@posthog/wizard 2.38.0 → 2.38.2

package/dist/{analytics-CvIK_07d.js → analytics-Ciob-x8a.js}

@@ -1,4 +1,4 @@
-import { S as ANALYTICS_TEAM_TAG, b as ANALYTICS_HOST_URL, r as debug, s as logToFile, x as ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY } from "./debug-CgdI7Rd-.js";
+import { b as ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, r as debug, s as logToFile, x as ANALYTICS_TEAM_TAG, y as ANALYTICS_HOST_URL } from "./debug-D1lORUFs.js";
 import { PostHog } from "posthog-node";
 import { v4 } from "uuid";
 //#region src/utils/ci-flag-overrides.ts
@@ -227,6 +227,6 @@ var Analytics = class {
 };
 const analytics = new Analytics();
 //#endregion
-export { ciExcludedTaskTypes as i, groupsFromUser as n, sessionProperties as r, analytics as t };
+export { ciExcludedTaskTypes as a, sessionProperties as i, analytics as n, groupsFromUser as r, Analytics as t };
 
-//# sourceMappingURL=analytics-CvIK_07d.js.map
+//# sourceMappingURL=analytics-Ciob-x8a.js.map

package/dist/{analytics-CvIK_07d.js.map → analytics-Ciob-x8a.js.map}

@@ -1 +1 @@
-{"version":3,"file":"analytics-CvIK_07d.js","names":["uuidv4"],"sources":["../src/utils/ci-flag-overrides.ts","../src/utils/analytics.ts"],"sourcesContent":["/**\n * CI-only feature-flag overrides.\n *\n * CI must route deterministically: a run that tests the orchestrator arm says\n * so explicitly instead of depending on a live feature flag someone can edit\n * mid-week. The override env var (see the allowlist in `env.ts`) is a JSON\n * object of flag key → value, merged over whatever PostHog returned.\n *\n * The override path exists only in CI builds (`pnpm build:ci`). Published\n * builds inline NODE_ENV as the literal \"production\", the guards collapse,\n * and tsdown strips the rest from the bundle — and the smoke test asserts the\n * env var names are physically absent from production output (which is also\n * why no comment in this file may spell them out), so this can never quietly\n * become a production surface.\n */\nimport { runtimeEnv } from '@env';\nimport { logToFile } from './debug';\n\nexport function applyCiFlagOverrides(\n  flags: Record<string, string>,\n): Record<string, string> {\n  // Compared inline (not via env.ts's IS_PRODUCTION_BUILD) so tsdown replaces\n  // it with a literal right here and the bundler can prove the rest of this\n  // function unreachable in production builds. The smoke test enforces that.\n  if (process.env.NODE_ENV === 'production') return flags;\n\n  const raw = runtimeEnv('WIZARD_CI_FLAG_OVERRIDES');\n  if (!raw) return flags;\n\n  let overrides: Record<string, unknown>;\n  try {\n    overrides = JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    // A malformed override is a CI misconfiguration. Fail the run loudly\n    // rather than silently testing whatever the live flags happen to say.\n    throw new Error(\n      'The CI flag-override env var is not valid JSON (expected {\"flag-key\": value, ...}).',\n    );\n  }\n\n  const merged = { ...flags };\n  for (const [key, value] of Object.entries(overrides)) {\n    merged[key] = String(value);\n  }\n  logToFile('[flags] CI overrides applied', overrides);\n  return merged;\n}\n\n/**\n * Task types excluded from this run. The exclusion env var (see the allowlist\n * in `env.ts`) is a comma-separated list (e.g. `dashboard`), set by the CI\n * harness that owns the policy — the wizard and the served content stay\n * run-mode agnostic. CI-build only, same as the flag overrides: published\n * builds strip this path.\n */\nexport function ciExcludedTaskTypes(): readonly string[] {\n  if (process.env.NODE_ENV === 'production') return [];\n\n  const raw = runtimeEnv('WIZARD_CI_EXCLUDE_TASKS');\n  if (!raw) return [];\n  const types = raw\n    .split(',')\n    .map((t) => t.trim())\n    .filter(Boolean);\n  if (types.length > 0) logToFile('[flags] CI task exclusions', types);\n  return types;\n}\n","import { PostHog } from 'posthog-node';\nimport {\n  ANALYTICS_HOST_URL,\n  ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY,\n  ANALYTICS_TEAM_TAG,\n} from '@lib/constants';\nimport type { WizardSession } from '@lib/wizard-session';\nimport type { ApiUser } from '@lib/api';\nimport { v4 as uuidv4 } from 'uuid';\nimport { IS_PRODUCTION_BUILD } from '@env';\nimport { debug, logToFile } from './debug';\nimport { applyCiFlagOverrides } from './ci-flag-overrides';\n\n/**\n * Extract a standard property bag from the current session.\n * Used by store-level analytics and available for ad-hoc captures.\n */\nexport function sessionProperties(\n  session: WizardSession,\n): Record<string, unknown> {\n  return {\n    integration: session.integration,\n    detected_framework: session.detectedFrameworkLabel,\n    typescript: session.typescript,\n    project_id: session.credentials?.projectId,\n    discovered_features: session.discoveredFeatures,\n    additional_features: session.additionalFeatureQueue,\n    run_phase: session.runPhase,\n  };\n}\n\nexport function groupsFromUser(\n  user: ApiUser | null,\n  host: string,\n): Record<string, string> {\n  const groups: Record<string, string> = { instance: host };\n  if (!user) return groups;\n\n  const organizationId = user.organization?.id;\n  if (organizationId) groups.organization = organizationId;\n\n  const customerId = user.organization?.customer_id;\n  if (customerId) groups.customer = customerId;\n\n  const projectUuid = user.team?.uuid;\n  if (projectUuid) groups.project = projectUuid;\n\n  return groups;\n}\n\nexport class Analytics {\n  private client: PostHog;\n  private tags: Record<string, string | boolean | number | null | undefined> =\n    {};\n  private distinctId?: string;\n  private anonymousId: string;\n  private _runId: string;\n  private sessionId: string | null = null;\n  private appName = 'wizard';\n  private activeFlags: Record<string, string> | null = null;\n  private groups: Record<string, string> = {};\n  private personProperties: Record<string, string> = {};\n\n  constructor() {\n    this.client = new PostHog(ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, {\n      host: ANALYTICS_HOST_URL,\n      flushAt: 1,\n      flushInterval: 0,\n      enableExceptionAutocapture: true,\n      before_send: (event) => {\n        if (!event) return event;\n        if (Object.keys(this.groups).length > 0) {\n          event.groups = { ...this.groups, ...event.groups };\n        }\n        // Autocaptured exceptions arrive with a random uuid and\n        // `$process_person_profile: false` — reattach the run's identity\n        // and tags so they land on the same person as everything else.\n        if (event.event === '$exception') {\n          event.distinctId = this.distinctId ?? this.anonymousId;\n          const { $process_person_profile, ...properties } =\n            event.properties ?? {};\n          void $process_person_profile;\n          event.properties = { ...this.tags, ...properties };\n        }\n        return event;\n      },\n    });\n\n    this.tags = { $app_name: this.appName };\n    // Tag every run with its build type so prod / dev / ci / headless segment\n    // cleanly in analytics. tsdown inlines IS_PRODUCTION_BUILD to `true` in\n    // published builds and `false` for dev/tsx/test runs. Non-interactive runs\n    // upgrade this in runWizardCI: dev `--ci` runs to 'ci', published headless\n    // runs to 'headless'.\n    this.tags.build = IS_PRODUCTION_BUILD ? 'prod' : 'dev';\n\n    this.anonymousId = uuidv4();\n\n    // One id per process = one id per wizard run, registered in the tag bag\n    // so it rides on every capture, exception, and autocaptured exception\n    // (all of which merge `this.tags`). Lets you separate two runs by the\n    // same logged-in user, who otherwise share one distinct id. Distinct\n    // from `anonymousId`, the pre-login *person* id that gets aliased onto\n    // the real user at login. `$session_id` is intentionally not set here —\n    // it stays null until OAuth completes (see identifyUser).\n    this._runId = uuidv4();\n    this.tags.run_id = this._runId;\n\n    this.distinctId = undefined;\n  }\n\n  /** Per-process run id, tagged on every event and gateway trace. */\n  get runId(): string {\n    return this._runId;\n  }\n\n  /** Build type for this run ('prod' | 'dev' | 'ci' | 'headless') — the same value tagged on every analytics event. */\n  get build(): string {\n    return String(this.tags.build ?? 'dev');\n  }\n\n  /**\n   * Associate the run with the logged-in user, once per id. Identifies them\n   * (email, name) and records those person properties so events carry them and\n   * feature flags can target the individual user — without the email here the\n   * wizard only sends `$app_name`, so email-targeted flags never match. Opens\n   * the analytics session on first login, then aliases the run's anonymous id\n   * onto the identified person so pre-login events merge in.\n   */\n  identifyUser(user: ApiUser) {\n    const distinctId = user.distinct_id;\n    if (this.distinctId === distinctId || distinctId === this.anonymousId) {\n      return;\n    }\n    this.distinctId = distinctId;\n    // Open the analytics session on first login. Null until here, so\n    // pre-OAuth events carry only `run_id`; from now on every event also\n    // carries `$session_id` and PostHog groups the authenticated run into a\n    // native Session. Stored in the tag bag so it rides on every subsequent\n    // capture and exception.\n    if (!this.sessionId) {\n      this.sessionId = uuidv4();\n      this.tags.$session_id = this.sessionId;\n    }\n    const props: Record<string, string> = {};\n    if (user.email) props.email = user.email;\n    const name = [user.first_name, user.last_name]\n      .filter(Boolean)\n      .join(' ')\n      .trim();\n    if (name) props.name = name;\n    this.personProperties = props;\n    this.client.identify({ distinctId, properties: { $set: props } });\n    this.client.alias({\n      distinctId,\n      alias: this.anonymousId,\n    });\n    // The flag snapshot is per identity. Anything evaluated before login (the\n    // intro screen reads the tools-menu flag) was anonymous — drop it so the\n    // next read re-evaluates as this user.