@posthog/wizard 2.58.0 → 2.60.0

package/dist/{analytics-Bvq5-kCh.js → analytics-B9V7x1Ma.js}

@@ -1,4 +1,4 @@
-import { C as ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, S as ANALYTICS_HOST_URL, _t as RUN_SURFACE, ht as VERSION, it as WIZARD_FLAG_KEYS, r as debug, s as logToFile, vt as TASK_ID, w as ANALYTICS_TEAM_TAG, yt as TASK_RUN_ID } from "./debug-Di-I0xld.js";
+import { C as ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, S as ANALYTICS_HOST_URL, _t as RUN_SURFACE, ht as VERSION, it as WIZARD_FLAG_KEYS, r as debug, s as logToFile, vt as TASK_ID, w as ANALYTICS_TEAM_TAG, yt as TASK_RUN_ID } from "./debug-D3Ucw2y1.js";
 import { PostHog } from "posthog-node";
 import { v4 } from "uuid";
 //#region src/utils/ci-flag-overrides.ts
@@ -281,4 +281,4 @@ const analytics = new Analytics();
 //#endregion
 export { ciExcludedTaskTypes as a, sessionProperties as i, analytics as n, groupsFromUser as r, Analytics as t };
 
-//# sourceMappingURL=analytics-Bvq5-kCh.js.map
+//# sourceMappingURL=analytics-B9V7x1Ma.js.map

package/dist/{analytics-Bvq5-kCh.js.map → analytics-B9V7x1Ma.js.map}

@@ -1 +1 @@
-{"version":3,"file":"analytics-Bvq5-kCh.js","names":["uuidv4"],"sources":["../src/utils/ci-flag-overrides.ts","../src/utils/analytics.ts"],"sourcesContent":["/**\n * CI-only feature-flag overrides.\n *\n * CI must route deterministically: a run that tests the orchestrator arm says\n * so explicitly instead of depending on a live feature flag someone can edit\n * mid-week. The override env var (see the allowlist in `env.ts`) is a JSON\n * object of flag key → value, merged over whatever PostHog returned.\n *\n * The override path exists only in CI builds (`pnpm build:ci`). Published\n * builds inline NODE_ENV as the literal \"production\", the guards collapse,\n * and tsdown strips the rest from the bundle — and the smoke test asserts the\n * env var names are physically absent from production output (which is also\n * why no comment in this file may spell them out), so this can never quietly\n * become a production surface.\n */\nimport { runtimeEnv } from '@env';\nimport { logToFile } from './debug';\n\nexport function applyCiFlagOverrides(\n  flags: Record<string, string>,\n  payloads: Record<string, unknown> = {},\n): { flags: Record<string, string>; payloads: Record<string, unknown> } {\n  // Compared inline (not via env.ts's IS_PRODUCTION_BUILD) so tsdown replaces\n  // it with a literal right here and the bundler can prove the rest of this\n  // function unreachable in production builds. The smoke test enforces that.\n  if (process.env.NODE_ENV === 'production') return { flags, payloads };\n\n  const raw = runtimeEnv('WIZARD_CI_FLAG_OVERRIDES');\n  if (!raw) return { flags, payloads };\n\n  let overrides: Record<string, unknown>;\n  try {\n    overrides = JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    // A malformed override is a CI misconfiguration. Fail the run loudly\n    // rather than silently testing whatever the live flags happen to say.\n    throw new Error(\n      'The CI flag-override env var is not valid JSON (expected {\"flag-key\": value, ...}).',\n    );\n  }\n\n  const mergedFlags = { ...flags };\n  const mergedPayloads = { ...payloads };\n  for (const [key, value] of Object.entries(overrides)) {\n    // An object/array override is a flag payload: the flag reads 'true' and\n    // the value rides the payload channel, matching a payload-carrying flag.\n    if (typeof value === 'object' && value !== null) {\n      mergedFlags[key] = 'true';\n      mergedPayloads[key] = value;\n    } else {\n      mergedFlags[key] = String(value);\n    }\n  }\n  logToFile('[flags] CI overrides applied', overrides);\n  return { flags: mergedFlags, payloads: mergedPayloads };\n}\n\n/**\n * Task types excluded from this run. The exclusion env var (see the allowlist\n * in `env.ts`) is a comma-separated list (e.g. `dashboard`), set by the CI\n * harness that owns the policy — the wizard and the served content stay\n * run-mode agnostic. CI-build only, same as the flag overrides: published\n * builds strip this path.\n */\nexport function ciExcludedTaskTypes(): readonly string[] {\n  if (process.env.NODE_ENV === 'production') return [];\n\n  const raw = runtimeEnv('WIZARD_CI_EXCLUDE_TASKS');\n  if (!raw) return [];\n  const types = raw\n    .split(',')\n    .map((t) => t.trim())\n    .filter(Boolean);\n  if (types.length > 0) logToFile('[flags] CI task exclusions', types);\n  return types;\n}\n","import { PostHog } from 'posthog-node';\nimport {\n  ANALYTICS_HOST_URL,\n  ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY,\n  ANALYTICS_TEAM_TAG,\n  WIZARD_FLAG_KEYS,\n} from '@lib/constants';\nimport type { WizardSession } from '@lib/wizard-session';\nimport type { ApiUser } from '@lib/api';\nimport { v4 as uuidv4 } from 'uuid';\nimport { IS_PRODUCTION_BUILD, RUN_SURFACE, TASK_ID, TASK_RUN_ID } from '@env';\nimport { VERSION } from '@lib/version';\nimport { debug, logToFile } from './debug';\nimport { applyCiFlagOverrides } from './ci-flag-overrides';\n\n/**\n * The invocation, reduced to flag-safe strings: the command word (first\n * positional, 'default' for the bare flow) and the sorted option NAMES.\n * Option values never leave the machine — they carry paths, emails, keys.\n */\nfunction invocationProperties(): { command: string; cli_flags: string } {\n  const args = process.argv.slice(2);\n  const command = args.find((a) => !a.startsWith('-')) ?? 'default';\n  const flags = [\n    ...new Set(\n      args\n        .filter((a) => a.startsWith('--'))\n        .map((a) => a.slice(2).split('=')[0]),\n    ),\n  ].sort();\n  return { command, cli_flags: flags.join(',') };\n}\n\n/**\n * Extract a standard property bag from the current session.\n * Used by store-level analytics and available for ad-hoc captures.\n */\nexport function sessionProperties(\n  session: WizardSession,\n): Record<string, unknown> {\n  return {\n    integration: session.integration,\n    detected_framework: session.detectedFrameworkLabel,\n    typescript: session.typescript,\n    project_id: session.credentials?.projectId,\n    discovered_features: session.discoveredFeatures,\n    additional_features: session.additionalFeatureQueue,\n    run_phase: session.runPhase,\n  };\n}\n\nexport function groupsFromUser(\n  user: ApiUser | null,\n  host: string,\n): Record<string, string> {\n  const groups: Record<string, string> = { instance: host };\n  if (!user) return groups;\n\n  const organizationId = user.organization?.id;\n  if (organizationId) groups.organization = organizationId;\n\n  const customerId = user.organization?.customer_id;\n  if (customerId) groups.customer = customerId;\n\n  const projectUuid = user.team?.uuid;\n  if (projectUuid) groups.project = projectUuid;\n\n  return groups;\n}\n\nconst WIZARD_FLAGS: ReadonlySet<string> = new Set(WIZARD_FLAG_KEYS);\n\n// Widen back to the SDK's shape — a filter on `true` never matches `'true'`.