@posthog/wizard 2.42.0 → 2.43.0

package/dist/{provisioning-CmpiiTaR.js.map → provisioning-BMXR8fS1.js.map}

@@ -1 +1 @@
-{"version":3,"file":"provisioning-CmpiiTaR.js","names":[],"sources":["../src/utils/urls.ts","../src/utils/provisioning.ts"],"sourcesContent":["import axios from 'axios';\nimport { IS_DEV, WIZARD_USER_AGENT } from '@lib/constants';\nimport type { CloudRegion } from './types';\n\n/**\n * Resolve a pinned PostHog base URL from an optional override. When present, it\n * becomes the single source of truth for every PostHog origin — the\n * API/ingestion host, the cloud/app URL, and the OAuth server — bypassing\n * region resolution entirely.\n *\n * The override lives on the session (`session.baseUrl`, set by `--base-url`) and\n * is threaded in by callers, so there is no hidden module-level state. A `--base-url`\n * value wins; otherwise a dev/test build implies `localhost:8010`; otherwise the\n * result is `undefined`, meaning region-based resolution applies.\n *\n * This is the runtime equivalent of the `IS_DEV` localhost routing: `IS_DEV` is a\n * build-time constant that tsdown compiles out of production builds, so it can't\n * point a shipped wizard at a local stack — `--base-url` can. Both feed this one\n * resolver so every URL helper only asks the question once.\n */\nexport const resolveBaseUrl = (override?: string): string | undefined => {\n  return override?.trim() || (IS_DEV ? 'http://localhost:8010' : undefined);\n};\n\nexport const getUiHostFromHost = (host: string) => {\n  if (host.includes('us.i.posthog.com')) {\n    return 'https://us.posthog.com';\n  }\n\n  if (host.includes('eu.i.posthog.com')) {\n    return 'https://eu.posthog.com';\n  }\n\n  return host;\n};\n\nexport const getHost = (region: CloudRegion, baseUrl?: string) => {\n  const override = resolveBaseUrl(baseUrl);\n  if (override) {\n    return override;\n  }\n\n  if (region === 'eu') {\n    return 'https://eu.i.posthog.com';\n  }\n\n  return 'https://us.i.posthog.com';\n};\n\nexport const getCloudUrl = (region: CloudRegion, baseUrl?: string) => {\n  const override = resolveBaseUrl(baseUrl);\n  if (override) {\n    return override;\n  }\n\n  if (region === 'eu') {\n    return 'https://eu.posthog.com';\n  }\n\n  return 'https://us.posthog.com';\n};\n\nexport async function detectRegion(\n  accessToken: string,\n  baseUrl?: string,\n): Promise<CloudRegion> {\n  // With a pinned base URL there is only one instance to talk to — skip the\n  // us/eu probe and default the region label to 'us'. (Covers IS_DEV too, via\n  // resolveBaseUrl.) The URLs themselves come from the override, not this label.\n  if (resolveBaseUrl(baseUrl)) {\n    return 'us';\n  }\n\n  const headers = {\n    Authorization: `Bearer ${accessToken}`,\n    'User-Agent': WIZARD_USER_AGENT,\n  };\n\n  const [usResult, euResult] = await Promise.allSettled([\n    axios.get('https://us.posthog.com/api/users/@me/', { headers }),\n    axios.get('https://eu.posthog.com/api/users/@me/', { headers }),\n  ]);\n\n  if (usResult.status === 'fulfilled') return 'us';\n  if (euResult.status === 'fulfilled') return 'eu';\n\n  throw new Error(\n    'Could not determine cloud region from access token. Please check your PostHog account.',\n  );\n}\n\nexport const getLlmGatewayUrl = (host: string) => {\n  if (host.includes('host.docker.internal')) {\n    return 'http://host.docker.internal:3308/wizard';\n  }\n\n  if (host.includes('localhost')) {\n    return 'http://localhost:3308/wizard';\n  }\n\n  if (host.includes('eu.posthog.com') || host.includes('eu.i.posthog.com')) {\n    return 'https://gateway.eu.posthog.com/wizard';\n  }\n\n  return 'https://gateway.us.posthog.com/wizard';\n};\n\n/** Region-agnostic prod OAuth server. Resolves to the right region server-side. */\nconst PROD_OAUTH_URL = 'https://oauth.posthog.com';\n\n/**\n * OAuth server URL. Follows the base-URL override (and thus IS_DEV → localhost),\n * otherwise the region-agnostic prod OAuth host.\n */\nexport const getOAuthUrl = (baseUrl?: string): string =>\n  resolveBaseUrl(baseUrl) ?? PROD_OAUTH_URL;\n","/**\n * Provisioning API client for creating new PostHog accounts.