\n    this.activeFlags = null;\n  }\n\n  /** Person properties sent with flag evaluation: app name plus the user's. */\n  private flagPersonProperties(): Record<string, string> {\n    return { $app_name: this.appName, ...this.personProperties };\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  setGroups(groups: Record<string, string>) {\n    this.groups = groups;\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    this.client.captureException(error, this.distinctId ?? this.anonymousId, {\n      team: ANALYTICS_TEAM_TAG,\n      ...this.tags,\n      ...properties,\n    });\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: eventName,\n      properties: {\n        ...this.tags,\n        ...properties,\n      },\n    });\n  }\n\n  /**\n   * Capture a wizard-specific event. Automatically prepends \"wizard: \" to the event name.\n   * All new wizard analytics should use this method instead of capture() directly.\n   */\n  wizardCapture(eventName: string, properties?: Record<string, unknown>): void {\n    this.capture(`wizard: ${eventName}`, properties);\n  }\n\n  /**\n   * Flush pending events without firing the \"setup wizard finished\" terminal\n   * event. Use this from CLI error paths that exit before any wizard run\n   * starts — `shutdown()` would inflate the run count with a \"finished\" event\n   * for a parse error that never actually ran the wizard.\n   */\n  async flush(): Promise<void> {\n    await this.client.shutdown();\n  }\n\n  async getFeatureFlag(flagKey: string): Promise<string | boolean | undefined> {\n    try {\n      const distinctId = this.distinctId ?? this.anonymousId;\n      return await this.client.getFeatureFlag(flagKey, distinctId, {\n        sendFeatureFlagEvents: true,\n        personProperties: this.flagPersonProperties(),\n      });\n    } catch (error) {\n      debug('Failed to get feature flag:', flagKey, error);\n      return undefined;\n    }\n  }\n\n  /**\n   * Evaluate all feature flags for the current user at the start of a run.\n   * Result is cached; subsequent calls in the same run return the same map.\n   * Returns flag key -> string value (booleans become 'true'/'false').\n   */\n  async getAllFlagsForWizard(): Promise<Record<string, string>> {\n    if (this.activeFlags !== null) {\n      return this.activeFlags;\n    }\n    const out: Record<string, string> = {};\n    try {\n      const distinctId = this.distinctId ?? this.anonymousId;\n      logToFile('[flags] evaluating as', {\n        distinctId,\n        identified: this.distinctId !== undefined,\n        personProperties: this.flagPersonProperties(),\n      });\n      const result = await this.client.getAllFlagsAndPayloads(distinctId, {\n        personProperties: this.flagPersonProperties(),\n      });\n      const flags = result.featureFlags ?? {};\n      for (const [key, value] of Object.entries(flags)) {\n        if (value === undefined) continue;\n        out[key] = typeof value === 'boolean' ? String(value) : String(value);\n      }\n    } catch (error) {\n      debug('Failed to get all feature flags:', error);\n      this.captureException(\n        error instanceof Error ? error : new Error(String(error)),\n        { step: 'get_all_flags' },\n      );\n    }\n    // Outside the fetch guard on purpose: a malformed CI override must fail\n    // the run loudly, and a valid one applies even when the fetch failed —\n    // CI routing stays deterministic either way.\n    this.activeFlags = applyCiFlagOverrides(out);\n    logToFile('[flags] evaluated', this.activeFlags);\n    return this.activeFlags;\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (Object.keys(this.tags).length === 0) {\n      return;\n    }\n\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: 'setup wizard finished',\n      properties: {\n        // Flat for filtering; the nested `tags` snapshot stays for back-compat.\n        ...this.tags,\n        run_id: this._runId,\n        ...(this.sessionId ? { $session_id: this.sessionId } : {}),\n        status,\n        tags: this.tags,\n      },\n    });\n\n    await this.client.shutdown();\n  }\n}\n\nexport const analytics = new Analytics();\n"],"mappings":";;;;AAkBA,SAAgB,qBACd,OACwB;AAImB,QAAO;;;;;;;;;AA+BpD,SAAgB,sBAAyC;AACZ,QAAO,EAAE;;;;;;;;ACvCtD,SAAgB,kBACd,SACyB;AACzB,QAAO;EACL,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,YAAY,QAAQ;EACpB,YAAY,QAAQ,aAAa;EACjC,qBAAqB,QAAQ;EAC7B,qBAAqB,QAAQ;EAC7B,WAAW,QAAQ;EACpB;;AAGH,SAAgB,eACd,MACA,MACwB;CACxB,MAAM,SAAiC,EAAE,UAAU,MAAM;AACzD,KAAI,CAAC,KAAM,QAAO;CAElB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,KAAI,eAAgB,QAAO,eAAe;CAE1C,MAAM,aAAa,KAAK,cAAc;AACtC,KAAI,WAAY,QAAO,WAAW;CAElC,MAAM,cAAc,KAAK,MAAM;AAC/B,KAAI,YAAa,QAAO,UAAU;AAElC,QAAO;;AAGT,IAAa,YAAb,MAAuB;CACrB;CACA,OACE,EAAE;CACJ;CACA;CACA;CACA,YAAmC;CACnC,UAAkB;CAClB,cAAqD;CACrD,SAAyC,EAAE;CAC3C,mBAAmD,EAAE;CAErD,cAAc;AACZ,OAAK,SAAS,IAAI,QAAQ,4CAA4C;GACpE,MAAM;GACN,SAAS;GACT,eAAe;GACf,4BAA4B;GAC5B,cAAc,UAAU;AACtB,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,OAAO,KAAK,KAAK,OAAO,CAAC,SAAS,EACpC,OAAM,SAAS;KAAE,GAAG,KAAK;KAAQ,GAAG,MAAM;KAAQ;AAKpD,QAAI,MAAM,UAAU,cAAc;AAChC,WAAM,aAAa,KAAK,cAAc,KAAK;KAC3C,MAAM,EAAE,yBAAyB,GAAG,eAClC,MAAM,cAAc,EAAE;AAExB,WAAM,aAAa;MAAE,GAAG,KAAK;MAAM,GAAG;MAAY;;AAEpD,WAAO;;GAEV,CAAC;AAEF,OAAK,OAAO,EAAE,WAAW,KAAK,SAAS;AAMvC,OAAK,KAAK,QAA8B;AAExC,OAAK,cAAcA,IAAQ;AAS3B,OAAK,SAASA,IAAQ;AACtB,OAAK,KAAK,SAAS,KAAK;AAExB,OAAK,aAAa,KAAA;;;CAIpB,IAAI,QAAgB;AAClB,SAAO,KAAK;;;CAId,IAAI,QAAgB;AAClB,SAAO,OAAO,KAAK,KAAK,SAAS,MAAM;;;;;;;;;;CAWzC,aAAa,MAAe;EAC1B,MAAM,aAAa,KAAK;AACxB,MAAI,KAAK,eAAe,cAAc,eAAe,KAAK,YACxD;AAEF,OAAK,aAAa;AAMlB,MAAI,CAAC,KAAK,WAAW;AACnB,QAAK,YAAYA,IAAQ;AACzB,QAAK,KAAK,cAAc,KAAK;;EAE/B,MAAM,QAAgC,EAAE;AACxC,MAAI,KAAK,MAAO,OAAM,QAAQ,KAAK;EACnC,MAAM,OAAO,CAAC,KAAK,YAAY,KAAK,UAAU,CAC3C,OAAO,QAAQ,CACf,KAAK,IAAI,CACT,MAAM;AACT,MAAI,KAAM,OAAM,OAAO;AACvB,OAAK,mBAAmB;AACxB,OAAK,OAAO,SAAS;GAAE;GAAY,YAAY,EAAE,MAAM,OAAO;GAAE,CAAC;AACjE,OAAK,OAAO,MAAM;GAChB;GACA,OAAO,KAAK;GACb,CAAC;AAIF,OAAK,cAAc;;;CAIrB,uBAAuD;AACrD,SAAO;GAAE,WAAW,KAAK;GAAS,GAAG,KAAK;GAAkB;;CAG9D,OAAO,KAAa,OAAqD;AACvE,OAAK,KAAK,OAAO;;CAGnB,UAAU,QAAgC;AACxC,OAAK,SAAS;;CAGhB,iBAAiB,OAAc,aAAsC,EAAE,EAAE;AACvE,OAAK,OAAO,iBAAiB,OAAO,KAAK,cAAc,KAAK,aAAa;GACvE,MAAM;GACN,GAAG,KAAK;GACR,GAAG;GACJ,CAAC;;CAGJ,QAAQ,WAAmB,YAAsC;AAC/D,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IACV,GAAG,KAAK;IACR,GAAG;IACJ;GACF,CAAC;;;;;;CAOJ,cAAc,WAAmB,YAA4C;AAC3E,OAAK,QAAQ,WAAW,aAAa,WAAW;;;;;;;;CASlD,MAAM,QAAuB;AAC3B,QAAM,KAAK,OAAO,UAAU;;CAG9B,MAAM,eAAe,SAAwD;AAC3E,MAAI;GACF,MAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,UAAO,MAAM,KAAK,OAAO,eAAe,SAAS,YAAY;IAC3D,uBAAuB;IACvB,kBAAkB,KAAK,sBAAsB;IAC9C,CAAC;WACK,OAAO;AACd,SAAM,+BAA+B,SAAS,MAAM;AACpD;;;;;;;;CASJ,MAAM,uBAAwD;AAC5D,MAAI,KAAK,gBAAgB,KACvB,QAAO,KAAK;EAEd,MAAM,MAA8B,EAAE;AACtC,MAAI;GACF,MAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,aAAU,yBAAyB;IACjC;IACA,YAAY,KAAK,eAAe,KAAA;IAChC,kBAAkB,KAAK,sBAAsB;IAC9C,CAAC;GAIF,MAAM,SAHS,MAAM,KAAK,OAAO,uBAAuB,YAAY,EAClE,kBAAkB,KAAK,sBAAsB,EAC9C,CAAC,EACmB,gBAAgB,EAAE;AACvC,QAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,EAAE;AAChD,QAAI,UAAU,KAAA,EAAW;AACzB,QAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,GAAG,OAAO,MAAM;;WAEhE,OAAO;AACd,SAAM,oCAAoC,MAAM;AAChD,QAAK,iBACH,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD,EAAE,MAAM,iBAAiB,CAC1B;;AAKH,OAAK,cAAc,qBAAqB,IAAI;AAC5C,YAAU,qBAAqB,KAAK,YAAY;AAChD,SAAO,KAAK;;CAGd,MAAM,SAAS,QAA2C;AACxD,MAAI,OAAO,KAAK,KAAK,KAAK,CAAC,WAAW,EACpC;AAGF,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IAEV,GAAG,KAAK;IACR,QAAQ,KAAK;IACb,GAAI,KAAK,YAAY,EAAE,aAAa,KAAK,WAAW,GAAG,EAAE;IACzD;IACA,MAAM,KAAK;IACZ;GACF,CAAC;AAEF,QAAM,KAAK,OAAO,UAAU;;;AAIhC,MAAa,YAAY,IAAI,WAAW"}
+{"version":3,"file":"analytics-Ciob-x8a.js","names":["uuidv4"],"sources":["../src/utils/ci-flag-overrides.ts","../src/utils/analytics.ts"],"sourcesContent":["/**\n * CI-only feature-flag overrides.\n *\n * CI must route deterministically: a run that tests the orchestrator arm says\n * so explicitly instead of depending on a live feature flag someone can edit\n * mid-week. The override env var (see the allowlist in `env.ts`) is a JSON\n * object of flag key → value, merged over whatever PostHog returned.\n *\n * The override path exists only in CI builds (`pnpm build:ci`). Published\n * builds inline NODE_ENV as the literal \"production\", the guards collapse,\n * and tsdown strips the rest from the bundle — and the smoke test asserts the\n * env var names are physically absent from production output (which is also\n * why no comment in this file may spell them out), so this can never quietly\n * become a production surface.\n */\nimport { runtimeEnv } from '@env';\nimport { logToFile } from './debug';\n\nexport function applyCiFlagOverrides(\n  flags: Record<string, string>,\n): Record<string, string> {\n  // Compared inline (not via env.ts's IS_PRODUCTION_BUILD) so tsdown replaces\n  // it with a literal right here and the bundler can prove the rest of this\n  // function unreachable in production builds. The smoke test enforces that.\n  if (process.env.NODE_ENV === 'production') return flags;\n\n  const raw = runtimeEnv('WIZARD_CI_FLAG_OVERRIDES');\n  if (!raw) return flags;\n\n  let overrides: Record<string, unknown>;\n  try {\n    overrides = JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    // A malformed override is a CI misconfiguration. Fail the run loudly\n    // rather than silently testing whatever the live flags happen to say.\n    throw new Error(\n      'The CI flag-override env var is not valid JSON (expected {\"flag-key\": value, ...}).',\n    );\n  }\n\n  const merged = { ...flags };\n  for (const [key, value] of Object.entries(overrides)) {\n    merged[key] = String(value);\n  }\n  logToFile('[flags] CI overrides applied', overrides);\n  return merged;\n}\n\n/**\n * Task types excluded from this run. The exclusion env var (see the allowlist\n * in `env.ts`) is a comma-separated list (e.g. `dashboard`), set by the CI\n * harness that owns the policy — the wizard and the served content stay\n * run-mode agnostic. CI-build only, same as the flag overrides: published\n * builds strip this path.