\nfunction flagResponseValue(value: string): string | boolean {\n  if (value === 'true') return true;\n  if (value === 'false') return false;\n  return value;\n}\n\nexport class Analytics {\n  private client: PostHog;\n  private tags: Record<string, string | boolean | number | null | undefined> =\n    {};\n  private distinctId?: string;\n  private anonymousId: string;\n  private _runId: string;\n  private sessionId: string | null = null;\n  private appName = 'wizard';\n  private activeFlags: Record<string, string> | null = null;\n  private activeFlagPayloads: Record<string, unknown> = {};\n  private groups: Record<string, string> = {};\n  private personProperties: Record<string, string> = {};\n  private terminalEventSent = false;\n\n  constructor() {\n    this.client = new PostHog(ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, {\n      host: ANALYTICS_HOST_URL,\n      flushAt: 1,\n      flushInterval: 0,\n      enableExceptionAutocapture: true,\n      before_send: (event) => {\n        if (!event) return event;\n        if (Object.keys(this.groups).length > 0) {\n          event.groups = { ...this.groups, ...event.groups };\n        }\n        // Autocaptured exceptions arrive with a random uuid and\n        // `$process_person_profile: false` — reattach the run's identity\n        // and tags so they land on the same person as everything else.\n        if (event.event === '$exception') {\n          event.distinctId = this.distinctId ?? this.anonymousId;\n          const { $process_person_profile, ...properties } =\n            event.properties ?? {};\n          void $process_person_profile;\n          event.properties = { ...this.tags, ...properties };\n        }\n        // The SDK captures this one itself, bypassing capture(), so tags merge here.\n        if (event.event === '$feature_flag_called') {\n          event.properties = { ...this.tags, ...(event.properties ?? {}) };\n        }\n        return event;\n      },\n    });\n\n    this.tags = { $app_name: this.appName };\n    // Tag every run with its build type so prod / dev / ci / headless segment\n    // cleanly in analytics. tsdown inlines IS_PRODUCTION_BUILD to `true` in\n    // published builds and `false` for dev/tsx/test runs. Non-interactive runs\n    // upgrade this in runWizardCI: dev `--ci` runs to 'ci', published headless\n    // runs to 'headless'.\n    this.tags.build = IS_PRODUCTION_BUILD ? 'prod' : 'dev';\n\n    this.tags.run_surface = RUN_SURFACE;\n\n    // The build this run came from. Already sent as a flag-evaluation person\n    // property; tagging it makes every event attributable to a release, so a\n    // regression can be bounded to the versions that carry it.\n    this.tags.version = VERSION;\n\n    // Cloud runs only: the task run that owns the sandbox. Without these the\n    // wizard's events and the run that launched it are two unrelated streams,\n    // since run_id above is minted per process and never leaves the wizard.\n    // Left unset for local runs so the properties stay absent rather than null.\n    if (TASK_RUN_ID) this.tags.task_run_id = TASK_RUN_ID;\n    if (TASK_ID) this.tags.task_id = TASK_ID;\n\n    this.anonymousId = uuidv4();\n\n    // One id per process = one id per wizard run, registered in the tag bag\n    // so it rides on every capture, exception, and autocaptured exception\n    // (all of which merge `this.tags`). Lets you separate two runs by the\n    // same logged-in user, who otherwise share one distinct id. Distinct\n    // from `anonymousId`, the pre-login *person* id that gets aliased onto\n    // the real user at login. `$session_id` is intentionally not set here —\n    // it stays null until OAuth completes (see identifyUser).\n    this._runId = uuidv4();\n    this.tags.run_id = this._runId;\n\n    this.distinctId = undefined;\n  }\n\n  /** Per-process run id, tagged on every event and gateway trace. */\n  get runId(): string {\n    return this._runId;\n  }\n\n  /** Build type for this run ('prod' | 'dev' | 'ci' | 'headless') — the same value tagged on every analytics event. */\n  get build(): string {\n    return String(this.tags.build ?? 'dev');\n  }\n\n  /**\n   * Associate the run with the logged-in user, once per id. Identifies them\n   * (email, name) and records those person properties so events carry them and\n   * feature flags can target the individual user — without the email here the\n   * wizard only sends `$app_name`, so email-targeted flags never match. Opens\n   * the analytics session on first login, then aliases the run's anonymous id\n   * onto the identified person so pre-login events merge in.\n   */\n  identifyUser(user: ApiUser) {\n    const distinctId = user.distinct_id;\n    if (this.distinctId === distinctId || distinctId === this.anonymousId) {\n      return;\n    }\n    this.distinctId = distinctId;\n    // Open the analytics session on first login. Null until here, so\n    // pre-OAuth events carry only `run_id`; from now on every event also\n    // carries `$session_id` and PostHog groups the authenticated run into a\n    // native Session. Stored in the tag bag so it rides on every subsequent\n    // capture and exception.\n    if (!this.sessionId) {\n      this.sessionId = uuidv4();\n      this.tags.$session_id = this.sessionId;\n    }\n    const props: Record<string, string> = {};\n    if (user.email) props.email = user.email;\n    const name = [user.first_name, user.last_name]\n      .filter(Boolean)\n      .join(' ')\n      .trim();\n    if (name) props.name = name;\n    this.personProperties = props;\n    this.client.identify({ distinctId, properties: { $set: props } });\n    this.client.alias({\n      distinctId,\n      alias: this.anonymousId,\n    });\n    // The flag snapshot is per identity. Anything evaluated before login (the\n    // intro screen reads the tools-menu flag) was anonymous — drop it so the\n    // next read re-evaluates as this user.\n    this.activeFlags = null;\n    this.activeFlagPayloads = {};\n  }\n\n  /** Person properties sent with flag evaluation: app name plus the user's. */\n  private flagPersonProperties(): Record<string, string> {\n    // Environment facts flag conditions can scope on — evaluation-time only,\n    // never persisted onto the person. `version` gates an experiment to\n    // releases that implement it (a condition on a property older builds\n    // don't send silently never matches them); `run_surface`/`build` scope\n    // by invocation surface; `command`/`cli_flags` by subcommand; `os`/\n    // `node_major` by platform.\n    return {\n      $app_name: this.appName,\n      version: VERSION,\n      run_surface: RUN_SURFACE,\n      build: String(this.tags.build ?? 'dev'),\n      os: process.platform,\n      node_major: process.versions.node.split('.')