\n *\n * Uses the agentic provisioning API with PKCE auth:\n *   1. POST /account_requests  - create account, get auth code\n *   2. POST /oauth/token       - exchange code for tokens (with PKCE)\n *   3. POST /resources         - provision project, get API key\n */\n\nimport * as crypto from 'node:crypto';\nimport axios from 'axios';\nimport { z } from 'zod';\nimport {\n  POSTHOG_DEV_CLIENT_ID,\n  POSTHOG_US_CLIENT_ID,\n  WIZARD_PROVISIONING_SCOPES,\n  WIZARD_USER_AGENT,\n} from '@lib/constants';\nimport { resolveBaseUrl } from './urls';\nimport { logToFile } from './debug';\nimport { analytics } from './analytics';\nimport type { HostResolution } from '@lib/host-resolution';\n\nconst API_VERSION = '0.1d';\n\n/**\n * Provisioning host. Follows a `--base-url` override (and IS_DEV → localhost),\n * else the region-agnostic prod provisioning host (always US; the target region\n * is passed in the request body).\n *\n * // TODO: Make this work with EU provisioning.\n */\nconst getProvisioningBaseUrl = (baseUrl?: string): string =>\n  resolveBaseUrl(baseUrl) ?? 'https://us.posthog.com';\n\n/**\n * OAuth client ID for provisioning. A pinned base URL means a dev-seeded stack\n * that registers the dev client; prod uses the US client.\n *\n * TODO: same assumption as `getOAuthClientId` in oauth.ts — a pinned base URL is\n * treated as a dev-seeded instance. Make configurable if we ever point\n * `--base-url` at a non-dev instance with its own OAuth app.\n *\n * TODO: Make this work with EU provisioning.\n */\nconst getProvisioningClientId = (baseUrl?: string): string =>\n  resolveBaseUrl(baseUrl) ? POSTHOG_DEV_CLIENT_ID : POSTHOG_US_CLIENT_ID;\n\nfunction generateCodeVerifier(): string {\n  return crypto.randomBytes(32).toString('base64url');\n}\n\nfunction generateCodeChallenge(verifier: string): string {\n  return crypto.createHash('sha256').update(verifier).digest('base64url');\n}\n\n// --- Response schemas ---\n\nconst AccountRequestResponseSchema = z.object({\n  id: z.string(),\n  type: z.enum(['oauth', 'requires_auth', 'error']),\n  oauth: z\n    .object({\n      code: z.string(),\n    })\n    .optional(),\n  error: z\n    .object({\n      code: z.string(),\n      message: z.string(),\n    })\n    .optional(),\n});\n\nconst TokenResponseSchema = z.object({\n  token_type: z.string(),\n  access_token: z.string(),\n  refresh_token: z.string(),\n  expires_in: z.number(),\n  account: z\n    .object({\n      id: z.string(),\n    })\n    .optional(),\n});\n\nconst ResourceResponseSchema = z.object({\n  status: z.string(),\n  id: z.string(),\n  service_id: z.string(),\n  complete: z\n    .object({\n      access_configuration: z.object({\n        api_key: z.string(),\n        host: z.string(),\n        personal_api_key: z.string().optional(),\n      }),\n    })\n    .optional(),\n});\n\nexport interface ProvisioningResult {\n  accessToken: string;\n  refreshToken: string;\n  projectApiKey: string;\n  host: string;\n  personalApiKey?: string;\n  projectId: string;\n  accountId: string;\n}\n\n/**\n * Create a new PostHog account and provision a project via the provisioning API.\n *\n * This is the \"no browser\" signup path: the wizard collects the email,\n * calls the provisioning API to create the account, and gets back\n * credentials without opening a browser.\n */\nexport async function provisionNewAccount(\n  email: string,\n  name: string,\n  region: 'US' | 'EU' = 'US',\n  opts?: { orgName?: string; projectName?: string; baseUrl?: string },\n): Promise<ProvisioningResult> {\n  const codeVerifier = generateCodeVerifier();\n  const codeChallenge = generateCodeChallenge(codeVerifier);\n  const provisioningBaseUrl = getProvisioningBaseUrl(opts?.baseUrl);\n\n  logToFile('[provisioning] starting account creation');\n\n  // Step 1: Create account\n  const accountRes = await axios.post(\n    `${provisioningBaseUrl}/api/agentic/provisioning/account_requests`,\n    {\n      id: crypto.randomUUID(),\n      email,\n      name,\n      client_id: getProvisioningClientId(opts?.baseUrl),\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n      scopes: WIZARD_PROVISIONING_SCOPES,\n      configuration: {\n        region,\n        ...