\n */\nexport function ciExcludedTaskTypes(): readonly string[] {\n  if (process.env.NODE_ENV === 'production') return [];\n\n  const raw = runtimeEnv('WIZARD_CI_EXCLUDE_TASKS');\n  if (!raw) return [];\n  const types = raw\n    .split(',')\n    .map((t) => t.trim())\n    .filter(Boolean);\n  if (types.length > 0) logToFile('[flags] CI task exclusions', types);\n  return types;\n}\n","import { PostHog } from 'posthog-node';\nimport {\n  ANALYTICS_HOST_URL,\n  ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY,\n  ANALYTICS_TEAM_TAG,\n} from '@lib/constants';\nimport type { WizardSession } from '@lib/wizard-session';\nimport type { ApiUser } from '@lib/api';\nimport { v4 as uuidv4 } from 'uuid';\nimport { IS_PRODUCTION_BUILD } from '@env';\nimport { debug, logToFile } from './debug';\nimport { applyCiFlagOverrides } from './ci-flag-overrides';\n\n/**\n * Extract a standard property bag from the current session.\n * Used by store-level analytics and available for ad-hoc captures.\n */\nexport function sessionProperties(\n  session: WizardSession,\n): Record<string, unknown> {\n  return {\n    integration: session.integration,\n    detected_framework: session.detectedFrameworkLabel,\n    typescript: session.typescript,\n    project_id: session.credentials?.projectId,\n    discovered_features: session.discoveredFeatures,\n    additional_features: session.additionalFeatureQueue,\n    run_phase: session.runPhase,\n  };\n}\n\nexport function groupsFromUser(\n  user: ApiUser | null,\n  host: string,\n): Record<string, string> {\n  const groups: Record<string, string> = { instance: host };\n  if (!user) return groups;\n\n  const organizationId = user.organization?.id;\n  if (organizationId) groups.organization = organizationId;\n\n  const customerId = user.organization?.customer_id;\n  if (customerId) groups.customer = customerId;\n\n  const projectUuid = user.team?.uuid;\n  if (projectUuid) groups.project = projectUuid;\n\n  return groups;\n}\n\nexport class Analytics {\n  private client: PostHog;\n  private tags: Record<string, string | boolean | number | null | undefined> =\n    {};\n  private distinctId?: string;\n  private anonymousId: string;\n  private _runId: string;\n  private sessionId: string | null = null;\n  private appName = 'wizard';\n  private activeFlags: Record<string, string> | null = null;\n  private groups: Record<string, string> = {};\n  private personProperties: Record<string, string> = {};\n\n  constructor() {\n    this.client = new PostHog(ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, {\n      host: ANALYTICS_HOST_URL,\n      flushAt: 1,\n      flushInterval: 0,\n      enableExceptionAutocapture: true,\n      before_send: (event) => {\n        if (!event) return event;\n        if (Object.keys(this.groups).length > 0) {\n          event.groups = { ...this.groups, ...event.groups };\n        }\n        // Autocaptured exceptions arrive with a random uuid and\n        // `$process_person_profile: false` — reattach the run's identity\n        // and tags so they land on the same person as everything else.\n        if (event.event === '$exception') {\n          event.distinctId = this.distinctId ?? this.anonymousId;\n          const { $process_person_profile, ...properties } =\n            event.properties ?? {};\n          void $process_person_profile;\n          event.properties = { ...this.tags, ...properties };\n        }\n        return event;\n      },\n    });\n\n    this.tags = { $app_name: this.appName };\n    // Tag every run with its build type so prod / dev / ci / headless segment\n    // cleanly in analytics. tsdown inlines IS_PRODUCTION_BUILD to `true` in\n    // published builds and `false` for dev/tsx/test runs. Non-interactive runs\n    // upgrade this in runWizardCI: dev `--ci` runs to 'ci', published headless\n    // runs to 'headless'.\n    this.tags.build = IS_PRODUCTION_BUILD ? 'prod' : 'dev';\n\n    this.anonymousId = uuidv4();\n\n    // One id per process = one id per wizard run, registered in the tag bag\n    // so it rides on every capture, exception, and autocaptured exception\n    // (all of which merge `this.tags`). Lets you separate two runs by the\n    // same logged-in user, who otherwise share one distinct id. Distinct\n    // from `anonymousId`, the pre-login *person* id that gets aliased onto\n    // the real user at login. `$session_id` is intentionally not set here —\n    // it stays null until OAuth completes (see identifyUser).\n    this._runId = uuidv4();\n    this.tags.run_id = this._runId;\n\n    this.distinctId = undefined;\n  }\n\n  /** Per-process run id, tagged on every event and gateway trace. */\n  get runId(): string {\n    return this._runId;\n  }\n\n  /** Build type for this run ('prod' | 'dev' | 'ci' | 'headless') — the same value tagged on every analytics event. */\n  get build(): string {\n    return String(this.tags.build ?? 'dev');\n  }\n\n  /**\n   * Associate the run with the logged-in user, once per id. Identifies them\n   * (email, name) and records those person properties so events carry them and\n   * feature flags can target the individual user — without the email here the\n   * wizard only sends `$app_name`, so email-targeted flags never match. Opens\n   * the analytics session on first login, then aliases the run's anonymous id\n   * onto the identified person so pre-login events merge in.\n   */\n  identifyUser(user: ApiUser) {\n    const distinctId = user.distinct_id;\n    if (this.distinctId === distinctId || distinctId === this.anonymousId) {\n      return;\n    }\n    this.distinctId = distinctId;\n    // Open the analytics session on first login. Null until here, so\n    // pre-OAuth events carry only `run_id`; from now on every event also\n    // carries `$session_id` and PostHog groups the authenticated run into a\n    // native Session. Stored in the tag bag so it rides on every subsequent\n    // capture and exception.\n    if (!this.sessionId) {\n      this.sessionId = uuidv4();\n      this.tags.$session_id = this.sessionId;\n    }\n    const props: Record<string, string> = {};\n    if (user.email) props.email = user.email;\n    const name = [user.first_name, user.last_name]\n      .filter(Boolean)\n      .join(' ')\n      .trim();\n    if (name) props.name = name;\n    this.personProperties = props;\n    this.client.identify({ distinctId, properties: { $set: props } });\n    this.client.alias({\n      distinctId,\n      alias: this.anonymousId,\n    });\n    // The flag snapshot is per identity. Anything evaluated before login (the\n    // intro screen reads the tools-menu flag) was anonymous — drop it so the\n    // next read re-evaluates as this user.\n    this.activeFlags = null;\n  }\n\n  /** Person properties sent with flag evaluation: app name plus the user's. */\n  private flagPersonProperties(): Record<string, string> {\n    return { $app_name: this.appName, ...this.personProperties };\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  setGroups(groups: Record<string, string>) {\n    this.groups = groups;\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    this.client.captureException(error, this.distinctId ?? this.anonymousId, {\n      team: ANALYTICS_TEAM_TAG,\n      ...this.tags,\n      ...properties,\n    });\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: eventName,\n      properties: {\n        ...this.tags,\n        ...properties,\n      },\n    });\n  }\n\n  /**\n   * Capture a wizard-specific event. Automatically prepends \"wizard: \" to the event name.\n   * All new wizard analytics should use this method instead of capture() directly.\n   */\n  wizardCapture(eventName: string, properties?: Record<string, unknown>): void {\n    this.capture(`wizard: ${eventName}`, properties);\n  }\n\n  /**\n   * Flush pending events without firing the \"setup wizard finished\" terminal\n   * event. Use this from CLI error paths that exit before any wizard run\n   * starts — `shutdown()` would inflate the run count with a \"finished\" event\n   * for a parse error that never actually ran the wizard.\n   */\n  async flush(): Promise<void> {\n    await this.client.shutdown();\n  }\n\n  async getFeatureFlag(flagKey: string): Promise<string | boolean | undefined> {\n    try {\n      const distinctId = this.distinctId ?? this.anonymousId;\n      return await this.client.getFeatureFlag(flagKey, distinctId, {\n        sendFeatureFlagEvents: true,\n        personProperties: this.flagPersonProperties(),\n      });\n    } catch (error) {\n      debug('Failed to get feature flag:', flagKey, error);\n      return undefined;\n    }\n  }\n\n  /**\n   * Evaluate all feature flags for the current user at the start of a run.\n   * Result is cached; subsequent calls in the same run return the same map.\n   * Returns flag key -> string value (booleans become 'true'/'false').\n   */\n  async getAllFlagsForWizard(): Promise<Record<string, string>> {\n    if (this.activeFlags !== null) {\n      return this.activeFlags;\n    }\n    const out: Record<string, string> = {};\n    try {\n      const distinctId = this.distinctId ?? this.anonymousId;\n      logToFile('[flags] evaluating as', {\n        distinctId,\n        identified: this.distinctId !== undefined,\n        personProperties: this.flagPersonProperties(),\n      });\n      const result = await this.client.getAllFlagsAndPayloads(distinctId, {\n        personProperties: this.flagPersonProperties(),\n      });\n      const flags = result.featureFlags ?? {};\n      for (const [key, value] of Object.entries(flags)) {\n        if (value === undefined) continue;\n        out[key] = typeof value === 'boolean' ? String(value) : String(value);\n      }\n    } catch (error) {\n      debug('Failed to get all feature flags:', error);\n      this.captureException(\n        error instanceof Error ? error : new Error(String(error)),\n        { step: 'get_all_flags' },\n      );\n    }\n    // Outside the fetch guard on purpose: a malformed CI override must fail\n    // the run loudly, and a valid one applies even when the fetch failed —\n    // CI routing stays deterministic either way.\n    this.activeFlags = applyCiFlagOverrides(out);\n    logToFile('[flags] evaluated', this.activeFlags);\n    return this.activeFlags;\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (Object.keys(this.tags).length === 0) {\n      return;\n    }\n\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: 'setup wizard finished',\n      properties: {\n        // Flat for filtering; the nested `tags` snapshot stays for back-compat.