[0],\n      ...invocationProperties(),\n      ...this.personProperties,\n    };\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  setGroups(groups: Record<string, string>) {\n    this.groups = groups;\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    this.client.captureException(error, this.distinctId ?? this.anonymousId, {\n      team: ANALYTICS_TEAM_TAG,\n      ...this.tags,\n      ...properties,\n    });\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: eventName,\n      properties: {\n        ...this.tags,\n        ...this.wizardFlagFeatureProperties(),\n        ...properties,\n      },\n    });\n  }\n\n  // Built from the resolved map, not the SDK snapshot: a CI-forced variant must own its events.\n  private wizardFlagFeatureProperties(): Record<string, unknown> {\n    if (this.activeFlags === null) return {};\n    const props: Record<string, unknown> = {};\n    const active: string[] = [];\n    for (const [key, value] of Object.entries(this.activeFlags)) {\n      if (!WIZARD_FLAGS.has(key)) continue;\n      const resolved = flagResponseValue(value);\n      props[`$feature/${key}`] = resolved;\n      if (resolved !== false) active.push(key);\n    }\n    if (active.length > 0) props.$active_feature_flags = active.sort();\n    return props;\n  }\n\n  /**\n   * Capture a wizard-specific event. Automatically prepends \"wizard: \" to the event name.\n   * All new wizard analytics should use this method instead of capture() directly.\n   */\n  wizardCapture(eventName: string, properties?: Record<string, unknown>): void {\n    this.capture(`wizard: ${eventName}`, properties);\n  }\n\n  /**\n   * Flush pending events without firing the \"setup wizard finished\" terminal\n   * event. Use this from CLI error paths that exit before any wizard run\n   * starts — `shutdown()` would inflate the run count with a \"finished\" event\n   * for a parse error that never actually ran the wizard.\n   */\n  async flush(): Promise<void> {\n    await this.client.shutdown();\n  }\n\n  /**\n   * Evaluate all feature flags for the current user at the start of a run.\n   * Result is cached; subsequent calls in the same run return the same map.\n   * Returns flag key -> string value (booleans become 'true'/'false').\n   */\n  // Only a getFlag read records an exposure; the bulk response records none.\n  async getAllFlagsForWizard(): Promise<Record<string, string>> {\n    if (this.activeFlags !== null) {\n      return this.activeFlags;\n    }\n    const out: Record<string, string> = {};\n    const payloads: Record<string, unknown> = {};\n    try {\n      const distinctId = this.distinctId ?? this.anonymousId;\n      logToFile('[flags] evaluating as', {\n        distinctId,\n        identified: this.distinctId !== undefined,\n        personProperties: this.flagPersonProperties(),\n      });\n      const evaluation = await this.client.evaluateFlags(distinctId, {\n        personProperties: this.flagPersonProperties(),\n      });\n      for (const key of WIZARD_FLAG_KEYS) {\n        const value = evaluation.getFlag(key);\n        if (value === undefined) continue;\n        out[key] = String(value);\n        const payload = evaluation.getFlagPayload(key);\n        if (payload !== undefined) payloads[key] = payload;\n      }\n    } catch (error) {\n      debug('Failed to get all feature flags:', error);\n      this.captureException(\n        error instanceof Error ? error : new Error(String(error)),\n        { step: 'get_all_flags' },\n      );\n    }\n    // Outside the fetch guard on purpose: a malformed CI override must fail\n    // the run loudly, and a valid one applies even when the fetch failed —\n    // CI routing stays deterministic either way.\n    const merged = applyCiFlagOverrides(out, payloads);\n    this.activeFlags = merged.flags;\n    this.activeFlagPayloads = merged.payloads;\n    logToFile('[flags] evaluated', this.activeFlags);\n    return this.activeFlags;\n  }\n\n  /** Flag payloads from the same snapshot; empty until the flags are fetched. */\n  getWizardFlagPayloads(): Record<string, unknown> {\n    return this.activeFlagPayloads;\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (Object.keys(this.tags).length === 0) {\n      return;\n    }\n\n    // First status wins. The interrupt fallback in start-tui fires\n    // shutdown('cancelled') on every TUI teardown; without this guard a run\n    // that already reported 'success' would emit a second, contradicting\n    // terminal event when the user dismisses the outro.\n    if (this.terminalEventSent) {\n      return;\n    }\n    this.terminalEventSent = true;\n\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: 'setup wizard finished',\n      properties: {\n        // Flat for filtering; the nested `tags` snapshot stays for back-compat.\n        ...this.tags,\n        run_id: this._runId,\n        ...(this.sessionId ? { $session_id: this.sessionId } : {}),\n        status,\n        tags: this.tags,\n      },\n    });\n\n    await this.client.shutdown();\n  }\n}\n\nexport const analytics = new Analytics();\n"],"mappings":";;;;AAkBA,SAAgB,qBACd,OACA,WAAoC,EAAE,EACgC;AAI3B,QAAO;EAAE;EAAO;EAAU;;;;;;;;;AAuCvE,SAAgB,sBAAyC;AACZ,QAAO,EAAE;;;;;;;;;AC7CtD,SAAS,uBAA+D;CACtE,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE;AASlC,QAAO;EAAE,SARO,KAAK,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC,IAAI;EAQtC,WAPJ,CACZ,GAAG,IAAI,IACL,KACG,QAAQ,MAAM,EAAE,WAAW,KAAK,CAAC,CACjC,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,CACxC,CACF,CAAC,MAAM,CAC2B,KAAK,IAAI;EAAE;;;;;;AAOhD,SAAgB,kBACd,SACyB;AACzB,QAAO;EACL,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,YAAY,QAAQ;EACpB,YAAY,QAAQ,aAAa;EACjC,qBAAqB,QAAQ;EAC7B,qBAAqB,QAAQ;EAC7B,WAAW,QAAQ;EACpB;;AAGH,SAAgB,eACd,MACA,MACwB;CACxB,MAAM,SAAiC,EAAE,UAAU,MAAM;AACzD,KAAI,CAAC,KAAM,QAAO;CAElB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,KAAI,eAAgB,QAAO,eAAe;CAE1C,MAAM,aAAa,KAAK,cAAc;AACtC,KAAI,WAAY,QAAO,WAAW;CAElC,MAAM,cAAc,KAAK,MAAM;AAC/B,KAAI,YAAa,QAAO,UAAU;AAElC,QAAO;;AAGT,MAAM,eAAoC,IAAI,IAAI,iBAAiB;AAGnE,SAAS,kBAAkB,OAAiC;AAC1D,KAAI,UAAU,OAAQ,QAAO;AAC7B,KAAI,UAAU,QAAS,QAAO;AAC9B,QAAO;;AAGT,IAAa,YAAb,MAAuB;CACrB;CACA,OACE,EAAE;CACJ;CACA;CACA;CACA,YAAmC;CACnC,UAAkB;CAClB,cAAqD;CACrD,qBAAsD,EAAE;CACxD,SAAyC,EAAE;CAC3C,mBAAmD,EAAE;CACrD,oBAA4B;CAE5B,cAAc;AACZ,OAAK,SAAS,IAAI,QAAQ,4CAA4C;GACpE,MAAM;GACN,SAAS;GACT,eAAe;GACf,4BAA4B;GAC5B,cAAc,UAAU;AACtB,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,OAAO,KAAK,KAAK,OAAO,CAAC,SAAS,EACpC,OAAM,SAAS;KAAE,GAAG,KAAK;KAAQ,GAAG,MAAM;KAAQ;AAKpD,QAAI,MAAM,UAAU,cAAc;AAChC,WAAM,aAAa,KAAK,cAAc,KAAK;KAC3C,MAAM,EAAE,yBAAyB,GAAG,eAClC,MAAM,cAAc,EAAE;AAExB,WAAM,aAAa;MAAE,GAAG,KAAK;MAAM,GAAG;MAAY;;AAGpD,QAAI,MAAM,UAAU,uBAClB,OAAM,aAAa;KAAE,GAAG,KAAK;KAAM,GAAI,MAAM,cAAc,EAAE;KAAG;AAElE,WAAO;;GAEV,CAAC;AAEF,OAAK,OAAO,EAAE,WAAW,KAAK,SAAS;AAMvC,OAAK,KAAK,QAA8B;AAExC,OAAK,KAAK,cAAc;AAKxB,OAAK,KAAK,UAAU;AAMpB,MAAI,YAAa,MAAK,KAAK,cAAc;AACzC,MAAI,QAAS,MAAK,KAAK,UAAU;AAEjC,OAAK,cAAcA,IAAQ;AAS3B,OAAK,SAASA,IAAQ;AACtB,OAAK,KAAK,SAAS,KAAK;AAExB,OAAK,aAAa,KAAA;;;CAIpB,IAAI,QAAgB;AAClB,SAAO,KAAK;;;CAId,IAAI,QAAgB;AAClB,SAAO,OAAO,KAAK,KAAK,SAAS,MAAM;;;;;;;;;;CAWzC,aAAa,MAAe;EAC1B,MAAM,aAAa,KAAK;AACxB,MAAI,KAAK,eAAe,cAAc,eAAe,KAAK,YACxD;AAEF,OAAK,aAAa;AAMlB,MAAI,CAAC,KAAK,WAAW;AACnB,QAAK,YAAYA,IAAQ;AACzB,QAAK,KAAK,cAAc,KAAK;;EAE/B,MAAM,QAAgC,EAAE;AACxC,MAAI,KAAK,MAAO,OAAM,QAAQ,KAAK;EACnC,MAAM,OAAO,CAAC,KAAK,YAAY,KAAK,UAAU,CAC3C,OAAO,QAAQ,CACf,KAAK,IAAI,CACT,MAAM;AACT,MAAI,KAAM,OAAM,OAAO;AACvB,OAAK,mBAAmB;AACxB,OAAK,OAAO,SAAS;GAAE;GAAY,YAAY,EAAE,MAAM,OAAO;GAAE,CAAC;AACjE,OAAK,OAAO,MAAM;GAChB;GACA,OAAO,KAAK;GACb,CAAC;AAIF,OAAK,cAAc;AACnB,OAAK,qBAAqB,EAAE;;;CAI9B,uBAAuD;AAOrD,SAAO;GACL,WAAW,KAAK;GAChB,SAAS;GACT,aAAa;GACb,OAAO,OAAO,KAAK,KAAK,SAAS,MAAM;GACvC,IAAI,QAAQ;GACZ,YAAY,QAAQ,SAAS,KAAK,MAAM,IAAI,CAAC;GAC7C,GAAG,sBAAsB;GACzB,GAAG,KAAK;GACT;;CAGH,OAAO,KAAa,OAAqD;AACvE,OAAK,KAAK,OAAO;;CAGnB,UAAU,QAAgC;AACxC,OAAK,SAAS;;CAGhB,iBAAiB,OAAc,aAAsC,EAAE,EAAE;AACvE,OAAK,OAAO,iBAAiB,OAAO,KAAK,cAAc,KAAK,aAAa;GACvE,MAAM;GACN,GAAG,KAAK;GACR,GAAG;GACJ,CAAC;;CAGJ,QAAQ,WAAmB,YAAsC;AAC/D,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IACV,GAAG,KAAK;IACR,GAAG,KAAK,6BAA6B;IACrC,GAAG;IACJ;GACF,CAAC;;CAIJ,8BAA+D;AAC7D,MAAI,KAAK,gBAAgB,KAAM,QAAO,EAAE;EACxC,MAAM,QAAiC,EAAE;EACzC,MAAM,SAAmB,EAAE;AAC3B,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,YAAY,EAAE;AAC3D,OAAI,CAAC,aAAa,IAAI,IAAI,CAAE;GAC5B,MAAM,WAAW,kBAAkB,MAAM;AACzC,SAAM,YAAY,SAAS;AAC3B,OAAI,aAAa,MAAO,QAAO,KAAK,IAAI;;AAE1C,MAAI,OAAO,SAAS,EAAG,OAAM,wBAAwB,OAAO,MAAM;AAClE,SAAO;;;;;;CAOT,cAAc,WAAmB,YAA4C;AAC3E,OAAK,QAAQ,WAAW,aAAa,WAAW;;;;;;;;CASlD,MAAM,QAAuB;AAC3B,QAAM,KAAK,OAAO,UAAU;;;;;;;CAS9B,MAAM,uBAAwD;AAC5D,MAAI,KAAK,gBAAgB,KACvB,QAAO,KAAK;EAEd,MAAM,MAA8B,EAAE;EACtC,MAAM,WAAoC,EAAE;AAC5C,MAAI;GACF,MAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,aAAU,yBAAyB;IACjC;IACA,YAAY,KAAK,eAAe,KAAA;IAChC,kBAAkB,KAAK,sBAAsB;IAC9C,CAAC;GACF,MAAM,aAAa,MAAM,KAAK,OAAO,cAAc,YAAY,EAC7D,kBAAkB,KAAK,sBAAsB,EAC9C,CAAC;AACF,QAAK,MAAM,OAAO,kBAAkB;IAClC,MAAM,QAAQ,WAAW,QAAQ,IAAI;AACrC,QAAI,UAAU,KAAA,EAAW;AACzB,QAAI,OAAO,OAAO,MAAM;IACxB,MAAM,UAAU,WAAW,eAAe,IAAI;AAC9C,QAAI,YAAY,KAAA,EAAW,UAAS,OAAO;;WAEtC,OAAO;AACd,SAAM,oCAAoC,MAAM;AAChD,QAAK,iBACH,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD,EAAE,MAAM,iBAAiB,CAC1B;;EAKH,MAAM,SAAS,qBAAqB,KAAK,SAAS;AAClD,OAAK,cAAc,OAAO;AAC1B,OAAK,qBAAqB,OAAO;AACjC,YAAU,qBAAqB,KAAK,YAAY;AAChD,SAAO,KAAK;;;CAId,wBAAiD;AAC/C,SAAO,KAAK;;CAGd,MAAM,SAAS,QAA2C;AACxD,MAAI,OAAO,KAAK,KAAK,KAAK,CAAC,WAAW,EACpC;AAOF,MAAI,KAAK,kBACP;AAEF,OAAK,oBAAoB;AAEzB,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IAEV,GAAG,KAAK;IACR,QAAQ,KAAK;IACb,GAAI,KAAK,YAAY,EAAE,aAAa,KAAK,WAAW,GAAG,EAAE;IACzD;IACA,MAAM,KAAK;IACZ;GACF,CAAC;AAEF,QAAM,KAAK,OAAO,UAAU;;;AAIhC,MAAa,YAAY,IAAI,WAAW"}
+{"version":3,"file":"analytics-B9V7x1Ma.js","names":["uuidv4"],"sources":["../src/utils/ci-flag-overrides.ts","../src/utils/analytics.ts"],"sourcesContent":["/**\n * CI-only feature-flag overrides.\n *\n * CI must route deterministically: a run that tests the orchestrator arm says\n * so explicitly instead of depending on a live feature flag someone can edit\n * mid-week. The override env var (see the allowlist in `env.ts`) is a JSON\n * object of flag key → value, merged over whatever PostHog returned.\n *\n * The override path exists only in CI builds (`pnpm build:ci`). Published\n * builds inline NODE_ENV as the literal \"production\", the guards collapse,\n * and tsdown strips the rest from the bundle — and the smoke test asserts the\n * env var names are physically absent from production output (which is also\n * why no comment in this file may spell them out), so this can never quietly\n * become a production surface.\n */\nimport { runtimeEnv } from '@env';\nimport { logToFile } from './debug';\n\nexport function applyCiFlagOverrides(\n  flags: Record<string, string>,\n  payloads: Record<string, unknown> = {},\n): { flags: Record<string, string>; payloads: Record<string, unknown> } {\n  // Compared inline (not via env.ts's IS_PRODUCTION_BUILD) so tsdown replaces\n  // it with a literal right here and the bundler can prove the rest of this\n  // function unreachable in production builds. The smoke test enforces that.\n  if (process.env.NODE_ENV === 'production') return { flags, payloads };\n\n  const raw = runtimeEnv('WIZARD_CI_FLAG_OVERRIDES');\n  if (!raw) return { flags, payloads };\n\n  let overrides: Record<string, unknown>;\n  try {\n    overrides = JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    // A malformed override is a CI misconfiguration. Fail the run loudly\n    // rather than silently testing whatever the live flags happen to say.\n    throw new Error(\n      'The CI flag-override env var is not valid JSON (expected {\"flag-key\": value, ...}).',\n    );\n  }\n\n  const mergedFlags = { ...flags };\n  const mergedPayloads = { ...payloads };\n  for (const [key, value] of Object.entries(overrides)) {\n    // An object/array override is a flag payload: the flag reads 'true' and\n    // the value rides the payload channel, matching a payload-carrying flag.\n    if (typeof value === 'object' && value !== null) {\n      mergedFlags[key] = 'true';\n      mergedPayloads[key] = value;\n    } else {\n      mergedFlags[key] = String(value);\n    }\n  }\n  logToFile('[flags] CI overrides applied', overrides);\n  return { flags: mergedFlags, payloads: mergedPayloads };\n}\n\n/**\n * Task types excluded from this run. The exclusion env var (see the allowlist\n * in `env.ts`) is a comma-separated list (e.g. `dashboard`), set by the CI\n * harness that owns the policy — the wizard and the served content stay\n * run-mode agnostic. CI-build only, same as the flag overrides: published\n * builds strip this path.\n */\nexport function ciExcludedTaskTypes(): readonly string[] {\n  if (process.env.NODE_ENV === 'production') return [];\n\n  const raw = runtimeEnv('WIZARD_CI_EXCLUDE_TASKS');\n  if (!raw) return [];\n  const types = raw\n    .split(',')\n    .map((t) => t.trim())\n    .filter(Boolean);\n  if (types.length > 0) logToFile('[flags] CI task exclusions', types);\n  return types;\n}\n","import { PostHog } from 'posthog-node';\nimport {\n  ANALYTICS_HOST_URL,\n  ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY,\n  ANALYTICS_TEAM_TAG,\n  WIZARD_FLAG_KEYS,\n} from '@lib/constants';\nimport type { WizardSession } from '@lib/wizard-session';\nimport type { ApiUser } from '@lib/api';\nimport { v4 as uuidv4 } from 'uuid';\nimport { IS_PRODUCTION_BUILD, RUN_SURFACE, TASK_ID, TASK_RUN_ID } from '@env';\nimport { VERSION } from '@lib/version';\nimport { debug, logToFile } from './debug';\nimport { applyCiFlagOverrides } from './ci-flag-overrides';\n\n/**\n * The invocation, reduced to flag-safe strings: the command word (first\n * positional, 'default' for the bare flow) and the sorted option NAMES.\n * Option values never leave the machine — they carry paths, emails, keys.