(opts?.orgName ? { organization_name: opts.orgName } : {}),\n      },\n    },\n    {\n      headers: {\n        'Content-Type': 'application/json',\n        'API-Version': API_VERSION,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      timeout: 30_000,\n    },\n  );\n\n  const accountData = AccountRequestResponseSchema.parse(accountRes.data);\n\n  if (accountData.type === 'error') {\n    const msg = accountData.error?.message ?? 'Account creation failed';\n    analytics.captureException(new Error(msg), {\n      step: 'provisioning_account_request',\n      error_code: accountData.error?.code,\n    });\n    throw new Error(msg);\n  }\n\n  if (accountData.type === 'requires_auth') {\n    throw new Error(\n      'This email is already associated with a PostHog account. Please use the login flow instead.',\n    );\n  }\n\n  const code = accountData.oauth?.code;\n  if (!code) {\n    throw new Error('No authorization code received from account creation');\n  }\n\n  logToFile('[provisioning] account created, exchanging code for tokens');\n\n  // Step 2: Exchange code for tokens\n  const tokenRes = await axios.post(\n    `${provisioningBaseUrl}/api/agentic/oauth/token`,\n    new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      code_verifier: codeVerifier,\n    }).toString(),\n    {\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'API-Version': API_VERSION,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      timeout: 30_000,\n    },\n  );\n\n  const tokenData = TokenResponseSchema.parse(tokenRes.data);\n\n  logToFile('[provisioning] tokens received, provisioning resources');\n\n  // Step 3: Provision resources\n  const resourceRes = await axios.post(\n    `${provisioningBaseUrl}/api/agentic/provisioning/resources`,\n    {\n      service_id: 'analytics',\n      ...(opts?.projectName\n        ? { configuration: { project_name: opts.projectName } }\n        : {}),\n    },\n    {\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${tokenData.access_token}`,\n        'API-Version': API_VERSION,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      timeout: 30_000,\n    },\n  );\n\n  const resourceData = ResourceResponseSchema.parse(resourceRes.data);\n\n  if (resourceData.status !== 'complete' || !resourceData.complete) {\n    throw new Error('Resource provisioning did not complete');\n  }\n\n  logToFile('[provisioning] resources provisioned successfully');\n\n  return {\n    accessToken: tokenData.access_token,\n    refreshToken: tokenData.refresh_token,\n    projectApiKey: resourceData.complete.access_configuration.api_key,\n    host: resourceData.complete.access_configuration.host,\n    personalApiKey: resourceData.complete.access_configuration.personal_api_key,\n    projectId: resourceData.id,\n    accountId: tokenData.account?.id ?? '',\n  };\n}\n\n/**\n * Request a one-time deep link URL that logs the user into PostHog\n * and redirects to their project dashboard — or, when `opts.path` is\n * given, to any safe in-app relative path (e.g. the Signals inbox).\n */\nexport async function requestDeepLink(\n  accessToken: string,\n  host: HostResolution,\n  opts?: { purpose?: string; path?: string },\n): Promise<string | null> {\n  try {\n    const baseUrl = host.appHost;\n\n    const res = await axios.post(\n      `${baseUrl}/api/agentic/provisioning/deep_links`,\n      {\n        purpose: opts?.purpose ?? 'dashboard',\n        ...(opts?.path ? { path: opts.path } : {}),\n      },\n      {\n        headers: {\n          'Content-Type': 'application/json',\n          Authorization: `Bearer ${accessToken}`,\n          'API-Version': API_VERSION,\n          'User-Agent': WIZARD_USER_AGENT,\n        },\n        timeout: 10_000,\n      },\n    );\n\n    const url = res.data?.url;\n    if (typeof url === 'string') {\n      logToFile(`[provisioning] deep link created: ${url}`);\n      return url;\n    }\n    return null;\n  } catch {\n    logToFile('[provisioning] deep link request