\n        ...this.tags,\n        run_id: this._runId,\n        ...(this.sessionId ? { $session_id: this.sessionId } : {}),\n        status,\n        tags: this.tags,\n      },\n    });\n\n    await this.client.shutdown();\n  }\n}\n\nexport const analytics = new Analytics();\n"],"mappings":";;;;AAkBA,SAAgB,qBACd,OACwB;AAImB,QAAO;;;;;;;;;AA+BpD,SAAgB,sBAAyC;AACZ,QAAO,EAAE;;;;;;;;ACvCtD,SAAgB,kBACd,SACyB;AACzB,QAAO;EACL,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,YAAY,QAAQ;EACpB,YAAY,QAAQ,aAAa;EACjC,qBAAqB,QAAQ;EAC7B,qBAAqB,QAAQ;EAC7B,WAAW,QAAQ;EACpB;;AAGH,SAAgB,eACd,MACA,MACwB;CACxB,MAAM,SAAiC,EAAE,UAAU,MAAM;AACzD,KAAI,CAAC,KAAM,QAAO;CAElB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,KAAI,eAAgB,QAAO,eAAe;CAE1C,MAAM,aAAa,KAAK,cAAc;AACtC,KAAI,WAAY,QAAO,WAAW;CAElC,MAAM,cAAc,KAAK,MAAM;AAC/B,KAAI,YAAa,QAAO,UAAU;AAElC,QAAO;;AAGT,IAAa,YAAb,MAAuB;CACrB;CACA,OACE,EAAE;CACJ;CACA;CACA;CACA,YAAmC;CACnC,UAAkB;CAClB,cAAqD;CACrD,SAAyC,EAAE;CAC3C,mBAAmD,EAAE;CAErD,cAAc;AACZ,OAAK,SAAS,IAAI,QAAQ,4CAA4C;GACpE,MAAM;GACN,SAAS;GACT,eAAe;GACf,4BAA4B;GAC5B,cAAc,UAAU;AACtB,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,OAAO,KAAK,KAAK,OAAO,CAAC,SAAS,EACpC,OAAM,SAAS;KAAE,GAAG,KAAK;KAAQ,GAAG,MAAM;KAAQ;AAKpD,QAAI,MAAM,UAAU,cAAc;AAChC,WAAM,aAAa,KAAK,cAAc,KAAK;KAC3C,MAAM,EAAE,yBAAyB,GAAG,eAClC,MAAM,cAAc,EAAE;AAExB,WAAM,aAAa;MAAE,GAAG,KAAK;MAAM,GAAG;MAAY;;AAEpD,WAAO;;GAEV,CAAC;AAEF,OAAK,OAAO,EAAE,WAAW,KAAK,SAAS;AAMvC,OAAK,KAAK,QAA8B;AAExC,OAAK,cAAcA,IAAQ;AAS3B,OAAK,SAASA,IAAQ;AACtB,OAAK,KAAK,SAAS,KAAK;AAExB,OAAK,aAAa,KAAA;;;CAIpB,IAAI,QAAgB;AAClB,SAAO,KAAK;;;CAId,IAAI,QAAgB;AAClB,SAAO,OAAO,KAAK,KAAK,SAAS,MAAM;;;;;;;;;;CAWzC,aAAa,MAAe;EAC1B,MAAM,aAAa,KAAK;AACxB,MAAI,KAAK,eAAe,cAAc,eAAe,KAAK,YACxD;AAEF,OAAK,aAAa;AAMlB,MAAI,CAAC,KAAK,WAAW;AACnB,QAAK,YAAYA,IAAQ;AACzB,QAAK,KAAK,cAAc,KAAK;;EAE/B,MAAM,QAAgC,EAAE;AACxC,MAAI,KAAK,MAAO,OAAM,QAAQ,KAAK;EACnC,MAAM,OAAO,CAAC,KAAK,YAAY,KAAK,UAAU,CAC3C,OAAO,QAAQ,CACf,KAAK,IAAI,CACT,MAAM;AACT,MAAI,KAAM,OAAM,OAAO;AACvB,OAAK,mBAAmB;AACxB,OAAK,OAAO,SAAS;GAAE;GAAY,YAAY,EAAE,MAAM,OAAO;GAAE,CAAC;AACjE,OAAK,OAAO,MAAM;GAChB;GACA,OAAO,KAAK;GACb,CAAC;AAIF,OAAK,cAAc;;;CAIrB,uBAAuD;AACrD,SAAO;GAAE,WAAW,KAAK;GAAS,GAAG,KAAK;GAAkB;;CAG9D,OAAO,KAAa,OAAqD;AACvE,OAAK,KAAK,OAAO;;CAGnB,UAAU,QAAgC;AACxC,OAAK,SAAS;;CAGhB,iBAAiB,OAAc,aAAsC,EAAE,EAAE;AACvE,OAAK,OAAO,iBAAiB,OAAO,KAAK,cAAc,KAAK,aAAa;GACvE,MAAM;GACN,GAAG,KAAK;GACR,GAAG;GACJ,CAAC;;CAGJ,QAAQ,WAAmB,YAAsC;AAC/D,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IACV,GAAG,KAAK;IACR,GAAG;IACJ;GACF,CAAC;;;;;;CAOJ,cAAc,WAAmB,YAA4C;AAC3E,OAAK,QAAQ,WAAW,aAAa,WAAW;;;;;;;;CASlD,MAAM,QAAuB;AAC3B,QAAM,KAAK,OAAO,UAAU;;CAG9B,MAAM,eAAe,SAAwD;AAC3E,MAAI;GACF,MAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,UAAO,MAAM,KAAK,OAAO,eAAe,SAAS,YAAY;IAC3D,uBAAuB;IACvB,kBAAkB,KAAK,sBAAsB;IAC9C,CAAC;WACK,OAAO;AACd,SAAM,+BAA+B,SAAS,MAAM;AACpD;;;;;;;;CASJ,MAAM,uBAAwD;AAC5D,MAAI,KAAK,gBAAgB,KACvB,QAAO,KAAK;EAEd,MAAM,MAA8B,EAAE;AACtC,MAAI;GACF,MAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,aAAU,yBAAyB;IACjC;IACA,YAAY,KAAK,eAAe,KAAA;IAChC,kBAAkB,KAAK,sBAAsB;IAC9C,CAAC;GAIF,MAAM,SAHS,MAAM,KAAK,OAAO,uBAAuB,YAAY,EAClE,kBAAkB,KAAK,sBAAsB,EAC9C,CAAC,EACmB,gBAAgB,EAAE;AACvC,QAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,EAAE;AAChD,QAAI,UAAU,KAAA,EAAW;AACzB,QAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,GAAG,OAAO,MAAM;;WAEhE,OAAO;AACd,SAAM,oCAAoC,MAAM;AAChD,QAAK,iBACH,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD,EAAE,MAAM,iBAAiB,CAC1B;;AAKH,OAAK,cAAc,qBAAqB,IAAI;AAC5C,YAAU,qBAAqB,KAAK,YAAY;AAChD,SAAO,KAAK;;CAGd,MAAM,SAAS,QAA2C;AACxD,MAAI,OAAO,KAAK,KAAK,KAAK,CAAC,WAAW,EACpC;AAGF,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IAEV,GAAG,KAAK;IACR,QAAQ,KAAK;IACb,GAAI,KAAK,YAAY,EAAE,aAAa,KAAK,WAAW,GAAG,EAAE;IACzD;IACA,MAAM,KAAK;IACZ;GACF,CAAC;AAEF,QAAM,KAAK,OAAO,UAAU;;;AAIhC,MAAa,YAAY,IAAI,WAAW"}

package/dist/analytics-DbfiRvPS.js

@@ -0,0 +1,2 @@
+import { n as analytics } from "./analytics-Ciob-x8a.js";
+export { analytics };

package/dist/{api-CyA47qug.js → api-T_WHs3qZ.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";
-import { ct as WIZARD_USER_AGENT } from "./debug-CgdI7Rd-.js";
-import { t as analytics } from "./analytics-CvIK_07d.js";
+import { st as WIZARD_USER_AGENT } from "./debug-D1lORUFs.js";
+import { n as analytics } from "./analytics-Ciob-x8a.js";
 import axios from "axios";
 import { z } from "zod";
 //#region src/lib/api.ts
@@ -170,4 +170,4 @@ function handleApiError(error, operation) {
 //#endregion
 export { fetchUserData as a, fetchSlackConnected as i, api_exports as n, handleApiError as o, fetchProjectData as r, ApiError as t };
 
-//# sourceMappingURL=api-CyA47qug.js.map
+//# sourceMappingURL=api-T_WHs3qZ.js.map

package/dist/{api-CyA47qug.js.map → api-T_WHs3qZ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"api-CyA47qug.js","names":[],"sources":["../src/lib/api.ts"],"sourcesContent":["import axios, { AxiosError } from 'axios';\nimport { z } from 'zod';\nimport { analytics } from '@utils/analytics';\nimport { WIZARD_USER_AGENT } from './constants';\n\n/**\n * User payload from `/api/users/@me/`. Schema typed for the fields the\n * wizard actually reads + passthrough on everything else so the full\n * upstream response rides through to the session for downstream features\n * (account-aware copy, plan-gated flows, org/team metadata, etc.).\n *\n * Top-level uses `.passthrough()` so unknown fields aren't stripped;\n * the few nested objects we care about (team, organization,\n * organizations[]) do the same so their additional fields survive too.\n *\n * Keep `distinct_id` required — analytics depends on it. Everything\n * else added here is nullish so partial responses don't fail parsing.\n */\nexport const ApiUserSchema = z\n  .object({\n    // Identifiers\n    distinct_id: z.string(),\n    uuid: z.string().nullish(),\n    id: z.number().nullish(),\n\n    // Profile\n    email: z.string().nullish(),\n    first_name: z.string().nullish(),\n    last_name: z.string().nullish(),\n    date_joined: z.string().nullish(),\n    is_email_verified: z.boolean().nullish(),\n    is_2fa_enabled: z.boolean().nullish(),\n    is_staff: z.boolean().nullish(),\n\n    // Preferences\n    theme_mode: z.string().nullish(),\n    toolbar_mode: z.string().nullish(),\n    hide_mcp_hints: z.boolean().nullish(),\n\n    // Optional / nullable on the backend — pre-onboarding signup paths\n    // return null and older accounts may not have it set. Treat as a\n    // hint, never a guarantee.\n    role_at_organization: z.string().nullish(),\n\n    // Current team + organization (objects from the API, kept typed on\n    // the fields the wizard uses; passthrough preserves the rest).\n    team: z\n      .object({\n        id: z.number(),\n        uuid: z.string().nullish(),\n        organization: z.string().uuid(),\n        api_token: z.string().nullish(),\n        project_id: z.number().nullish(),\n        name: z.string().nullish(),\n        timezone: z.string().nullish(),\n      })\n      .passthrough(),\n    organization: z\n      .object({\n        id: z.string().uuid(),\n        name: z.string().nullish(),\n        slug: z.string().nullish(),\n        membership_level: z.number().nullish(),\n        customer_id: z.string().nullish(),\n        // Org-level AI consent gate. Signals drops all findings while\n        // this is not true. Null on older orgs (pre-2026-05 default\n        // flip) — treat null as \"unknown\", not \"off\".\n        is_ai_data_processing_approved: z.boolean().nullish(),\n      })\n      .passthrough(),\n    organizations: z.array(\n      z\n        .object({\n          id: z.string().uuid(),\n          name: z.string().nullish(),\n          membership_level: z.number().nullish(),\n        })\n        .passthrough(),\n    ),\n  })\n  .passthrough();\n\n/**\n * Single activity log entry the wizard cares about. The PostHog endpoint\n * returns much more — schema kept minimal so changes upstream don't break us.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling. Deliberately retained: this is a thin,\n * well-typed wrapper around a stable PostHog endpoint, and we're likely\n * to want it again for a future feature (e.g. \"what changed in your\n * project recently\"). Re-deriving the schema is more work than letting\n * it sit dormant.\n */\nexport const ActivityLogEntrySchema = z\n  .object({\n    scope: z.string().nullish(),\n    activity: z.string().nullish(),\n    created_at: z.string().nullish(),\n  })\n  .passthrough();\n\n/** @unused — see ActivityLogEntrySchema. */\nexport const ActivityLogResponseSchema = z.object({\n  results: z.array(ActivityLogEntrySchema),\n});\n\n/** @unused — see ActivityLogEntrySchema. */\nexport type ActivityLogEntry = z.infer<typeof ActivityLogEntrySchema>;\n\nexport const ApiProjectSchema = z.object({\n  id: z.number(),\n  uuid: z.string().uuid(),\n  organization: z.string().uuid(),\n  api_token: z.string(),\n  name: z.string(),\n  // Product opt-ins (TeamSerializer-compat fields on /api/projects/:id).\n  // Project-level truth for \"is this product enabled\" — a product can be\n  // instrumented from another repo or the snippet, so these settings\n  // override repo-local evidence. Null/absent = unknown. Only the\n  // opt-ins a signals decision consumes: replay + exception autocapture\n  // feed signal-source choices; surveys feeds the surveys-scout tuning.\n  session_recording_opt_in: z.boolean().nullish(),\n  autocapture_exceptions_opt_in: z.boolean().nullish(),\n  surveys_opt_in: z.boolean().nullish(),\n});\n\nexport type ApiUser = z.infer<typeof ApiUserSchema>;\nexport type ApiProject = z.infer<typeof ApiProjectSchema>;\n\nexport class ApiError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode?: number,\n    public readonly endpoint?: string,\n  ) {\n    super(message);\n    this.name = 'ApiError';\n  }\n}\n\nexport async function fetchUserData(\n  accessToken: string,\n  baseUrl: string,\n): Promise<ApiUser> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/users/@me/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiUserSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch user data');\n    analytics.captureException(apiError, {\n      endpoint: '/api/users/@me/',\n      baseUrl,\n    });\n    throw apiError;\n  }\n}\n\n/**\n * Best-effort fetch of recent activity log entries. Returns [] on any error\n * so callers can treat absence of results as \"haven't detected anything yet\"\n * rather than a hard failure.