\n */\nfunction invocationProperties(): { command: string; cli_flags: string } {\n  const args = process.argv.slice(2);\n  const command = args.find((a) => !a.startsWith('-')) ?? 'default';\n  const flags = [\n    ...new Set(\n      args\n        .filter((a) => a.startsWith('--'))\n        .map((a) => a.slice(2).split('=')[0]),\n    ),\n  ].sort();\n  return { command, cli_flags: flags.join(',') };\n}\n\n/**\n * Extract a standard property bag from the current session.\n * Used by store-level analytics and available for ad-hoc captures.\n */\nexport function sessionProperties(\n  session: WizardSession,\n): Record<string, unknown> {\n  return {\n    integration: session.integration,\n    detected_framework: session.detectedFrameworkLabel,\n    typescript: session.typescript,\n    project_id: session.credentials?.projectId,\n    discovered_features: session.discoveredFeatures,\n    additional_features: session.additionalFeatureQueue,\n    run_phase: session.runPhase,\n  };\n}\n\nexport function groupsFromUser(\n  user: ApiUser | null,\n  host: string,\n): Record<string, string> {\n  const groups: Record<string, string> = { instance: host };\n  if (!user) return groups;\n\n  const organizationId = user.organization?.id;\n  if (organizationId) groups.organization = organizationId;\n\n  const customerId = user.organization?.customer_id;\n  if (customerId) groups.customer = customerId;\n\n  const projectUuid = user.team?.uuid;\n  if (projectUuid) groups.project = projectUuid;\n\n  return groups;\n}\n\nconst WIZARD_FLAGS: ReadonlySet<string> = new Set(WIZARD_FLAG_KEYS);\n\n// Widen back to the SDK's shape — a filter on `true` never matches `'true'`.\nfunction flagResponseValue(value: string): string | boolean {\n  if (value === 'true') return true;\n  if (value === 'false') return false;\n  return value;\n}\n\nexport class Analytics {\n  private client: PostHog;\n  private tags: Record<string, string | boolean | number | null | undefined> =\n    {};\n  private distinctId?: string;\n  private anonymousId: string;\n  private _runId: string;\n  private sessionId: string | null = null;\n  private appName = 'wizard';\n  private activeFlags: Record<string, string> | null = null;\n  private activeFlagPayloads: Record<string, unknown> = {};\n  private groups: Record<string, string> = {};\n  private personProperties: Record<string, string> = {};\n  private terminalEventSent = false;\n\n  constructor() {\n    this.client = new PostHog(ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, {\n      host: ANALYTICS_HOST_URL,\n      flushAt: 1,\n      flushInterval: 0,\n      enableExceptionAutocapture: true,\n      before_send: (event) => {\n        if (!event) return event;\n        if (Object.keys(this.groups).length > 0) {\n          event.groups = { ...this.groups, ...event.groups };\n        }\n        // Autocaptured exceptions arrive with a random uuid and\n        // `$process_person_profile: false` — reattach the run's identity\n        // and tags so they land on the same person as everything else.\n        if (event.event === '$exception') {\n          event.distinctId = this.distinctId ?? this.anonymousId;\n          const { $process_person_profile, ...properties } =\n            event.properties ?? {};\n          void $process_person_profile;\n          event.properties = { ...this.tags, ...properties };\n        }\n        // The SDK captures this one itself, bypassing capture(), so tags merge here.\n        if (event.event === '$feature_flag_called') {\n          event.properties = { ...this.tags, ...(event.properties ?? {}) };\n        }\n        return event;\n      },\n    });\n\n    this.tags = { $app_name: this.appName };\n    // Tag every run with its build type so prod / dev / ci / headless segment\n    // cleanly in analytics. tsdown inlines IS_PRODUCTION_BUILD to `true` in\n    // published builds and `false` for dev/tsx/test runs. Non-interactive runs\n    // upgrade this in runWizardCI: dev `--ci` runs to 'ci', published headless\n    // runs to 'headless'.\n    this.tags.build = IS_PRODUCTION_BUILD ? 'prod' : 'dev';\n\n    this.tags.run_surface = RUN_SURFACE;\n\n    // The build this run came from. Already sent as a flag-evaluation person\n    // property; tagging it makes every event attributable to a release, so a\n    // regression can be bounded to the versions that carry it.\n    this.tags.version = VERSION;\n\n    // Cloud runs only: the task run that owns the sandbox. Without these the\n    // wizard's events and the run that launched it are two unrelated streams,\n    // since run_id above is minted per process and never leaves the wizard.\n    // Left unset for local runs so the properties stay absent rather than null.\n    if (TASK_RUN_ID) this.tags.task_run_id = TASK_RUN_ID;\n    if (TASK_ID) this.tags.task_id = TASK_ID;\n\n    this.anonymousId = uuidv4();\n\n    // One id per process = one id per wizard run, registered in the tag bag\n    // so it rides on every capture, exception, and autocaptured exception\n    // (all of which merge `this.tags`). Lets you separate two runs by the\n    // same logged-in user, who otherwise share one distinct id. Distinct\n    // from `anonymousId`, the pre-login *person* id that gets aliased onto\n    // the real user at login. `$session_id` is intentionally not set here —\n    // it stays null until OAuth completes (see identifyUser).\n    this._runId = uuidv4();\n    this.tags.run_id = this._runId;\n\n    this.distinctId = undefined;\n  }\n\n  /** Per-process run id, tagged on every event and gateway trace. */\n  get runId(): string {\n    return this._runId;\n  }\n\n  /** Build type for this run ('prod' | 'dev' | 'ci' | 'headless') — the same value tagged on every analytics event. */\n  get build(): string {\n    return String(this.tags.build ?? 'dev');\n  }\n\n  /**\n   * Associate the run with the logged-in user, once per id. Identifies them\n   * (email, name) and records those person properties so events carry them and\n   * feature flags can target the individual user — without the email here the\n   * wizard only sends `$app_name`, so email-targeted flags never match. Opens\n   * the analytics session on first login, then aliases the run's anonymous id\n   * onto the identified person so pre-login events merge in.\n   */\n  identifyUser(user: ApiUser) {\n    const distinctId = user.distinct_id;\n    if (this.distinctId === distinctId || distinctId === this.anonymousId) {\n      return;\n    }\n    this.distinctId = distinctId;\n    // Open the analytics session on first login. Null until here, so\n    // pre-OAuth events carry only `run_id`; from now on every event also\n    // carries `$session_id` and PostHog groups the authenticated run into a\n    // native Session. Stored in the tag bag so it rides on every subsequent\n    // capture and exception.\n    if (!this.sessionId) {\n      this.sessionId = uuidv4();\n      this.tags.