failed, skipping');\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoBA,MAAa,kBAAkB,aAA0C;AACvE,QAAO,UAAU,MAAM,IAAwC,KAAA;;AAGjE,MAAa,qBAAqB,SAAiB;AACjD,KAAI,KAAK,SAAS,mBAAmB,CACnC,QAAO;AAGT,KAAI,KAAK,SAAS,mBAAmB,CACnC,QAAO;AAGT,QAAO;;AAGT,MAAa,WAAW,QAAqB,YAAqB;CAChE,MAAM,WAAW,eAAe,QAAQ;AACxC,KAAI,SACF,QAAO;AAGT,KAAI,WAAW,KACb,QAAO;AAGT,QAAO;;AAGT,MAAa,eAAe,QAAqB,YAAqB;CACpE,MAAM,WAAW,eAAe,QAAQ;AACxC,KAAI,SACF,QAAO;AAGT,KAAI,WAAW,KACb,QAAO;AAGT,QAAO;;AAGT,eAAsB,aACpB,aACA,SACsB;AAItB,KAAI,eAAe,QAAQ,CACzB,QAAO;CAGT,MAAM,UAAU;EACd,eAAe,UAAU;EACzB,cAAc;EACf;CAED,MAAM,CAAC,UAAU,YAAY,MAAM,QAAQ,WAAW,CACpD,MAAM,IAAI,yCAAyC,EAAE,SAAS,CAAC,EAC/D,MAAM,IAAI,yCAAyC,EAAE,SAAS,CAAC,CAChE,CAAC;AAEF,KAAI,SAAS,WAAW,YAAa,QAAO;AAC5C,KAAI,SAAS,WAAW,YAAa,QAAO;AAE5C,OAAM,IAAI,MACR,yFACD;;AAGH,MAAa,oBAAoB,SAAiB;AAChD,KAAI,KAAK,SAAS,uBAAuB,CACvC,QAAO;AAGT,KAAI,KAAK,SAAS,YAAY,CAC5B,QAAO;AAGT,KAAI,KAAK,SAAS,iBAAiB,IAAI,KAAK,SAAS,mBAAmB,CACtE,QAAO;AAGT,QAAO;;;AAIT,MAAM,iBAAiB;;;;;AAMvB,MAAa,eAAe,YAC1B,eAAe,QAAQ,IAAI;;;;;;;;;;;;;;;AC5F7B,MAAM,cAAc;;;;;;;;AASpB,MAAM,0BAA0B,YAC9B,eAAe,QAAQ,IAAI;;;;;;;;;;;AAY7B,MAAM,2BAA2B,YAC/B,eAAe,QAAQ,GAAG,wBAAwB;AAEpD,SAAS,uBAA+B;AACtC,QAAO,OAAO,YAAY,GAAG,CAAC,SAAS,YAAY;;AAGrD,SAAS,sBAAsB,UAA0B;AACvD,QAAO,OAAO,WAAW,SAAS,CAAC,OAAO,SAAS,CAAC,OAAO,YAAY;;AAKzE,MAAM,+BAA+B,EAAE,OAAO;CAC5C,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,KAAK;EAAC;EAAS;EAAiB;EAAQ,CAAC;CACjD,OAAO,EACJ,OAAO,EACN,MAAM,EAAE,QAAQ,EACjB,CAAC,CACD,UAAU;CACb,OAAO,EACJ,OAAO;EACN,MAAM,EAAE,QAAQ;EAChB,SAAS,EAAE,QAAQ;EACpB,CAAC,CACD,UAAU;CACd,CAAC;AAEF,MAAM,sBAAsB,EAAE,OAAO;CACnC,YAAY,EAAE,QAAQ;CACtB,cAAc,EAAE,QAAQ;CACxB,eAAe,EAAE,QAAQ;CACzB,YAAY,EAAE,QAAQ;CACtB,SAAS,EACN,OAAO,EACN,IAAI,EAAE,QAAQ,EACf,CAAC,CACD,UAAU;CACd,CAAC;AAEF,MAAM,yBAAyB,EAAE,OAAO;CACtC,QAAQ,EAAE,QAAQ;CAClB,IAAI,EAAE,QAAQ;CACd,YAAY,EAAE,QAAQ;CACtB,UAAU,EACP,OAAO,EACN,sBAAsB,EAAE,OAAO;EAC7B,SAAS,EAAE,QAAQ;EACnB,MAAM,EAAE,QAAQ;EAChB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;EACxC,CAAC,EACH,CAAC,CACD,UAAU;CACd,CAAC;;;;;;;;AAmBF,eAAsB,oBACpB,OACA,MACA,SAAsB,MACtB,MAC6B;CAC7B,MAAM,eAAe,sBAAsB;CAC3C,MAAM,gBAAgB,sBAAsB,aAAa;CACzD,MAAM,sBAAsB,uBAAuB,MAAM,QAAQ;AAEjE,WAAU,2CAA2C;CAGrD,MAAM,aAAa,MAAM,MAAM,KAC7B,GAAG,oBAAoB,6CACvB;EACE,IAAI,OAAO,YAAY;EACvB;EACA;EACA,WAAW,wBAAwB,MAAM,QAAQ;EACjD,gBAAgB;EAChB,uBAAuB;EACvB,QAAQ;EACR,eAAe;GACb;GACA,GAAI,MAAM,UAAU,EAAE,mBAAmB,KAAK,SAAS,GAAG,EAAE;GAC7D;EACF,EACD;EACE,SAAS;GACP,gBAAgB;GAChB,eAAe;GACf,cAAc;GACf;EACD,SAAS;EACV,CACF;CAED,MAAM,cAAc,6BAA6B,MAAM,WAAW,KAAK;AAEvE,KAAI,YAAY,SAAS,SAAS;EAChC,MAAM,MAAM,YAAY,OAAO,WAAW;AAC1C,YAAU,iBAAiB,IAAI,MAAM,IAAI,EAAE;GACzC,MAAM;GACN,YAAY,YAAY,OAAO;GAChC,CAAC;AACF,QAAM,IAAI,MAAM,IAAI;;AAGtB,KAAI,YAAY,SAAS,gBACvB,OAAM,IAAI,MACR,8FACD;CAGH,MAAM,OAAO,YAAY,OAAO;AAChC,KAAI,CAAC,KACH,OAAM,IAAI,MAAM,uDAAuD;AAGzE,WAAU,6DAA6D;CAGvE,MAAM,WAAW,MAAM,MAAM,KAC3B,GAAG,oBAAoB,2BACvB,IAAI,gBAAgB;EAClB,YAAY;EACZ;EACA,eAAe;EAChB,CAAC,CAAC,UAAU,EACb;EACE,SAAS;GACP,gBAAgB;GAChB,eAAe;GACf,cAAc;GACf;EACD,SAAS;EACV,CACF;CAED,MAAM,YAAY,oBAAoB,MAAM,SAAS,KAAK;AAE1D,WAAU,yDAAyD;CAGnE,MAAM,cAAc,MAAM,MAAM,KAC9B,GAAG,oBAAoB,sCACvB;EACE,YAAY;EACZ,GAAI,MAAM,cACN,EAAE,eAAe,EAAE,cAAc,KAAK,aAAa,EAAE,GACrD,EAAE;EACP,EACD;EACE,SAAS;GACP,gBAAgB;GAChB,eAAe,UAAU,UAAU;GACnC,eAAe;GACf,cAAc;GACf;EACD,SAAS;EACV,CACF;CAED,MAAM,eAAe,uBAAuB,MAAM,YAAY,KAAK;AAEnE,KAAI,aAAa,WAAW,cAAc,CAAC,aAAa,SACtD,OAAM,IAAI,MAAM,yCAAyC;AAG3D,WAAU,oDAAoD;AAE9D,QAAO;EACL,aAAa,UAAU;EACvB,cAAc,UAAU;EACxB,eAAe,aAAa,SAAS,qBAAqB;EAC1D,MAAM,aAAa,SAAS,qBAAqB;EACjD,gBAAgB,aAAa,SAAS,qBAAqB;EAC3D,WAAW,aAAa;EACxB,WAAW,UAAU,SAAS,MAAM;EACrC;;;;;;;AAQH,eAAsB,gBACpB,aACA,MACA,MACwB;AACxB,KAAI;EACF,MAAM,UAAU,KAAK;EAmBrB,MAAM,OAjBM,MAAM,MAAM,KACtB,GAAG,QAAQ,uCACX;GACE,SAAS,MAAM,WAAW;GAC1B,GAAI,MAAM,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE;GAC1C,EACD;GACE,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;IACzB,eAAe;IACf,cAAc;IACf;GACD,SAAS;GACV,CACF,EAEe,MAAM;AACtB,MAAI,OAAO,QAAQ,UAAU;AAC3B,aAAU,qCAAqC,MAAM;AACrD,UAAO;;AAET,SAAO;SACD;AACN,YAAU,oDAAoD;AAC9D,SAAO"}
+{"version":3,"file":"provisioning-BMXR8fS1.js","names":[],"sources":["../src/utils/urls.ts","../src/utils/provisioning.ts"],"sourcesContent":["import axios from 'axios';\nimport { IS_DEV, WIZARD_USER_AGENT } from '@lib/constants';\nimport type { CloudRegion } from './types';\n\n/**\n * Resolve a pinned PostHog base URL from an optional override. When present, it\n * becomes the single source of truth for every PostHog origin — the\n * API/ingestion host, the cloud/app URL, and the OAuth server — bypassing\n * region resolution entirely.\n *\n * The override lives on the session (`session.baseUrl`, set by `--base-url`) and\n * is threaded in by callers, so there is no hidden module-level state. A `--base-url`\n * value wins; otherwise a dev/test build implies `localhost:8010`; otherwise the\n * result is `undefined`, meaning region-based resolution applies.