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling from McpSuggestedPromptsScreen.\n * Deliberately retained for future features that want a soft signal of\n * recent project changes (e.g. dashboards, audit summaries). See the\n * ActivityLogEntrySchema doc comment for the keep-vs-delete rationale.\n */\nexport async function fetchRecentActivity(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  since: Date,\n): Promise<ActivityLogEntry[]> {\n  try {\n    const response = await axios.get(\n      `${baseUrl}/api/projects/${projectId}/activity_log/`,\n      {\n        params: { limit: 10 },\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          'User-Agent': WIZARD_USER_AGENT,\n        },\n        // Short timeout — best-effort probe, not a critical path.\n        timeout: 4000,\n      },\n    );\n    const parsed = ActivityLogResponseSchema.safeParse(response.data);\n    if (!parsed.success) return [];\n    const sinceMs = since.getTime();\n    return parsed.data.results.filter((entry) => {\n      if (!entry.created_at) return false;\n      const t = Date.parse(entry.created_at);\n      return Number.isFinite(t) && t >= sinceMs;\n    });\n  } catch {\n    return [];\n  }\n}\n\nexport async function fetchProjectData(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n): Promise<ApiProject> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/projects/${projectId}/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiProjectSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch project data');\n    analytics.captureException(apiError, {\n      endpoint: `/api/projects/${projectId}/`,\n      baseUrl,\n      projectId,\n    });\n    throw apiError;\n  }\n}\n\n/** Minimal shape of `/api/projects/:id/integrations/` — we only read `kind`. */\nconst IntegrationsResponseSchema = z.object({\n  results: z.array(z.object({ kind: z.string().nullish() }).passthrough()),\n});\n\n/**\n * Check whether the project already has a Slack integration connected.\n * Requires the `integration:read` scope. Throws on failure — callers\n * (including the SlackConnectScreen poll) decide how to degrade and\n * are responsible for capturing the error exactly once.\n */\nexport async function fetchSlackConnected(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  signal?: AbortSignal,\n): Promise<boolean> {\n  const response = await axios.get(\n    `${baseUrl}/api/projects/${projectId}/integrations/`,\n    {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      signal,\n    },\n  );\n  const parsed = IntegrationsResponseSchema.safeParse(response.data);\n  if (!parsed.success) return false;\n  return parsed.data.results.some((i) => i.kind === 'slack');\n}\n\nexport function handleApiError(error: unknown, operation: string): ApiError {\n  if (axios.isAxiosError(error)) {\n    const axiosError = error as AxiosError<{ detail?: string }>;\n    const status = axiosError.response?.status;\n    const detail = axiosError.response?.data?.detail;\n    const endpoint = axiosError.config?.url;\n\n    if (status === 401) {\n      return new ApiError(\n        `Authentication failed while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 403) {\n      return new ApiError(\n        `Access denied while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 404) {\n      return new ApiError(\n        `Resource not found while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    const message = detail || `Failed to ${operation}`;\n    return new ApiError(message, status, endpoint);\n  }\n\n  if (error instanceof z.ZodError) {\n    return new ApiError(`Invalid response format while trying to ${operation}`);\n  }\n\n  return new ApiError(\n    `Unexpected error while trying to ${operation}: ${\n      error instanceof Error ? error.message : 'Unknown error'\n    }`,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,gBAAgB,EAC1B,OAAO;CAEN,aAAa,EAAE,QAAQ;CACvB,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,IAAI,EAAE,QAAQ,CAAC,SAAS;CAGxB,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,mBAAmB,EAAE,SAAS,CAAC,SAAS;CACxC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACrC,UAAU,EAAE,SAAS,CAAC,SAAS;CAG/B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CAKrC,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAI1C,MAAM,EACH,OAAO;EACN,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM;EAC/B,WAAW,EAAE,QAAQ,CAAC,SAAS;EAC/B,YAAY,EAAE,QAAQ,CAAC,SAAS;EAChC,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,UAAU,EAAE,QAAQ,CAAC,SAAS;EAC/B,CAAC,CACD,aAAa;CAChB,cAAc,EACX,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACtC,aAAa,EAAE,QAAQ,CAAC,SAAS;EAIjC,gCAAgC,EAAE,SAAS,CAAC,SAAS;EACtD,CAAC,CACD,aAAa;CAChB,eAAe,EAAE,MACf,EACG,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACvC,CAAC,CACD,aAAa,CACjB;CACF,CAAC,CACD,aAAa;;;;;;;;;;;;AAahB,MAAa,yBAAyB,EACnC,OAAO;CACN,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,YAAY,EAAE,QAAQ,CAAC,SAAS;CACjC,CAAC,CACD,aAAa;AAGyB,EAAE,OAAO,EAChD,SAAS,EAAE,MAAM,uBAAuB,EACzC,CAAC;AAKF,MAAa,mBAAmB,EAAE,OAAO;CACvC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ,CAAC,MAAM;CACvB,cAAc,EAAE,QAAQ,CAAC,MAAM;CAC/B,WAAW,EAAE,QAAQ;CACrB,MAAM,EAAE,QAAQ;CAOhB,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,+BAA+B,EAAE,SAAS,CAAC,SAAS;CACpD,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACtC,CAAC;AAKF,IAAa,WAAb,cAA8B,MAAM;CAClC,YACE,SACA,YACA,UACA;AACA,QAAM,QAAQ;AAHE,OAAA,aAAA;AACA,OAAA,WAAA;AAGhB,OAAK,OAAO;;;AAIhB,eAAsB,cACpB,aACA,SACkB;AAClB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,kBAAkB,EAC5D,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,cAAc,MAAM,SAAS,KAAK;UAClC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,kBAAkB;AACzD,YAAU,iBAAiB,UAAU;GACnC,UAAU;GACV;GACD,CAAC;AACF,QAAM;;;AA+CV,eAAsB,iBACpB,aACA,WACA,SACqB;AACrB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,gBAAgB,UAAU,IAAI,EACxE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,iBAAiB,MAAM,SAAS,KAAK;UACrC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,qBAAqB;AAC5D,YAAU,iBAAiB,UAAU;GACnC,UAAU,iBAAiB,UAAU;GACrC;GACA;GACD,CAAC;AACF,QAAM;;;;AAKV,MAAM,6BAA6B,EAAE,OAAO,EAC1C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,EACzE,CAAC;;;;;;;AAQF,eAAsB,oBACpB,aACA,WACA,SACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,IAC3B,GAAG,QAAQ,gBAAgB,UAAU,iBACrC;EACE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf;EACD;EACD,CACF;CACD,MAAM,SAAS,2BAA2B,UAAU,SAAS,KAAK;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,QAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,QAAQ;;AAG5D,SAAgB,eAAe,OAAgB,WAA6B;AAC1E,KAAI,MAAM,aAAa,MAAM,EAAE;EAC7B,MAAM,aAAa;EACnB,MAAM,SAAS,WAAW,UAAU;EACpC,MAAM,SAAS,WAAW,UAAU,MAAM;EAC1C,MAAM,WAAW,WAAW,QAAQ;AAEpC,MAAI,WAAW,IACb,QAAO,IAAI,SACT,yCAAyC,aACzC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,iCAAiC,aACjC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,sCAAsC,aACtC,QACA,SACD;AAIH,SAAO,IAAI,SADK,UAAU,aAAa,aACV,QAAQ,SAAS;;AAGhD,KAAI,iBAAiB,EAAE,SACrB,QAAO,IAAI,SAAS,2CAA2C,YAAY;AAG7E,QAAO,IAAI,SACT,oCAAoC,UAAU,IAC5C,iBAAiB,QAAQ,MAAM,UAAU,kBAE5C"}
+{"version":3,"file":"api-T_WHs3qZ.js","names":[],"sources":["../src/lib/api.ts"],"sourcesContent":["import axios, { AxiosError } from 'axios';\nimport { z } from 'zod';\nimport { analytics } from '@utils/analytics';\nimport { WIZARD_USER_AGENT } from './constants';\n\n/**\n * User payload from `/api/users/@me/`. Schema typed for the fields the\n * wizard actually reads + passthrough on everything else so the full\n * upstream response rides through to the session for downstream features\n * (account-aware copy, plan-gated flows, org/team metadata, etc.).\n *\n * Top-level uses `.passthrough()` so unknown fields aren't stripped;\n * the few nested objects we care about (team, organization,\n * organizations[]) do the same so their additional fields survive too.\n *\n * Keep `distinct_id` required — analytics depends on it. Everything\n * else added here is nullish so partial responses don't fail parsing.\n */\nexport const ApiUserSchema = z\n  .object({\n    // Identifiers\n    distinct_id: z.string(),\n    uuid: z.string().nullish(),\n    id: z.number().nullish(),\n\n    // Profile\n    email: z.string().nullish(),\n    first_name: z.string().nullish(),\n    last_name: z.string().nullish(),\n    date_joined: z.string().nullish(),\n    is_email_verified: z.boolean().nullish(),\n    is_2fa_enabled: z.boolean().nullish(),\n    is_staff: z.boolean().nullish(),\n\n    // Preferences\n    theme_mode: z.string().nullish(),\n    toolbar_mode: z.string().nullish(),\n    hide_mcp_hints: z.boolean().nullish(),\n\n    // Optional / nullable on the backend — pre-onboarding signup paths\n    // return null and older accounts may not have it set. Treat as a\n    // hint, never a guarantee.\n    role_at_organization: z.string().nullish(),\n\n    // Current team + organization (objects from the API, kept typed on\n    // the fields the wizard uses; passthrough preserves the rest).\n    team: z\n      .object({\n        id: z.number(),\n        uuid: z.string().nullish(),\n        organization: z.string().uuid(),\n        api_token: z.string().nullish(),\n        project_id: z.number().nullish(),\n        name: z.string().nullish(),\n        timezone: z.string().nullish(),\n      })\n      .passthrough(),\n    organization: z\n      .object({\n        id: z.string().uuid(),\n        name: z.string().nullish(),\n        slug: z.string().nullish(),\n        membership_level: z.number().nullish(),\n        customer_id: z.string().nullish(),\n        // Org-level AI consent gate. Signals drops all findings while\n        // this is not true. Null on older orgs (pre-2026-05 default\n        // flip) — treat null as \"unknown\", not \"off\".\n        is_ai_data_processing_approved: z.boolean().nullish(),\n      })\n      .passthrough(),\n    organizations: z.array(\n      z\n        .object({\n          id: z.string().uuid(),\n          name: z.string().nullish(),\n          membership_level: z.number().nullish(),\n        })\n        .passthrough(),\n    ),\n  })\n  .passthrough();\n\n/**\n * Single activity log entry the wizard cares about. The PostHog endpoint\n * returns much more — schema kept minimal so changes upstream don't break us.