$session_id = this.sessionId;\n    }\n    const props: Record<string, string> = {};\n    if (user.email) props.email = user.email;\n    const name = [user.first_name, user.last_name]\n      .filter(Boolean)\n      .join(' ')\n      .trim();\n    if (name) props.name = name;\n    this.personProperties = props;\n    this.client.identify({ distinctId, properties: { $set: props } });\n    this.client.alias({\n      distinctId,\n      alias: this.anonymousId,\n    });\n    // The flag snapshot is per identity. Anything evaluated before login (the\n    // intro screen reads the tools-menu flag) was anonymous — drop it so the\n    // next read re-evaluates as this user.\n    this.activeFlags = null;\n    this.activeFlagPayloads = {};\n  }\n\n  /** Person properties sent with flag evaluation: app name plus the user's. */\n  private flagPersonProperties(): Record<string, string> {\n    // Environment facts flag conditions can scope on — evaluation-time only,\n    // never persisted onto the person. `version` gates an experiment to\n    // releases that implement it (a condition on a property older builds\n    // don't send silently never matches them); `run_surface`/`build` scope\n    // by invocation surface; `command`/`cli_flags` by subcommand; `os`/\n    // `node_major` by platform.\n    return {\n      $app_name: this.appName,\n      version: VERSION,\n      run_surface: RUN_SURFACE,\n      build: String(this.tags.build ?? 'dev'),\n      os: process.platform,\n      node_major: process.versions.node.split('.')[0],\n      ...invocationProperties(),\n      ...this.personProperties,\n    };\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  setGroups(groups: Record<string, string>) {\n    this.groups = groups;\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    this.client.captureException(error, this.distinctId ?? this.anonymousId, {\n      team: ANALYTICS_TEAM_TAG,\n      ...this.tags,\n      ...properties,\n    });\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: eventName,\n      properties: {\n        ...this.tags,\n        ...this.wizardFlagFeatureProperties(),\n        ...properties,\n      },\n    });\n  }\n\n  // Built from the resolved map, not the SDK snapshot: a CI-forced variant must own its events.\n  private wizardFlagFeatureProperties(): Record<string, unknown> {\n    if (this.activeFlags === null) return {};\n    const props: Record<string, unknown> = {};\n    const active: string[] = [];\n    for (const [key, value] of Object.entries(this.activeFlags)) {\n      if (!WIZARD_FLAGS.has(key)) continue;\n      const resolved = flagResponseValue(value);\n      props[`$feature/${key}`] = resolved;\n      if (resolved !== false) active.push(key);\n    }\n    if (active.length > 0) props.$active_feature_flags = active.sort();\n    return props;\n  }\n\n  /**\n   * Capture a wizard-specific event. Automatically prepends \"wizard: \" to the event name.\n   * All new wizard analytics should use this method instead of capture() directly.\n   */\n  wizardCapture(eventName: string, properties?: Record<string, unknown>): void {\n    this.capture(`wizard: ${eventName}`, properties);\n  }\n\n  /**\n   * Flush pending events without firing the \"setup wizard finished\" terminal\n   * event. Use this from CLI error paths that exit before any wizard run\n   * starts — `shutdown()` would inflate the run count with a \"finished\" event\n   * for a parse error that never actually ran the wizard.\n   */\n  async flush(): Promise<void> {\n    await this.client.shutdown();\n  }\n\n  /**\n   * Evaluate all feature flags for the current user at the start of a run.\n   * Result is cached; subsequent calls in the same run return the same map.\n   * Returns flag key -> string value (booleans become 'true'/'false').\n   */\n  // Only a getFlag read records an exposure; the bulk response records none.\n  async getAllFlagsForWizard(): Promise<Record<string, string>> {\n    if (this.activeFlags !== null) {\n      return this.activeFlags;\n    }\n    const out: Record<string, string> = {};\n    const payloads: Record<string, unknown> = {};\n    try {\n      const distinctId = this.distinctId ?? this.anonymousId;\n      logToFile('[flags] evaluating as', {\n        distinctId,\n        identified: this.distinctId !== undefined,\n        personProperties: this.flagPersonProperties(),\n      });\n      const evaluation = await this.client.evaluateFlags(distinctId, {\n        personProperties: this.flagPersonProperties(),\n      });\n      for (const key of WIZARD_FLAG_KEYS) {\n        const value = evaluation.getFlag(key);\n        if (value === undefined) continue;\n        out[key] = String(value);\n        const payload = evaluation.getFlagPayload(key);\n        if (payload !== undefined) payloads[key] = payload;\n      }\n    } catch (error) {\n      debug('Failed to get all feature flags:', error);\n      this.captureException(\n        error instanceof Error ? error : new Error(String(error)),\n        { step: 'get_all_flags' },\n      );\n    }\n    // Outside the fetch guard on purpose: a malformed CI override must fail\n    // the run loudly, and a valid one applies even when the fetch failed —\n    // CI routing stays deterministic either way.\n    const merged = applyCiFlagOverrides(out, payloads);\n    this.activeFlags = merged.flags;\n    this.activeFlagPayloads = merged.payloads;\n    logToFile('[flags] evaluated', this.activeFlags);\n    return this.activeFlags;\n  }\n\n  /** Flag payloads from the same snapshot; empty until the flags are fetched. */\n  getWizardFlagPayloads(): Record<string, unknown> {\n    return this.activeFlagPayloads;\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (Object.keys(this.tags).length === 0) {\n      return;\n    }\n\n    // First status wins. The interrupt fallback in start-tui fires\n    // shutdown('cancelled') on every TUI teardown; without this guard a run\n    // that already reported 'success' would emit a second, contradicting\n    // terminal event when the user dismisses the outro.\n    if (this.terminalEventSent) {\n      return;\n    }\n    this.terminalEventSent = true;\n\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: 'setup wizard finished',\n      properties: {\n        // Flat for filtering; the nested `tags` snapshot stays for back-compat.\n        ...this.tags,\n        run_id: this._runId,\n        ...