\n *\n * This is the runtime equivalent of the `IS_DEV` localhost routing: `IS_DEV` is a\n * build-time constant that tsdown compiles out of production builds, so it can't\n * point a shipped wizard at a local stack — `--base-url` can. Both feed this one\n * resolver so every URL helper only asks the question once.\n */\nexport const resolveBaseUrl = (override?: string): string | undefined => {\n  return override?.trim() || (IS_DEV ? 'http://localhost:8010' : undefined);\n};\n\nexport const getUiHostFromHost = (host: string) => {\n  if (host.includes('us.i.posthog.com')) {\n    return 'https://us.posthog.com';\n  }\n\n  if (host.includes('eu.i.posthog.com')) {\n    return 'https://eu.posthog.com';\n  }\n\n  return host;\n};\n\nexport const getHost = (region: CloudRegion, baseUrl?: string) => {\n  const override = resolveBaseUrl(baseUrl);\n  if (override) {\n    return override;\n  }\n\n  if (region === 'eu') {\n    return 'https://eu.i.posthog.com';\n  }\n\n  return 'https://us.i.posthog.com';\n};\n\nexport const getCloudUrl = (region: CloudRegion, baseUrl?: string) => {\n  const override = resolveBaseUrl(baseUrl);\n  if (override) {\n    return override;\n  }\n\n  if (region === 'eu') {\n    return 'https://eu.posthog.com';\n  }\n\n  return 'https://us.posthog.com';\n};\n\nexport async function detectRegion(\n  accessToken: string,\n  baseUrl?: string,\n): Promise<CloudRegion> {\n  // With a pinned base URL there is only one instance to talk to — skip the\n  // us/eu probe and default the region label to 'us'. (Covers IS_DEV too, via\n  // resolveBaseUrl.) The URLs themselves come from the override, not this label.\n  if (resolveBaseUrl(baseUrl)) {\n    return 'us';\n  }\n\n  const headers = {\n    Authorization: `Bearer ${accessToken}`,\n    'User-Agent': WIZARD_USER_AGENT,\n  };\n\n  const [usResult, euResult] = await Promise.allSettled([\n    axios.get('https://us.posthog.com/api/users/@me/', { headers }),\n    axios.get('https://eu.posthog.com/api/users/@me/', { headers }),\n  ]);\n\n  if (usResult.status === 'fulfilled') return 'us';\n  if (euResult.status === 'fulfilled') return 'eu';\n\n  throw new Error(\n    'Could not determine cloud region from access token. Please check your PostHog account.',\n  );\n}\n\nexport const getLlmGatewayUrl = (host: string) => {\n  if (host.includes('host.docker.internal')) {\n    return 'http://host.docker.internal:3308/wizard';\n  }\n\n  if (host.includes('localhost')) {\n    return 'http://localhost:3308/wizard';\n  }\n\n  if (host.includes('eu.posthog.com') || host.includes('eu.i.posthog.com')) {\n    return 'https://gateway.eu.posthog.com/wizard';\n  }\n\n  return 'https://gateway.us.posthog.com/wizard';\n};\n\n/** Region-agnostic prod OAuth server. Resolves to the right region server-side. */\nconst PROD_OAUTH_URL = 'https://oauth.posthog.com';\n\n/**\n * OAuth server URL. Follows the base-URL override (and thus IS_DEV → localhost),\n * otherwise the region-agnostic prod OAuth host.\n */\nexport const getOAuthUrl = (baseUrl?: string): string =>\n  resolveBaseUrl(baseUrl) ?? PROD_OAUTH_URL;\n","/**\n * Provisioning API client for creating new PostHog accounts.\n *\n * Uses the agentic provisioning API with PKCE auth:\n *   1. POST /account_requests  - create account, get auth code\n *   2. POST /oauth/token       - exchange code for tokens (with PKCE)\n *   3. POST /resources         - provision project, get API key\n */\n\nimport * as crypto from 'node:crypto';\nimport axios from 'axios';\nimport { z } from 'zod';\nimport {\n  POSTHOG_DEV_CLIENT_ID,\n  POSTHOG_US_CLIENT_ID,\n  WIZARD_PROVISIONING_SCOPES,\n  WIZARD_USER_AGENT,\n} from '@lib/constants';\nimport { resolveBaseUrl } from './urls';\nimport { logToFile } from './debug';\nimport { analytics } from './analytics';\nimport type { HostResolution } from '@lib/host-resolution';\n\nconst API_VERSION = '0.1d';\n\n/**\n * Provisioning host. Follows a `--base-url` override (and IS_DEV → localhost),\n * else the region-agnostic prod provisioning host (always US; the target region\n * is passed in the request body).\n *\n * // TODO: Make this work with EU provisioning.