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling. Deliberately retained: this is a thin,\n * well-typed wrapper around a stable PostHog endpoint, and we're likely\n * to want it again for a future feature (e.g. \"what changed in your\n * project recently\"). Re-deriving the schema is more work than letting\n * it sit dormant.\n */\nexport const ActivityLogEntrySchema = z\n  .object({\n    scope: z.string().nullish(),\n    activity: z.string().nullish(),\n    created_at: z.string().nullish(),\n  })\n  .passthrough();\n\n/** @unused — see ActivityLogEntrySchema. */\nexport const ActivityLogResponseSchema = z.object({\n  results: z.array(ActivityLogEntrySchema),\n});\n\n/** @unused — see ActivityLogEntrySchema. */\nexport type ActivityLogEntry = z.infer<typeof ActivityLogEntrySchema>;\n\nexport const ApiProjectSchema = z.object({\n  id: z.number(),\n  uuid: z.string().uuid(),\n  organization: z.string().uuid(),\n  api_token: z.string(),\n  name: z.string(),\n  // Product opt-ins (TeamSerializer-compat fields on /api/projects/:id).\n  // Project-level truth for \"is this product enabled\" — a product can be\n  // instrumented from another repo or the snippet, so these settings\n  // override repo-local evidence. Null/absent = unknown. Only the\n  // opt-ins a signals decision consumes: replay + exception autocapture\n  // feed signal-source choices; surveys feeds the surveys-scout tuning.\n  session_recording_opt_in: z.boolean().nullish(),\n  autocapture_exceptions_opt_in: z.boolean().nullish(),\n  surveys_opt_in: z.boolean().nullish(),\n});\n\nexport type ApiUser = z.infer<typeof ApiUserSchema>;\nexport type ApiProject = z.infer<typeof ApiProjectSchema>;\n\nexport class ApiError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode?: number,\n    public readonly endpoint?: string,\n  ) {\n    super(message);\n    this.name = 'ApiError';\n  }\n}\n\nexport async function fetchUserData(\n  accessToken: string,\n  baseUrl: string,\n): Promise<ApiUser> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/users/@me/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiUserSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch user data');\n    analytics.captureException(apiError, {\n      endpoint: '/api/users/@me/',\n      baseUrl,\n    });\n    throw apiError;\n  }\n}\n\n/**\n * Best-effort fetch of recent activity log entries. Returns [] on any error\n * so callers can treat absence of results as \"haven't detected anything yet\"\n * rather than a hard failure.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling from McpSuggestedPromptsScreen.\n * Deliberately retained for future features that want a soft signal of\n * recent project changes (e.g. dashboards, audit summaries). See the\n * ActivityLogEntrySchema doc comment for the keep-vs-delete rationale.\n */\nexport async function fetchRecentActivity(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  since: Date,\n): Promise<ActivityLogEntry[]> {\n  try {\n    const response = await axios.get(\n      `${baseUrl}/api/projects/${projectId}/activity_log/`,\n      {\n        params: { limit: 10 },\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          'User-Agent': WIZARD_USER_AGENT,\n        },\n        // Short timeout — best-effort probe, not a critical path.\n        timeout: 4000,\n      },\n    );\n    const parsed = ActivityLogResponseSchema.safeParse(response.data);\n    if (!parsed.success) return [];\n    const sinceMs = since.getTime();\n    return parsed.data.results.filter((entry) => {\n      if (!entry.created_at) return false;\n      const t = Date.parse(entry.created_at);\n      return Number.isFinite(t) && t >= sinceMs;\n    });\n  } catch {\n    return [];\n  }\n}\n\nexport async function fetchProjectData(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n): Promise<ApiProject> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/projects/${projectId}/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiProjectSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch project data');\n    analytics.captureException(apiError, {\n      endpoint: `/api/projects/${projectId}/`,\n      baseUrl,\n      projectId,\n    });\n    throw apiError;\n  }\n}\n\n/** Minimal shape of `/api/projects/:id/integrations/` — we only read `kind`. */\nconst IntegrationsResponseSchema = z.object({\n  results: z.array(z.object({ kind: z.string().nullish() }).passthrough()),\n});\n\n/**\n * Check whether the project already has a Slack integration connected.\n * Requires the `integration:read` scope. Throws on failure — callers\n * (including the SlackConnectScreen poll) decide how to degrade and\n * are responsible for capturing the error exactly once.\n */\nexport async function fetchSlackConnected(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  signal?: AbortSignal,\n): Promise<boolean> {\n  const response = await axios.get(\n    `${baseUrl}/api/projects/${projectId}/integrations/`,\n    {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      signal,\n    },\n  );\n  const parsed = IntegrationsResponseSchema.safeParse(response.data);\n  if (!parsed.success) return false;\n  return parsed.data.results.some((i) => i.kind === 'slack');\n}\n\nexport function handleApiError(error: unknown, operation: string): ApiError {\n  if (axios.isAxiosError(error)) {\n    const axiosError = error as AxiosError<{ detail?: string }>;\n    const status = axiosError.response?.status;\n    const detail = axiosError.response?.data?.detail;\n    const endpoint = axiosError.config?.url;\n\n    if (status === 401) {\n      return new ApiError(\n        `Authentication failed while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 403) {\n      return new ApiError(\n        `Access denied while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 404) {\n      return new ApiError(\n        `Resource not found while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    const message = detail || `Failed to ${operation}`;\n    return new ApiError(message, status, endpoint);\n  }\n\n  if (error instanceof z.ZodError) {\n    return new ApiError(`Invalid response format while trying to ${operation}`);\n  }\n\n  return new ApiError(\n    `Unexpected error while trying to ${operation}: ${\n      error instanceof Error ? error.message : 'Unknown error'\n    }`,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,gBAAgB,EAC1B,OAAO;CAEN,aAAa,EAAE,QAAQ;CACvB,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,IAAI,EAAE,QAAQ,CAAC,SAAS;CAGxB,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,mBAAmB,EAAE,SAAS,CAAC,SAAS;CACxC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACrC,UAAU,EAAE,SAAS,CAAC,SAAS;CAG/B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CAKrC,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAI1C,MAAM,EACH,OAAO;EACN,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM;EAC/B,WAAW,EAAE,QAAQ,CAAC,SAAS;EAC/B,YAAY,EAAE,QAAQ,CAAC,SAAS;EAChC,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,UAAU,EAAE,QAAQ,CAAC,SAAS;EAC/B,CAAC,CACD,aAAa;CAChB,cAAc,EACX,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACtC,aAAa,EAAE,QAAQ,CAAC,SAAS;EAIjC,gCAAgC,EAAE,SAAS,CAAC,SAAS;EACtD,CAAC,CACD,aAAa;CAChB,eAAe,EAAE,MACf,EACG,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACvC,CAAC,CACD,aAAa,CACjB;CACF,CAAC,CACD,aAAa;;;;;;;;;;;;AAahB,MAAa,yBAAyB,EACnC,OAAO;CACN,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,YAAY,EAAE,QAAQ,CAAC,SAAS;CACjC,CAAC,CACD,aAAa;AAGyB,EAAE,OAAO,EAChD,SAAS,EAAE,MAAM,uBAAuB,EACzC,CAAC;AAKF,MAAa,mBAAmB,EAAE,OAAO;CACvC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ,CAAC,MAAM;CACvB,cAAc,EAAE,QAAQ,CAAC,MAAM;CAC/B,WAAW,EAAE,QAAQ;CACrB,MAAM,EAAE,QAAQ;CAOhB,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,+BAA+B,EAAE,SAAS,CAAC,SAAS;CACpD,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACtC,CAAC;AAKF,IAAa,WAAb,cAA8B,MAAM;CAClC,YACE,SACA,YACA,UACA;AACA,QAAM,QAAQ;AAHE,OAAA,aAAA;AACA,OAAA,WAAA;AAGhB,OAAK,OAAO;;;AAIhB,eAAsB,cACpB,aACA,SACkB;AAClB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,kBAAkB,EAC5D,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,cAAc,MAAM,SAAS,KAAK;UAClC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,kBAAkB;AACzD,YAAU,iBAAiB,UAAU;GACnC,UAAU;GACV;GACD,CAAC;AACF,QAAM;;;AA+CV,eAAsB,iBACpB,aACA,WACA,SACqB;AACrB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,gBAAgB,UAAU,IAAI,EACxE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,iBAAiB,MAAM,SAAS,KAAK;UACrC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,qBAAqB;AAC5D,YAAU,iBAAiB,UAAU;GACnC,UAAU,iBAAiB,UAAU;GACrC;GACA;GACD,CAAC;AACF,QAAM;;;;AAKV,MAAM,6BAA6B,EAAE,OAAO,EAC1C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,EACzE,CAAC;;;;;;;AAQF,eAAsB,oBACpB,aACA,WACA,SACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,IAC3B,GAAG,QAAQ,gBAAgB,UAAU,iBACrC;EACE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf;EACD;EACD,CACF;CACD,MAAM,SAAS,2BAA2B,UAAU,SAAS,KAAK;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,QAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,QAAQ;;AAG5D,SAAgB,eAAe,OAAgB,WAA6B;AAC1E,KAAI,MAAM,aAAa,MAAM,EAAE;EAC7B,MAAM,aAAa;EACnB,MAAM,SAAS,WAAW,UAAU;EACpC,MAAM,SAAS,WAAW,UAAU,MAAM;EAC1C,MAAM,WAAW,WAAW,QAAQ;AAEpC,MAAI,WAAW,IACb,QAAO,IAAI,SACT,yCAAyC,aACzC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,iCAAiC,aACjC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,sCAAsC,aACtC,QACA,SACD;AAIH,SAAO,IAAI,SADK,UAAU,aAAa,aACV,QAAQ,SAAS;;AAGhD,KAAI,iBAAiB,EAAE,SACrB,QAAO,IAAI,SAAS,2CAA2C,YAAY;AAG7E,QAAO,IAAI,SACT,oCAAoC,UAAU,IAC5C,iBAAiB,QAAQ,MAAM,UAAU,kBAE5C"}

package/dist/bin.js

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
-import { F as Integration, V as POSTHOG_DOCS_URL, a as getLogFilePath, ct as WIZARD_USER_AGENT, dt as getSkillsBaseUrl, ft as VERSION, h as LoggingUI, m as setUI, p as getUI, r as debug, s as logToFile } from "./debug-CgdI7Rd-.js";
-import { t as analytics } from "./analytics-CvIK_07d.js";
-import { r as setEntryCommand } from "./telemetry-wOdXbZLp.js";
-import { n as isUsingTypeScript } from "./setup-utils-DhmigSLO.js";