(this.sessionId ? { $session_id: this.sessionId } : {}),\n        status,\n        tags: this.tags,\n      },\n    });\n\n    await this.client.shutdown();\n  }\n}\n\nexport const analytics = new Analytics();\n"],"mappings":";;;;AAkBA,SAAgB,qBACd,OACA,WAAoC,EAAE,EACgC;AAI3B,QAAO;EAAE;EAAO;EAAU;;;;;;;;;AAuCvE,SAAgB,sBAAyC;AACZ,QAAO,EAAE;;;;;;;;;AC7CtD,SAAS,uBAA+D;CACtE,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE;AASlC,QAAO;EAAE,SARO,KAAK,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC,IAAI;EAQtC,WAPJ,CACZ,GAAG,IAAI,IACL,KACG,QAAQ,MAAM,EAAE,WAAW,KAAK,CAAC,CACjC,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,CACxC,CACF,CAAC,MAAM,CAC2B,KAAK,IAAI;EAAE;;;;;;AAOhD,SAAgB,kBACd,SACyB;AACzB,QAAO;EACL,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,YAAY,QAAQ;EACpB,YAAY,QAAQ,aAAa;EACjC,qBAAqB,QAAQ;EAC7B,qBAAqB,QAAQ;EAC7B,WAAW,QAAQ;EACpB;;AAGH,SAAgB,eACd,MACA,MACwB;CACxB,MAAM,SAAiC,EAAE,UAAU,MAAM;AACzD,KAAI,CAAC,KAAM,QAAO;CAElB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,KAAI,eAAgB,QAAO,eAAe;CAE1C,MAAM,aAAa,KAAK,cAAc;AACtC,KAAI,WAAY,QAAO,WAAW;CAElC,MAAM,cAAc,KAAK,MAAM;AAC/B,KAAI,YAAa,QAAO,UAAU;AAElC,QAAO;;AAGT,MAAM,eAAoC,IAAI,IAAI,iBAAiB;AAGnE,SAAS,kBAAkB,OAAiC;AAC1D,KAAI,UAAU,OAAQ,QAAO;AAC7B,KAAI,UAAU,QAAS,QAAO;AAC9B,QAAO;;AAGT,IAAa,YAAb,MAAuB;CACrB;CACA,OACE,EAAE;CACJ;CACA;CACA;CACA,YAAmC;CACnC,UAAkB;CAClB,cAAqD;CACrD,qBAAsD,EAAE;CACxD,SAAyC,EAAE;CAC3C,mBAAmD,EAAE;CACrD,oBAA4B;CAE5B,cAAc;AACZ,OAAK,SAAS,IAAI,QAAQ,4CAA4C;GACpE,MAAM;GACN,SAAS;GACT,eAAe;GACf,4BAA4B;GAC5B,cAAc,UAAU;AACtB,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,OAAO,KAAK,KAAK,OAAO,CAAC,SAAS,EACpC,OAAM,SAAS;KAAE,GAAG,KAAK;KAAQ,GAAG,MAAM;KAAQ;AAKpD,QAAI,MAAM,UAAU,cAAc;AAChC,WAAM,aAAa,KAAK,cAAc,KAAK;KAC3C,MAAM,EAAE,yBAAyB,GAAG,eAClC,MAAM,cAAc,EAAE;AAExB,WAAM,aAAa;MAAE,GAAG,KAAK;MAAM,GAAG;MAAY;;AAGpD,QAAI,MAAM,UAAU,uBAClB,OAAM,aAAa;KAAE,GAAG,KAAK;KAAM,GAAI,MAAM,cAAc,EAAE;KAAG;AAElE,WAAO;;GAEV,CAAC;AAEF,OAAK,OAAO,EAAE,WAAW,KAAK,SAAS;AAMvC,OAAK,KAAK,QAA8B;AAExC,OAAK,KAAK,cAAc;AAKxB,OAAK,KAAK,UAAU;AAMpB,MAAI,YAAa,MAAK,KAAK,cAAc;AACzC,MAAI,QAAS,MAAK,KAAK,UAAU;AAEjC,OAAK,cAAcA,IAAQ;AAS3B,OAAK,SAASA,IAAQ;AACtB,OAAK,KAAK,SAAS,KAAK;AAExB,OAAK,aAAa,KAAA;;;CAIpB,IAAI,QAAgB;AAClB,SAAO,KAAK;;;CAId,IAAI,QAAgB;AAClB,SAAO,OAAO,KAAK,KAAK,SAAS,MAAM;;;;;;;;;;CAWzC,aAAa,MAAe;EAC1B,MAAM,aAAa,KAAK;AACxB,MAAI,KAAK,eAAe,cAAc,eAAe,KAAK,YACxD;AAEF,OAAK,aAAa;AAMlB,MAAI,CAAC,KAAK,WAAW;AACnB,QAAK,YAAYA,IAAQ;AACzB,QAAK,KAAK,cAAc,KAAK;;EAE/B,MAAM,QAAgC,EAAE;AACxC,MAAI,KAAK,MAAO,OAAM,QAAQ,KAAK;EACnC,MAAM,OAAO,CAAC,KAAK,YAAY,KAAK,UAAU,CAC3C,OAAO,QAAQ,CACf,KAAK,IAAI,CACT,MAAM;AACT,MAAI,KAAM,OAAM,OAAO;AACvB,OAAK,mBAAmB;AACxB,OAAK,OAAO,SAAS;GAAE;GAAY,YAAY,EAAE,MAAM,OAAO;GAAE,CAAC;AACjE,OAAK,OAAO,MAAM;GAChB;GACA,OAAO,KAAK;GACb,CAAC;AAIF,OAAK,cAAc;AACnB,OAAK,qBAAqB,EAAE;;;CAI9B,uBAAuD;AAOrD,SAAO;GACL,WAAW,KAAK;GAChB,SAAS;GACT,aAAa;GACb,OAAO,OAAO,KAAK,KAAK,SAAS,MAAM;GACvC,IAAI,QAAQ;GACZ,YAAY,QAAQ,SAAS,KAAK,MAAM,IAAI,CAAC;GAC7C,GAAG,sBAAsB;GACzB,GAAG,KAAK;GACT;;CAGH,OAAO,KAAa,OAAqD;AACvE,OAAK,KAAK,OAAO;;CAGnB,UAAU,QAAgC;AACxC,OAAK,SAAS;;CAGhB,iBAAiB,OAAc,aAAsC,EAAE,EAAE;AACvE,OAAK,OAAO,iBAAiB,OAAO,KAAK,cAAc,KAAK,aAAa;GACvE,MAAM;GACN,GAAG,KAAK;GACR,GAAG;GACJ,CAAC;;CAGJ,QAAQ,WAAmB,YAAsC;AAC/D,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IACV,GAAG,KAAK;IACR,GAAG,KAAK,6BAA6B;IACrC,GAAG;IACJ;GACF,CAAC;;CAIJ,8BAA+D;AAC7D,MAAI,KAAK,gBAAgB,KAAM,QAAO,EAAE;EACxC,MAAM,QAAiC,EAAE;EACzC,MAAM,SAAmB,EAAE;AAC3B,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,YAAY,EAAE;AAC3D,OAAI,CAAC,aAAa,IAAI,IAAI,CAAE;GAC5B,MAAM,WAAW,kBAAkB,MAAM;AACzC,SAAM,YAAY,SAAS;AAC3B,OAAI,aAAa,MAAO,QAAO,KAAK,IAAI;;AAE1C,MAAI,OAAO,SAAS,EAAG,OAAM,wBAAwB,OAAO,MAAM;AAClE,SAAO;;;;;;CAOT,cAAc,WAAmB,YAA4C;AAC3E,OAAK,QAAQ,WAAW,aAAa,WAAW;;;;;;;;CASlD,MAAM,QAAuB;AAC3B,QAAM,KAAK,OAAO,UAAU;;;;;;;CAS9B,MAAM,uBAAwD;AAC5D,MAAI,KAAK,gBAAgB,KACvB,QAAO,KAAK;EAEd,MAAM,MAA8B,EAAE;EACtC,MAAM,WAAoC,EAAE;AAC5C,MAAI;GACF,MAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,aAAU,yBAAyB;IACjC;IACA,YAAY,KAAK,eAAe,KAAA;IAChC,kBAAkB,KAAK,sBAAsB;IAC9C,CAAC;GACF,MAAM,aAAa,MAAM,KAAK,OAAO,cAAc,YAAY,EAC7D,kBAAkB,KAAK,sBAAsB,EAC9C,CAAC;AACF,QAAK,MAAM,OAAO,kBAAkB;IAClC,MAAM,QAAQ,WAAW,QAAQ,IAAI;AACrC,QAAI,UAAU,KAAA,EAAW;AACzB,QAAI,OAAO,OAAO,MAAM;IACxB,MAAM,UAAU,WAAW,eAAe,IAAI;AAC9C,QAAI,YAAY,KAAA,EAAW,UAAS,OAAO;;WAEtC,OAAO;AACd,SAAM,oCAAoC,MAAM;AAChD,QAAK,iBACH,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD,EAAE,MAAM,iBAAiB,CAC1B;;EAKH,MAAM,SAAS,qBAAqB,KAAK,SAAS;AAClD,OAAK,cAAc,OAAO;AAC1B,OAAK,qBAAqB,OAAO;AACjC,YAAU,qBAAqB,KAAK,YAAY;AAChD,SAAO,KAAK;;;CAId,wBAAiD;AAC/C,SAAO,KAAK;;CAGd,MAAM,SAAS,QAA2C;AACxD,MAAI,OAAO,KAAK,KAAK,KAAK,CAAC,WAAW,EACpC;AAOF,MAAI,KAAK,kBACP;AAEF,OAAK,oBAAoB;AAEzB,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IAEV,GAAG,KAAK;IACR,QAAQ,KAAK;IACb,GAAI,KAAK,YAAY,EAAE,aAAa,KAAK,WAAW,GAAG,EAAE;IACzD;IACA,MAAM,KAAK;IACZ;GACF,CAAC;AAEF,QAAM,KAAK,OAAO,UAAU;;;AAIhC,MAAa,YAAY,IAAI,WAAW"}

package/dist/analytics-HdW5e8_o.js

@@ -0,0 +1,2 @@
+import { n as analytics } from "./analytics-B9V7x1Ma.js";
+export { analytics };

package/dist/{api-Ca6ntEhK.js → api-OHLXhKTy.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";
-import { ft as WIZARD_USER_AGENT } from "./debug-Di-I0xld.js";
-import { n as analytics } from "./analytics-Bvq5-kCh.js";
+import { ft as WIZARD_USER_AGENT } from "./debug-D3Ucw2y1.js";
+import { n as analytics } from "./analytics-B9V7x1Ma.js";
 import axios from "axios";
 import { z } from "zod";
 //#region src/lib/api.ts
@@ -170,4 +170,4 @@ function handleApiError(error, operation) {
 //#endregion
 export { fetchUserData as a, fetchSlackConnected as i, api_exports as n, handleApiError as o, fetchProjectData as r, ApiError as t };
 
-//# sourceMappingURL=api-Ca6ntEhK.js.map
+//# sourceMappingURL=api-OHLXhKTy.js.map

package/dist/{api-Ca6ntEhK.js.map → api-OHLXhKTy.js.map}

@@ -1 +1 @@
-{"version":3,"file":"api-Ca6ntEhK.js","names":[],"sources":["../src/lib/api.ts"],"sourcesContent":["import axios, { AxiosError } from 'axios';\nimport { z } from 'zod';\nimport { analytics } from '@utils/analytics';\nimport { WIZARD_USER_AGENT } from './constants';\n\n/**\n * User payload from `/api/users/@me/`. Schema typed for the fields the\n * wizard actually reads + passthrough on everything else so the full\n * upstream response rides through to the session for downstream features\n * (account-aware copy, plan-gated flows, org/team metadata, etc.).\n *\n * Top-level uses `.passthrough()` so unknown fields aren't stripped;\n * the few nested objects we care about (team, organization,\n * organizations[]) do the same so their additional fields survive too.\n *\n * Keep `distinct_id` required — analytics depends on it. Everything\n * else added here is nullish so partial responses don't fail parsing.\n */\nexport const ApiUserSchema = z\n  .object({\n    // Identifiers\n    distinct_id: z.string(),\n    uuid: z.string().nullish(),\n    id: z.number().nullish(),\n\n    // Profile\n    email: z.string().nullish(),\n    first_name: z.string().nullish(),\n    last_name: z.string().nullish(),\n    date_joined: z.string().nullish(),\n    is_email_verified: z.boolean().nullish(),\n    is_2fa_enabled: z.boolean().nullish(),\n    is_staff: z.boolean().nullish(),\n\n    // Preferences\n    theme_mode: z.string().nullish(),\n    toolbar_mode: z.string().nullish(),\n    hide_mcp_hints: z.boolean().nullish(),\n\n    // Optional / nullable on the backend — pre-onboarding signup paths\n    // return null and older accounts may not have it set. Treat as a\n    // hint, never a guarantee.