\n */\nconst getProvisioningBaseUrl = (baseUrl?: string): string =>\n  resolveBaseUrl(baseUrl) ?? 'https://us.posthog.com';\n\n/**\n * OAuth client ID for provisioning. A pinned base URL means a dev-seeded stack\n * that registers the dev client; prod uses the US client.\n *\n * TODO: same assumption as `getOAuthClientId` in oauth.ts — a pinned base URL is\n * treated as a dev-seeded instance. Make configurable if we ever point\n * `--base-url` at a non-dev instance with its own OAuth app.\n *\n * TODO: Make this work with EU provisioning.\n */\nconst getProvisioningClientId = (baseUrl?: string): string =>\n  resolveBaseUrl(baseUrl) ? POSTHOG_DEV_CLIENT_ID : POSTHOG_US_CLIENT_ID;\n\nfunction generateCodeVerifier(): string {\n  return crypto.randomBytes(32).toString('base64url');\n}\n\nfunction generateCodeChallenge(verifier: string): string {\n  return crypto.createHash('sha256').update(verifier).digest('base64url');\n}\n\n// --- Response schemas ---\n\nconst AccountRequestResponseSchema = z.object({\n  id: z.string(),\n  type: z.enum(['oauth', 'requires_auth', 'error']),\n  oauth: z\n    .object({\n      code: z.string(),\n    })\n    .optional(),\n  error: z\n    .object({\n      code: z.string(),\n      message: z.string(),\n    })\n    .optional(),\n});\n\nconst TokenResponseSchema = z.object({\n  token_type: z.string(),\n  access_token: z.string(),\n  refresh_token: z.string(),\n  expires_in: z.number(),\n  account: z\n    .object({\n      id: z.string(),\n    })\n    .optional(),\n});\n\nconst ResourceResponseSchema = z.object({\n  status: z.string(),\n  id: z.string(),\n  service_id: z.string(),\n  complete: z\n    .object({\n      access_configuration: z.object({\n        api_key: z.string(),\n        host: z.string(),\n        personal_api_key: z.string().optional(),\n      }),\n    })\n    .optional(),\n});\n\nexport interface ProvisioningResult {\n  accessToken: string;\n  refreshToken: string;\n  projectApiKey: string;\n  host: string;\n  personalApiKey?: string;\n  projectId: string;\n  accountId: string;\n}\n\n/**\n * Create a new PostHog account and provision a project via the provisioning API.\n *\n * This is the \"no browser\" signup path: the wizard collects the email,\n * calls the provisioning API to create the account, and gets back\n * credentials without opening a browser.\n */\nexport async function provisionNewAccount(\n  email: string,\n  name: string,\n  region: 'US' | 'EU' = 'US',\n  opts?: { orgName?: string; projectName?: string; baseUrl?: string },\n): Promise<ProvisioningResult> {\n  const codeVerifier = generateCodeVerifier();\n  const codeChallenge = generateCodeChallenge(codeVerifier);\n  const provisioningBaseUrl = getProvisioningBaseUrl(opts?.baseUrl);\n\n  logToFile('[provisioning] starting account creation');\n\n  // Step 1: Create account\n  const accountRes = await axios.post(\n    `${provisioningBaseUrl}/api/agentic/provisioning/account_requests`,\n    {\n      id: crypto.randomUUID(),\n      email,\n      name,\n      client_id: getProvisioningClientId(opts?.baseUrl),\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n      scopes: WIZARD_PROVISIONING_SCOPES,\n      configuration: {\n        region,\n        ...(opts?.orgName ? { organization_name: opts.orgName } : {}),\n      },\n    },\n    {\n      headers: {\n        'Content-Type': 'application/json',\n        'API-Version': API_VERSION,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      timeout: 30_000,\n    },\n  );\n\n  const accountData = AccountRequestResponseSchema.parse(accountRes.data);\n\n  if (accountData.type === 'error') {\n    const msg = accountData.error?.message ?? 