-import { o as getUiHostFromHost } from "./urls-BR7jQgQp.js";
-import { t as HostResolution } from "./host-resolution-CUjt6efz.js";
-import { o as handleApiError } from "./api-CyA47qug.js";
-import "./wizard-session-DWeUEncV.js";
-import { r as runCleanups } from "./wizard-abort-bulz-_og.js";
-import { n as isNonInteractiveEnvironment } from "./environment-v22_Genm.js";
-import { n as runAgent, o as authenticate } from "./agent-runner-BMuJP8fb.js";
-import { C as SETUP_REPORT_FILE, l as recoverOrphanedSettingsBackups, p as AgentSignals } from "./agent-interface-BAodys0H.js";
-import { h as AUDIT_REPORT_FILE, i as fetchSkillMenu, m as AUDIT_CHECKS_KEY, p as AUDIT_CHECKS_FILE, t as WIZARD_TOOL_NAMES } from "./wizard-tools-CGrE1O_b.js";
-import { i as SPINNER_MESSAGE, t as FRAMEWORK_REGISTRY } from "./registry-ByrVTIE9.js";
-import { _ as gatherFrameworkContext, a as LINE_CHART_BLOCK, b as parseRequirementsTxt, g as detectProjectsWithAgent, h as HEALTH_CHECK_STEP, i as FUNNEL_BLOCK, m as Icons, n as integrationRunStep, o as PRODUCT_SUITE_BLOCK, p as Colors, r as posthogIntegrationConfig, s as StatusPeekTrigger, u as isClearBlock, v as parsePipfile, y as parsePyprojectToml } from "./posthog-integration-CcJWXPDa.js";
-import { n as safeReadFile, r as walkProjectFiles, t as IGNORED_DIRS } from "./file-utils-Gvc2Ysa_.js";
-import { n as readApiKeyFromEnv } from "./env-api-key-Bezg_uXQ.js";
+import { B as POSTHOG_DOCS_URL, P as Integration, a as getLogFilePath, dt as VERSION, f as getUI, m as LoggingUI, p as setUI, r as debug, s as logToFile, st as WIZARD_USER_AGENT, ut as getSkillsBaseUrl } from "./debug-D1lORUFs.js";
+import { n as analytics } from "./analytics-Ciob-x8a.js";
+import { r as setEntryCommand } from "./telemetry-BfnR7gtf.js";
+import { n as isUsingTypeScript } from "./setup-utils-DLGNk8T6.js";
+import { o as getUiHostFromHost } from "./urls-CilgPbS-.js";
+import { t as HostResolution } from "./host-resolution-BnUJZKId.js";
+import { o as handleApiError } from "./api-T_WHs3qZ.js";
+import "./wizard-session-BoXAZEOf.js";
+import { r as runCleanups } from "./wizard-abort-Cp5Y7f8C.js";
+import { n as isNonInteractiveEnvironment } from "./environment-BEsDCA2q.js";
+import { n as runAgent, o as authenticate } from "./agent-runner-CMfTmM3B.js";
+import { C as SETUP_REPORT_FILE, l as recoverOrphanedSettingsBackups, p as AgentSignals } from "./agent-interface-DExARWay.js";
+import { h as AUDIT_REPORT_FILE, i as fetchSkillMenu, m as AUDIT_CHECKS_KEY, p as AUDIT_CHECKS_FILE, t as WIZARD_TOOL_NAMES } from "./wizard-tools-DQTfAzSV.js";
+import { i as SPINNER_MESSAGE, t as FRAMEWORK_REGISTRY } from "./registry-BQIX-25O.js";
+import { _ as gatherFrameworkContext, a as LINE_CHART_BLOCK, b as parseRequirementsTxt, g as detectProjectsWithAgent, h as HEALTH_CHECK_STEP, i as FUNNEL_BLOCK, m as Icons, n as integrationRunStep, o as PRODUCT_SUITE_BLOCK, p as Colors, r as posthogIntegrationConfig, s as StatusPeekTrigger, u as isClearBlock, v as parsePipfile, y as parsePyprojectToml } from "./posthog-integration-CWXSng0W.js";
+import { n as safeReadFile, r as walkProjectFiles, t as IGNORED_DIRS } from "./file-utils-Cn3dzlo-.js";
+import { n as readApiKeyFromEnv } from "./env-api-key-DEl3LJBv.js";
 import { satisfies } from "semver";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import fs, { existsSync, readFileSync, readdirSync, statSync } from "fs";
-import path, { join, relative, resolve } from "path";
+import path, { join, relative, resolve, sep } from "path";
 import * as os from "node:os";
 import * as path$1 from "node:path";
 import { spawnSync } from "node:child_process";
@@ -243,7 +243,7 @@ function runProvision(argv) {
 }
 async function provision({ email, region, name, baseUrl, jsonMode }) {
 	try {
-		const { provisionNewAccount } = await import("./provisioning-BIuAPRcH.js").then((n) => n.n);
+		const { provisionNewAccount } = await import("./provisioning-CgomM26T.js").then((n) => n.n);
 		if (!jsonMode) getUI().log.info(`Provisioning account for ${email} in ${region}...`);
 		emitResult(await provisionNewAccount(email, name, region, { baseUrl }), jsonMode);
 		process.exit(0);
@@ -308,22 +308,22 @@ const basicIntegrationCommand = {
 		setEntryCommand("integrate");
 		(async () => {
 			if (isHeadless(argv)) {
-				const { runHeadlessInstall } = await import("./ci-install-C_o0Q7Fg.js");
+				const { runHeadlessInstall } = await import("./ci-install-DJN5aT7W.js");
 				return runHeadlessInstall(argv);
 			}
 			if (argv.ci) {
-				const { runCIInstall } = await import("./ci-install-C_o0Q7Fg.js");
+				const { runCIInstall } = await import("./ci-install-DJN5aT7W.js");
 				return runCIInstall(argv);
 			}
 			if (isNonInteractiveEnvironment()) {
-				const { failNonInteractive } = await import("./non-interactive-B-Ku4EOx.js");
+				const { failNonInteractive } = await import("./non-interactive-Dko5F3vh.js");
 				return failNonInteractive();
 			}
 			if (argv.playground) {
-				const { runPlayground } = await import("./playground-CmKFAlCE.js");
+				const { runPlayground } = await import("./playground-UtT6zbjE.js");
 				return runPlayground();
 			}
-			const { runInteractive } = await import("./interactive-CRdgBMxk.js");
+			const { runInteractive } = await import("./interactive-BB2IDSWP.js");
 			runInteractive(argv);
 		})();
 	}
@@ -3295,7 +3295,102 @@ const POSTHOG_PRESENT_KEY = "postHogPresent";
 * into the chosen sub-app, not the root.
 */
 const SELF_DRIVING_INTEGRATE_PATH_KEY = "selfDrivingIntegratePath";
-const POSTHOG_PACKAGE_RE = /(^|["'\s/=])posthog/im;
+const POSTHOG_PACKAGE_RE = /(^|["'\s/=:.@])posthog/im;
+const POSTHOG_MANIFESTS = [
+	"package.json",
+	"requirements.txt",
+	"pyproject.toml",
+	"Pipfile",
+	"setup.py",
+	"Gemfile",
+	"go.mod",
+	"composer.json",
+	"pubspec.yaml",
+	"Package.swift",
+	"Podfile",
+	"Podfile.lock",
+	"project.yml",
+	"build.gradle",
+	"build.gradle.kts",
+	"gradle/libs.versions.toml",
+	"pom.xml",
+	"mix.exs",
+	"Cargo.toml"
+];
+const POSTHOG_DIRS = [
+	".",
+	"app",
+	"frontend",
+	"backend",
+	"ios",
+	"android",
+	"android/app"
+];
+const WALK_SKIP_DIRS = new Set([
+	"node_modules",
+	"Pods",
+	"Carthage",
+	"DerivedData",
+	".build",
+	"build",
+	"dist",
+	"out",
+	".next",
+	"coverage",
+	"vendor",
+	".venv",
+	"site-packages",
+	"target",
+	".git"
+]);
+const WALK_MAX_DEPTH = 2;
+/**
+* The install dir plus every directory within WALK_MAX_DEPTH levels (skipping
+* heavy/vendored trees and dotdirs), unioned with the explicit POSTHOG_DIRS. A
+* full shallow walk on top of the named dirs, so a monorepo's nested apps
+* (e.g. `apps/mobile`) are seen without hardcoding the path.
+*/
+function scanDirs(installDir) {
+	const rels = new Set(POSTHOG_DIRS);
+	const walk = (rel, depth) => {
+		rels.add(rel);
+		if (depth >= WALK_MAX_DEPTH) return;
+		let entries;
+		try {
+			entries = readdirSync(join(installDir, rel), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const e of entries) {
+			if (!e.isDirectory()) continue;
+			if (e.name.startsWith(".") || WALK_SKIP_DIRS.has(e.name)) continue;
+			if (e.name.endsWith(".xcodeproj") || e.name.endsWith(".xcworkspace")) continue;
+			walk(rel === "." ? e.name : `${rel}/${e.name}`, depth + 1);
+		}
+	};
+	walk(".", 0);
+	return [...rels];
+}
+/**
+* True if a `*.xcodeproj/project.pbxproj` or `*.csproj`/`*.fsproj` in
+* `dirPath` references PostHog.
+*/
+function projectFileHasPostHog(dirPath) {
+	let entries;
+	try {
+		entries = readdirSync(dirPath);
+	} catch {
+		return false;
+	}
+	for (const entry of entries) {
+		const target = entry.endsWith(".xcodeproj") ? join(dirPath, entry, "project.pbxproj") : entry.endsWith(".csproj") || entry.endsWith(".fsproj") ? join(dirPath, entry) : null;
+		if (!target || !existsSync(target)) continue;
+		try {
+			if (POSTHOG_PACKAGE_RE.test(readFileSync(target, "utf8"))) return true;
+		} catch {}
+	}
+	return false;
+}
 /**
 * Deterministic, offline check: does the project already have a PostHog SDK?
 * Scans the common dependency manifests at the install dir for a `posthog`
@@ -3304,27 +3399,16 @@ const POSTHOG_PACKAGE_RE = /(^|["'\s/=])posthog/im;
 * first ("not found") or proceeds straight to setup ("found").
 */
 function detectPostHogPresent(installDir) {
-	const manifests = [
-		"package.json",
-		"requirements.txt",
-		"pyproject.toml",
-		"Pipfile",
-		"Gemfile",
-		"go.mod",
-		"composer.json",
-		"pubspec.yaml"
-	];
-	for (const dir of [
-		".",
-		"app",
-		"frontend",
-		"backend"
-	]) for (const name of manifests) {
-		const path = join(installDir, dir, name);
-		if (!existsSync(path)) continue;
-		try {
-			if (POSTHOG_PACKAGE_RE.test(readFileSync(path, "utf8"))) return true;
-		} catch {}
+	for (const dir of scanDirs(installDir)) {
+		const dirPath = join(installDir, dir);
+		for (const name of POSTHOG_MANIFESTS) {
+			const path = join(dirPath, name);
+			if (!existsSync(path)) continue;
+			try {
+				if (POSTHOG_PACKAGE_RE.test(readFileSync(path, "utf8"))) return true;
+			} catch {}
+		}
+		if (projectFileHasPostHog(dirPath)) return true;
 	}
 	return false;
 }
@@ -3421,7 +3505,7 @@ function classify(integration, hasPostHog) {
 	};
 	return { instrumentable: true };
 }
-/** Map a generic detection report into classified integration projects. */
+/** Map a detection report into classified projects (exported for tests). */
 function toIntegrationReport(report) {
 	return {
 		repoType: report.repoType,
@@ -3432,6 +3516,7 @@ function toIntegrationReport(report) {
 				framework: p.framework,
 				integration,
 				hasPostHog: p.hasPostHog,
+				continuable: p.hasPostHog,
 				...classify(integration, p.hasPostHog)
 			};
 		})
@@ -3487,10 +3572,18 @@ async function prepSelfDrivingIntegration(session) {
 */
 /** True once detection found PostHog already present in the project. */
 const postHogPresent = (session) => session.frameworkContext[POSTHOG_PRESENT_KEY] === true;
-/** Absolute dir to integrate into: the picked sub-app, else the repo root. */
+/**
+* Absolute dir to integrate into: the picked sub-app, else the repo root.
+* The picked path originates from LLM output; if it resolves outside the
+* repo (defense-in-depth on top of the coerce-layer clamp), fall back to
+* the root rather than run the agent elsewhere.
