uBAAuB,CAChC;AACD,QAAM,OAAO;AACb,QAAM"}

package/dist/skill-CPqcV8zp.js

@@ -0,0 +1,29 @@
+import { M as POSTHOG_DOCS_URL } from "./debug-Bx7nvCWW.js";
+import { d as createSkillProgram, n as runWizard, t as runWizardCI } from "./bin.js";
+//#region src/commands/basic-integration/skill.ts
+/** Run an arbitrary context-mill skill by id (`--skill <id>`, headless with `--ci`). */
+function runSkillMode(argv) {
+	const skillId = argv.skill;
+	const config = createSkillProgram({
+		skillId,
+		command: "skill",
+		id: "agent-skill",
+		description: `Run skill: ${skillId}`,
+		integrationLabel: skillId,
+		successMessage: `${skillId} completed!`,
+		reportFile: `posthog-${skillId}-report.md`,
+		docsUrl: POSTHOG_DOCS_URL,
+		spinnerMessage: `Running ${skillId}...`,
+		estimatedDurationMinutes: 5
+	});
+	const options = {
+		...argv,
+		skillId
+	};
+	if (argv.ci) runWizardCI(config, options);
+	else runWizard(config, options);
+}
+//#endregion
+export { runSkillMode };
+
+//# sourceMappingURL=skill-CPqcV8zp.js.map

package/dist/skill-CPqcV8zp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-CPqcV8zp.js","names":[],"sources":["../src/commands/basic-integration/skill.ts"],"sourcesContent":["import type { Arguments } from 'yargs';\nimport { POSTHOG_DOCS_URL } from '@lib/constants';\nimport { runWizard, runWizardCI } from '@lib/runners';\nimport { createSkillProgram } from '@lib/programs/agent-skill/index';\n\n/** Run an arbitrary context-mill skill by id (`--skill <id>`, headless with `--ci`). */\nexport function runSkillMode(argv: Arguments): void {\n  const skillId = argv.skill as string;\n  const config = createSkillProgram({\n    skillId,\n    command: 'skill',\n    id: 'agent-skill',\n    description: `Run skill: ${skillId}`,\n    integrationLabel: skillId,\n    successMessage: `${skillId} completed!`,\n    reportFile: `posthog-${skillId}-report.md`,\n    docsUrl: POSTHOG_DOCS_URL,\n    spinnerMessage: `Running ${skillId}...`,\n    estimatedDurationMinutes: 5,\n  });\n  const options = { ...argv, skillId };\n  if (argv.ci) {\n    runWizardCI(config, options);\n  } else {\n    runWizard(config, options);\n  }\n}\n"],"mappings":";;;;AAMA,SAAgB,aAAa,MAAuB;CAClD,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,mBAAmB;EAChC;EACA,SAAS;EACT,IAAI;EACJ,aAAa,cAAc;EAC3B,kBAAkB;EAClB,gBAAgB,GAAG,QAAQ;EAC3B,YAAY,WAAW,QAAQ;EAC/B,SAAS;EACT,gBAAgB,WAAW,QAAQ;EACnC,0BAA0B;EAC3B,CAAC;CACF,MAAM,UAAU;EAAE,GAAG;EAAM;EAAS;AACpC,KAAI,KAAK,GACP,aAAY,QAAQ,QAAQ;KAE5B,WAAU,QAAQ,QAAQ"}