'Account creation failed';\n    analytics.captureException(new Error(msg), {\n      step: 'provisioning_account_request',\n      error_code: accountData.error?.code,\n    });\n    throw new Error(msg);\n  }\n\n  if (accountData.type === 'requires_auth') {\n    throw new Error(\n      'This email is already associated with a PostHog account. Please use the login flow instead.',\n    );\n  }\n\n  const code = accountData.oauth?.code;\n  if (!code) {\n    throw new Error('No authorization code received from account creation');\n  }\n\n  logToFile('[provisioning] account created, exchanging code for tokens');\n\n  // Step 2: Exchange code for tokens\n  const tokenRes = await axios.post(\n    `${provisioningBaseUrl}/api/agentic/oauth/token`,\n    new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      code_verifier: codeVerifier,\n    }).toString(),\n    {\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'API-Version': API_VERSION,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      timeout: 30_000,\n    },\n  );\n\n  const tokenData = TokenResponseSchema.parse(tokenRes.data);\n\n  logToFile('[provisioning] tokens received, provisioning resources');\n\n  // Step 3: Provision resources\n  const resourceRes = await axios.post(\n    `${provisioningBaseUrl}/api/agentic/provisioning/resources`,\n    {\n      service_id: 'analytics',\n      ...(opts?.projectName\n        ? { configuration: { project_name: opts.projectName } }\n        : {}),\n    },\n    {\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${tokenData.access_token}`,\n        'API-Version': API_VERSION,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      timeout: 30_000,\n    },\n  );\n\n  const resourceData = ResourceResponseSchema.parse(resourceRes.data);\n\n  if (resourceData.status !== 'complete' || !resourceData.complete) {\n    throw new Error('Resource provisioning did not complete');\n  }\n\n  logToFile('[provisioning] resources provisioned successfully');\n\n  return {\n    accessToken: tokenData.access_token,\n    refreshToken: tokenData.refresh_token,\n    projectApiKey: resourceData.complete.access_configuration.api_key,\n    host: resourceData.complete.access_configuration.host,\n    personalApiKey: resourceData.complete.access_configuration.personal_api_key,\n    projectId: resourceData.id,\n    accountId: tokenData.account?.id ?? '',\n  };\n}\n\n/**\n * Request a one-time deep link URL that logs the user into PostHog\n * and redirects to their project dashboard — or, when `opts.path` is\n * given, to any safe in-app relative path (e.g. the Signals inbox).\n */\nexport async function requestDeepLink(\n  accessToken: string,\n  host: HostResolution,\n  opts?: { purpose?: string; path?: string },\n): Promise<string | null> {\n  try {\n    const baseUrl = host.appHost;\n\n    const res = await axios.post(\n      `${baseUrl}/api/agentic/provisioning/deep_links`,\n      {\n        purpose: opts?.purpose ?? 'dashboard',\n        ...(opts?.path ? { path: opts.path } : {}),\n      },\n      {\n        headers: {\n          'Content-Type': 'application/json',\n          Authorization: `Bearer ${accessToken}`,\n          'API-Version': API_VERSION,\n          'User-Agent': WIZARD_USER_AGENT,\n        },\n        timeout: 10_000,\n      },\n    );\n\n    const url = res.data?.url;\n    if (typeof url === 'string') {\n      logToFile(`[provisioning] deep link created: ${url}`);\n      return url;\n    }\n    return null;\n  } catch {\n    logToFile('[provisioning] deep link request failed, skipping');\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoBA,MAAa,kBAAkB,aAA0C;AACvE,QAAO,UAAU,MAAM,IAAwC,KAAA;;AAGjE,MAAa,qBAAqB,SAAiB;AACjD,KAAI,KAAK,SAAS,mBAAmB,CACnC,QAAO;AAGT,KAAI,KAAK,SAAS,mBAAmB,CACnC,QAAO;AAGT,QAAO;;AAGT,MAAa,WAAW,QAAqB,YAAqB;CAChE,MAAM,WAAW,eAAe,QAAQ;AACxC,KAAI,SACF,QAAO;AAGT,KAAI,WAAW,KACb,QAAO;AAGT,QAAO;;AAGT,MAAa,eAAe,QAAqB,YAAqB;CACpE,MAAM,WAAW,eAAe,QAAQ;AACxC,KAAI,SACF,QAAO;AAGT,KAAI,WAAW,KACb,QAAO;AAGT,QAAO;;AAGT,eAAsB,aACpB,aACA,SACsB;AAItB,KAAI,eAAe,QAAQ,CACzB,QAAO;CAGT,MAAM,UAAU;EACd,eAAe,UAAU;EACzB,cAAc;EACf;CAED,MAAM,CAAC,UAAU,YAAY,MAAM,QAAQ,WAAW,CACpD,MAAM,IAAI,yCAAyC,EAAE,SAAS,CAAC,EAC/D,MAAM,IAAI,yCAAyC,EAAE,SAAS,CAAC,CAChE,CAAC;AAEF,KAAI,SAAS,WAAW,YAAa,QAAO;AAC5C,KAAI,SAAS,WAAW,YAAa,QAAO;AAE5C,OAAM,IAAI,MACR,yFACD;;AAGH,MAAa,oBAAoB,SAAiB;AAChD,KAAI,KAAK,SAAS,uBAAuB,CACvC,QAAO;AAGT,KAAI,KAAK,SAAS,YAAY,CAC5B,QAAO;AAGT,KAAI,KAAK,SAAS,iBAAiB,IAAI,KAAK,SAAS,mBAAmB,CACtE,QAAO;AAGT,QAAO;;;AAIT,MAAM,iBAAiB;;;;;AAMvB,MAAa,eAAe,YAC1B,eAAe,QAAQ,IAAI;;;;;;;;;;;;;;;AC5F7B,MAAM,cAAc;;;;;;;;AASpB,MAAM,0BAA0B,YAC9B,eAAe,QAAQ,IAAI;;;;;;;;;;;AAY7B,MAAM,2BAA2B,YAC/B,eAAe,QAAQ,GAAG,wBAAwB;AAEpD,SAAS,uBAA+B;AACtC,QAAO,OAAO,YAAY,GAAG,CAAC,SAAS,YAAY;;AAGrD,SAAS,sBAAsB,UAA0B;AACvD,QAAO,OAAO,WAAW,SAAS,CAAC,OAAO,SAAS,CAAC,OAAO,YAAY;;AAKzE,MAAM,+BAA+B,EAAE,OAAO;CAC5C,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