+*/
 const integrationDir = (session) => {
 	const rel = session.frameworkContext[SELF_DRIVING_INTEGRATE_PATH_KEY];
-	return typeof rel === "string" && rel !== "." ? resolve(session.installDir, rel) : session.installDir;
+	if (typeof rel !== "string" || rel === ".") return session.installDir;
+	const root = resolve(session.installDir);
+	const dir = resolve(root, rel);
+	return dir === root || dir.startsWith(root + sep) ? dir : root;
 };
 const SELF_DRIVING_PROGRAM = [
 	{
@@ -3524,7 +3617,7 @@ const SELF_DRIVING_PROGRAM = [
 		label: "Detecting",
 		screenId: "self-driving-integration-detect",
 		show: (session) => session.integrate === true && session.integration == null,
-		isComplete: (session) => session.integration != null
+		isComplete: (session) => session.integration != null || session.integrate === false
 	},
 	{
 		...integrationRunStep,
@@ -4043,13 +4136,13 @@ const mcpAddCommand = {
 function runMcpAdd(argv) {
 	const features = parseFeatures(argv.features);
 	(async () => {
-		const { readApiKeyFromEnv } = await import("./env-api-key-Bezg_uXQ.js").then((n) => n.t);
+		const { readApiKeyFromEnv } = await import("./env-api-key-DEl3LJBv.js").then((n) => n.t);
 		const apiKey = argv.apiKey || readApiKeyFromEnv();
 		const debug = argv.debug;
 		const localMcp = argv.local;
 		try {
-			const { startTUI } = await import("./start-tui-DKHnPg5a.js");
-			const { buildSession } = await import("./wizard-session-B1ZM4OBv.js");
+			const { startTUI } = await import("./start-tui-BjCKghQq.js");
+			const { buildSession } = await import("./wizard-session-C8W_6X0j.js");
 			const tui = startTUI(VERSION, Program.McpAdd);
 			tui.store.session = buildSession({
 				debug,
@@ -4061,7 +4154,7 @@ function runMcpAdd(argv) {
 		} catch (error) {
 			if (!isTUIUnavailable(error)) throw error;
 			setUI(new LoggingUI());
-			const { addMCPServerToClientsStep } = await import("./add-mcp-server-to-clients-CeoyDLC-.js").then((n) => n.r);
+			const { addMCPServerToClientsStep } = await import("./add-mcp-server-to-clients-CHSzsAG8.js").then((n) => n.r);
 			await addMCPServerToClientsStep({
 				local: localMcp,
 				features,
@@ -4100,8 +4193,8 @@ function runMcpRemove(argv) {
 		const debug = argv.debug;
 		const localMcp = argv.local;
 		try {
-			const { startTUI } = await import("./start-tui-DKHnPg5a.js");
-			const { buildSession } = await import("./wizard-session-B1ZM4OBv.js");
+			const { startTUI } = await import("./start-tui-BjCKghQq.js");
+			const { buildSession } = await import("./wizard-session-C8W_6X0j.js");
 			const tui = startTUI(VERSION, Program.McpRemove);
 			tui.store.session = buildSession({
 				debug,
@@ -4110,7 +4203,7 @@ function runMcpRemove(argv) {
 			});
 		} catch {
 			setUI(new LoggingUI());
-			const { removeMCPServerFromClientsStep } = await import("./add-mcp-server-to-clients-CeoyDLC-.js").then((n) => n.r);
+			const { removeMCPServerFromClientsStep } = await import("./add-mcp-server-to-clients-CHSzsAG8.js").then((n) => n.r);
 			await removeMCPServerFromClientsStep({ local: localMcp });
 		}
 	})();
@@ -4132,8 +4225,8 @@ function runMcpTutorial(argv) {
 		const debug = argv.debug;
 		const localMcp = argv.local;
 		try {
-			const { startTUI } = await import("./start-tui-DKHnPg5a.js");
-			const { buildSession } = await import("./wizard-session-B1ZM4OBv.js");
+			const { startTUI } = await import("./start-tui-BjCKghQq.js");
+			const { buildSession } = await import("./wizard-session-C8W_6X0j.js");
 			const tui = startTUI(VERSION, Program.McpTutorial);
 			tui.store.session = buildSession({
 				debug,
@@ -4213,10 +4306,10 @@ function runWizard(config, options) {
 	(async () => {
 		try {
 			const installDir = options.installDir || process.cwd();
-			const { startTUI } = await import("./start-tui-DKHnPg5a.js");
-			const { buildSession, RunPhase } = await import("./wizard-session-B1ZM4OBv.js");
-			const { TaskStreamPush } = await import("./task-stream-C6s7qUCE.js");
-			const { PostHogDestination } = await import("./posthog-Dnl6wsYc.js");
+			const { startTUI } = await import("./start-tui-BjCKghQq.js");
+			const { buildSession, RunPhase } = await import("./wizard-session-C8W_6X0j.js");
+			const { TaskStreamPush } = await import("./task-stream-rC4IEUHC.js");
+			const { PostHogDestination } = await import("./posthog-BESrI6-T.js");
 			tui = startTUI(WIZARD_VERSION, config.id);
 			const activeTui = tui;
 			const session = buildSession({
@@ -4280,7 +4373,7 @@ function runWizard(config, options) {
 				if (shown(step)) await advanceStep(step, activeTui.store, config);
 			}
 			else if (skipAgent) {
-				const { getOrAskForProjectData } = await import("./setup-utils-DhmigSLO.js").then((n) => n.r);
+				const { getOrAskForProjectData } = await import("./setup-utils-DLGNk8T6.js").then((n) => n.r);
 				const { projectApiKey, host, accessToken, projectId } = await getOrAskForProjectData({
 					signup: session.signup,
 					ci: session.ci,
@@ -4382,11 +4475,11 @@ function runNonInteractive(config, options, mode) {
 	analytics.setTag("build", mode);
 	(async () => {
 		const path = await import("path");
-		const { buildSession, RunPhase, OutroKind } = await import("./wizard-session-B1ZM4OBv.js");
-		const { readEnvironment } = await import("./environment-v22_Genm.js").then((n) => n.t);
-		const { readApiKeyFromEnv } = await import("./env-api-key-Bezg_uXQ.js").then((n) => n.t);
-		const { configureLogFileFromEnvironment, logToFile } = await import("./debug-BhGq9rn9.js");
-		const { wizardAbort, WizardError } = await import("./wizard-abort-lbH6n2WG.js");
+		const { buildSession, RunPhase, OutroKind } = await import("./wizard-session-C8W_6X0j.js");
+		const { readEnvironment } = await import("./environment-BEsDCA2q.js").then((n) => n.t);
+		const { readApiKeyFromEnv } = await import("./env-api-key-DEl3LJBv.js").then((n) => n.t);
+		const { configureLogFileFromEnvironment, logToFile } = await import("./debug-Cne-cLxd.js");
+		const { wizardAbort, WizardError } = await import("./wizard-abort-DHrEGqaC.js");
 		configureLogFileFromEnvironment();
 		const env = readEnvironment();
 		const apiKey = options.apiKey ?? readApiKeyFromEnv() ?? void 0;
@@ -4417,9 +4510,9 @@ function runNonInteractive(config, options, mode) {
 		let store = null;
 		let taskStream = null;
 		if (mode === "headless") {
-			const { WizardStore } = await import("./store-BV1a-8Wp.js").then((n) => n.n);
-			const { HeadlessUI } = await import("./headless-ui-BtBcuxOj.js");
-			const { TaskStreamPush, PostHogDestination } = await import("./task-stream-C6s7qUCE.js");
+			const { WizardStore } = await import("./store-CDIxU0rr.js").then((n) => n.n);
+			const { HeadlessUI } = await import("./headless-ui-DGunpK-s.js");
+			const { TaskStreamPush, PostHogDestination } = await import("./task-stream-rC4IEUHC.js");
 			store = new WizardStore(config.id);
 			store.session = session;
 			setUI(new HeadlessUI(store));
@@ -4474,7 +4567,7 @@ function runNonInteractive(config, options, mode) {
 					});
 				}
 			}
-			const { runAgent } = await import("./agent-runner-BMuJP8fb.js").then((n) => n.t);
+			const { runAgent } = await import("./agent-runner-CMfTmM3B.js").then((n) => n.t);
 			await runAgent(config, session);
 			await settleStream(RunPhase.Completed);
 		} catch (error) {
@@ -5026,7 +5119,8 @@ const SinglePickerMenu = ({ message, options, centered = false, columns = 1, opt
 				children: colOpts.map((opt, rowIdx) => {
 					const flatIdx = colIdx * rows + rowIdx;
 					const isFocused = flatIdx === focused;
-					const label = opt.hint ? `${opt.label} (${opt.hint})` : opt.label;
+					const base = opt.hint ? `${opt.label} (${opt.hint})` : opt.label;
+					const label = opt.indent ? `  ${base}` : base;
 					return /* @__PURE__ */ jsxs(Box, {
 						gap: 1,
 						marginBottom: optionMarginBottom,
@@ -5034,16 +5128,16 @@ const SinglePickerMenu = ({ message, options, centered = false, columns = 1, opt
 							/* @__PURE__ */ jsx(Text, {
 								color: isFocused ? Colors.accent : void 0,
 								dimColor: !isFocused,
-								children: isFocused ? Icons.triangleSmallRight : " "
+								children: isFocused && !opt.header ? Icons.triangleSmallRight : " "
 							}),
 							opt.icon && /* @__PURE__ */ jsx(Text, {
 								color: opt.icon.color,
 								children: opt.icon.glyph
 							}),
 							/* @__PURE__ */ jsx(Text, {
-								color: opt.disabled ? Colors.muted : isFocused ? Colors.accent : void 0,
-								bold: isFocused && !opt.disabled,
-								dimColor: !isFocused || opt.disabled,
+								color: opt.header ? void 0 : opt.disabled ? Colors.muted : isFocused ? Colors.accent : void 0,
+								bold: opt.header || isFocused && !opt.disabled,
+								dimColor: !opt.header && (!isFocused || opt.disabled),
 								children: label
 							})
 						]
@@ -5401,7 +5495,7 @@ async function runDoctorCI(options) {
 	getUI().intro("Welcome to the PostHog setup wizard");
 	getUI().log.info("Running posthog-doctor in CI mode");
 	try {
-		const { getOrAskForProjectData } = await import("./setup-utils-DhmigSLO.js").then((n) => n.r);
+		const { getOrAskForProjectData } = await import("./setup-utils-DLGNk8T6.js").then((n) => n.r);
 		const { host, accessToken, projectId } = await getOrAskForProjectData({
 			signup: false,
 			ci: true,
@@ -5419,7 +5513,7 @@ async function runDoctorCI(options) {
 		for (const issue of sorted) getUI().log.info(`  • [${issue.severity}] ${getKindMeta(issue.kind).title}`);
 		process.exit(1);
 	} catch (error) {
-		const { ApiError } = await import("./api-CyA47qug.js").then((n) => n.n);
+		const { ApiError } = await import("./api-T_WHs3qZ.js").then((n) => n.n);
 		const message = error instanceof ApiError && error.statusCode === 401 ? "Your PostHog API key is invalid or expired." : error instanceof Error ? error.message : String(error);
 		getUI().log.error(`Doctor failed: ${message}`);
 		process.exit(1);
@@ -5501,8 +5595,8 @@ function runSlackConnect(argv) {
 	(async () => {
 		const debug = argv.debug;
 		try {
-			const { startTUI } = await import("./start-tui-DKHnPg5a.js");
-			const { buildSession } = await import("./wizard-session-B1ZM4OBv.js");
+			const { startTUI } = await import("./start-tui-BjCKghQq.js");
+			const { buildSession } = await import("./wizard-session-C8W_6X0j.js");
 			const tui = startTUI(VERSION, Program.SlackConnect);
 			tui.store.session = buildSession({
 				debug,