,KAAK;EAAC;EAAS;EAAiB;EAAQ,CAAC;CACjD,OAAO,EACJ,OAAO,EACN,MAAM,EAAE,QAAQ,EACjB,CAAC,CACD,UAAU;CACb,OAAO,EACJ,OAAO;EACN,MAAM,EAAE,QAAQ;EAChB,SAAS,EAAE,QAAQ;EACpB,CAAC,CACD,UAAU;CACd,CAAC;AAEF,MAAM,sBAAsB,EAAE,OAAO;CACnC,YAAY,EAAE,QAAQ;CACtB,cAAc,EAAE,QAAQ;CACxB,eAAe,EAAE,QAAQ;CACzB,YAAY,EAAE,QAAQ;CACtB,SAAS,EACN,OAAO,EACN,IAAI,EAAE,QAAQ,EACf,CAAC,CACD,UAAU;CACd,CAAC;AAEF,MAAM,yBAAyB,EAAE,OAAO;CACtC,QAAQ,EAAE,QAAQ;CAClB,IAAI,EAAE,QAAQ;CACd,YAAY,EAAE,QAAQ;CACtB,UAAU,EACP,OAAO,EACN,sBAAsB,EAAE,OAAO;EAC7B,SAAS,EAAE,QAAQ;EACnB,MAAM,EAAE,QAAQ;EAChB,kBAAkB,EAAE,QAAQ,CAAC,UAAU;EACxC,CAAC,EACH,CAAC,CACD,UAAU;CACd,CAAC;;;;;;;;AAmBF,eAAsB,oBACpB,OACA,MACA,SAAsB,MACtB,MAC6B;CAC7B,MAAM,eAAe,sBAAsB;CAC3C,MAAM,gBAAgB,sBAAsB,aAAa;CACzD,MAAM,sBAAsB,uBAAuB,MAAM,QAAQ;AAEjE,WAAU,2CAA2C;CAGrD,MAAM,aAAa,MAAM,MAAM,KAC7B,GAAG,oBAAoB,6CACvB;EACE,IAAI,OAAO,YAAY;EACvB;EACA;EACA,WAAW,wBAAwB,MAAM,QAAQ;EACjD,gBAAgB;EAChB,uBAAuB;EACvB,QAAQ;EACR,eAAe;GACb;GACA,GAAI,MAAM,UAAU,EAAE,mBAAmB,KAAK,SAAS,GAAG,EAAE;GAC7D;EACF,EACD;EACE,SAAS;GACP,gBAAgB;GAChB,eAAe;GACf,cAAc;GACf;EACD,SAAS;EACV,CACF;CAED,MAAM,cAAc,6BAA6B,MAAM,WAAW,KAAK;AAEvE,KAAI,YAAY,SAAS,SAAS;EAChC,MAAM,MAAM,YAAY,OAAO,WAAW;AAC1C,YAAU,iBAAiB,IAAI,MAAM,IAAI,EAAE;GACzC,MAAM;GACN,YAAY,YAAY,OAAO;GAChC,CAAC;AACF,QAAM,IAAI,MAAM,IAAI;;AAGtB,KAAI,YAAY,SAAS,gBACvB,OAAM,IAAI,MACR,8FACD;CAGH,MAAM,OAAO,YAAY,OAAO;AAChC,KAAI,CAAC,KACH,OAAM,IAAI,MAAM,uDAAuD;AAGzE,WAAU,6DAA6D;CAGvE,MAAM,WAAW,MAAM,MAAM,KAC3B,GAAG,oBAAoB,2BACvB,IAAI,gBAAgB;EAClB,YAAY;EACZ;EACA,eAAe;EAChB,CAAC,CAAC,UAAU,EACb;EACE,SAAS;GACP,gBAAgB;GAChB,eAAe;GACf,cAAc;GACf;EACD,SAAS;EACV,CACF;CAED,MAAM,YAAY,oBAAoB,MAAM,SAAS,KAAK;AAE1D,WAAU,yDAAyD;CAGnE,MAAM,cAAc,MAAM,MAAM,KAC9B,GAAG,oBAAoB,sCACvB;EACE,YAAY;EACZ,GAAI,MAAM,cACN,EAAE,eAAe,EAAE,cAAc,KAAK,aAAa,EAAE,GACrD,EAAE;EACP,EACD;EACE,SAAS;GACP,gBAAgB;GAChB,eAAe,UAAU,UAAU;GACnC,eAAe;GACf,cAAc;GACf;EACD,SAAS;EACV,CACF;CAED,MAAM,eAAe,uBAAuB,MAAM,YAAY,KAAK;AAEnE,KAAI,aAAa,WAAW,cAAc,CAAC,aAAa,SACtD,OAAM,IAAI,MAAM,yCAAyC;AAG3D,WAAU,oDAAoD;AAE9D,QAAO;EACL,aAAa,UAAU;EACvB,cAAc,UAAU;EACxB,eAAe,aAAa,SAAS,qBAAqB;EAC1D,MAAM,aAAa,SAAS,qBAAqB;EACjD,gBAAgB,aAAa,SAAS,qBAAqB;EAC3D,WAAW,aAAa;EACxB,WAAW,UAAU,SAAS,MAAM;EACrC;;;;;;;AAQH,eAAsB,gBACpB,aACA,MACA,MACwB;AACxB,KAAI;EACF,MAAM,UAAU,KAAK;EAmBrB,MAAM,OAjBM,MAAM,MAAM,KACtB,GAAG,QAAQ,uCACX;GACE,SAAS,MAAM,WAAW;GAC1B,GAAI,MAAM,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE;GAC1C,EACD;GACE,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;IACzB,eAAe;IACf,cAAc;IACf;GACD,SAAS;GACV,CACF,EAEe,MAAM;AACtB,MAAI,OAAO,QAAQ,UAAU;AAC3B,aAAU,qCAAqC,MAAM;AACrD,UAAO;;AAET,SAAO;SACD;AACN,YAAU,oDAAoD;AAC9D,SAAO"}

package/dist/{registry-DPriFJQI.js → registry-CsUUdVCd.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";
-import { f as getUI } from "./debug--QPXcpzv.js";
-import { a as createVersionBucket, c as detectAllPackageManagers, i as tryGetPackageJson } from "./setup-utils-C8yipMUt.js";
+import { f as getUI } from "./debug-DNEQR5DL.js";
+import { a as createVersionBucket, c as detectAllPackageManagers, i as tryGetPackageJson } from "./setup-utils-DkyEOBDx.js";
 import { n as getInstalledPackageVersion, r as hasDeclaredDependency, t as getDeclaredVersion } from "./package-json-CDs1ZVKu.js";
-import { a as gradlePackageManager, c as getPackageManagerName$1, i as detectPythonPackageManagers, l as getPythonVersion, n as composerPackageManager, o as swiftPackageManager, r as detectNodePackageManagers, s as detectPackageManager$1, t as bundlerPackageManager, u as getPythonVersionBucket } from "./package-manager-D_05Bmr0.js";
+import { a as gradlePackageManager, c as getPackageManagerName$1, i as detectPythonPackageManagers, l as getPythonVersion, n as composerPackageManager, o as swiftPackageManager, r as detectNodePackageManagers, s as detectPackageManager$1, t as bundlerPackageManager, u as getPythonVersionBucket } from "./package-manager-CBRR4_i4.js";
 import * as semver from "semver";
 import { major, minVersion } from "semver";
 import path from "path";
@@ -2909,4 +2909,4 @@ const FRAMEWORK_REGISTRY = {
 //#endregion
 export { SPINNER_MESSAGE as i, registry_exports as n, DEFAULT_PACKAGE_INSTALLATION as r, FRAMEWORK_REGISTRY as t };
 
-//# sourceMappingURL=registry-DPriFJQI.js.map
+//# sourceMappingURL=registry-CsUUdVCd.js.map