\n    role_at_organization: z.string().nullish(),\n\n    // Current team + organization (objects from the API, kept typed on\n    // the fields the wizard uses; passthrough preserves the rest).\n    team: z\n      .object({\n        id: z.number(),\n        uuid: z.string().nullish(),\n        organization: z.string().uuid(),\n        api_token: z.string().nullish(),\n        project_id: z.number().nullish(),\n        name: z.string().nullish(),\n        timezone: z.string().nullish(),\n      })\n      .passthrough(),\n    organization: z\n      .object({\n        id: z.string().uuid(),\n        name: z.string().nullish(),\n        slug: z.string().nullish(),\n        membership_level: z.number().nullish(),\n        customer_id: z.string().nullish(),\n        // Org-level AI consent gate. Signals drops all findings while\n        // this is not true. Null on older orgs (pre-2026-05 default\n        // flip) — treat null as \"unknown\", not \"off\".\n        is_ai_data_processing_approved: z.boolean().nullish(),\n      })\n      .passthrough(),\n    organizations: z.array(\n      z\n        .object({\n          id: z.string().uuid(),\n          name: z.string().nullish(),\n          membership_level: z.number().nullish(),\n        })\n        .passthrough(),\n    ),\n  })\n  .passthrough();\n\n/**\n * Single activity log entry the wizard cares about. The PostHog endpoint\n * returns much more — schema kept minimal so changes upstream don't break us.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling. Deliberately retained: this is a thin,\n * well-typed wrapper around a stable PostHog endpoint, and we're likely\n * to want it again for a future feature (e.g. \"what changed in your\n * project recently\"). Re-deriving the schema is more work than letting\n * it sit dormant.\n */\nexport const ActivityLogEntrySchema = z\n  .object({\n    scope: z.string().nullish(),\n    activity: z.string().nullish(),\n    created_at: z.string().nullish(),\n  })\n  .passthrough();\n\n/** @unused — see ActivityLogEntrySchema. */\nexport const ActivityLogResponseSchema = z.object({\n  results: z.array(ActivityLogEntrySchema),\n});\n\n/** @unused — see ActivityLogEntrySchema. */\nexport type ActivityLogEntry = z.infer<typeof ActivityLogEntrySchema>;\n\nexport const ApiProjectSchema = z.object({\n  id: z.number(),\n  uuid: z.string().uuid(),\n  organization: z.string().uuid(),\n  api_token: z.string(),\n  name: z.string(),\n  // Product opt-ins (TeamSerializer-compat fields on /api/projects/:id).\n  // Project-level truth for \"is this product enabled\" — a product can be\n  // instrumented from another repo or the snippet, so these settings\n  // override repo-local evidence. Null/absent = unknown. Only the\n  // opt-ins a signals decision consumes: replay + exception autocapture\n  // feed signal-source choices; surveys feeds the surveys-scout tuning.\n  session_recording_opt_in: z.boolean().nullish(),\n  autocapture_exceptions_opt_in: z.boolean().nullish(),\n  surveys_opt_in: z.boolean().nullish(),\n});\n\nexport type ApiUser = z.infer<typeof ApiUserSchema>;\nexport type ApiProject = z.infer<typeof ApiProjectSchema>;\n\nexport class ApiError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode?: number,\n    public readonly endpoint?: string,\n  ) {\n    super(message);\n    this.name = 'ApiError';\n  }\n}\n\nexport async function fetchUserData(\n  accessToken: string,\n  baseUrl: string,\n): Promise<ApiUser> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/users/@me/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiUserSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch user data');\n    analytics.captureException(apiError, {\n      endpoint: '/api/users/@me/',\n      baseUrl,\n    });\n    throw apiError;\n  }\n}\n\n/**\n * Best-effort fetch of recent activity log entries. Returns [] on any error\n * so callers can treat absence of results as \"haven't detected anything yet\"\n * rather than a hard failure.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling from McpSuggestedPromptsScreen.\n * Deliberately retained for future features that want a soft signal of\n * recent project changes (e.g. dashboards, audit summaries). See the\n * ActivityLogEntrySchema doc comment for the keep-vs-delete rationale.\n */\nexport async function fetchRecentActivity(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  since: Date,\n): Promise<ActivityLogEntry[]> {\n  try {\n    const response = await axios.get(\n      `${baseUrl}/api/projects/${projectId}/activity_log/`,\n      {\n        params: { limit: 10 },\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          'User-Agent': WIZARD_USER_AGENT,\n        },\n        // Short timeout — best-effort probe, not a critical path.\n        timeout: 4000,\n      },\n    );\n    const parsed = ActivityLogResponseSchema.safeParse(response.data);\n    if (!parsed.success) return [];\n    const sinceMs = since.getTime();\n    return parsed.data.results.filter((entry) => {\n      if (!entry.created_at) return false;\n      const t = Date.parse(entry.created_at);\n      return Number.isFinite(t) && t >= sinceMs;\n    });\n  } catch {\n    return [];\n  }\n}\n\nexport async function fetchProjectData(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n): Promise<ApiProject> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/projects/${projectId}/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiProjectSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch project data');\n    analytics.captureException(apiError, {\n      endpoint: `/api/projects/${projectId}/`,\n      baseUrl,\n      projectId,\n    });\n    throw apiError;\n  }\n}\n\n/** Minimal shape of `/api/projects/:id/integrations/` — we only read `kind`. */\nconst IntegrationsResponseSchema = z.object({\n  results: z.array(z.object({ kind: z.string().nullish() }).passthrough()),\n});\n\n/**\n * Check whether the project already has a Slack integration connected.\n * Requires the `integration:read` scope. Throws on failure — callers\n * (including the SlackConnectScreen poll) decide how to degrade and\n * are responsible for capturing the error exactly once.\n */\nexport async function fetchSlackConnected(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  signal?: AbortSignal,\n): Promise<boolean> {\n  const response = await axios.get(\n    `${baseUrl}/api/projects/${projectId}/integrations/`,\n    {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      signal,\n    },\n  );\n  const parsed = IntegrationsResponseSchema.safeParse(response.data);\n  if (!parsed.success) return false;\n  return parsed.data.results.some((i) => i.kind === 'slack');\n}\n\nexport function handleApiError(error: unknown, operation: string): ApiError {\n  if (axios.isAxiosError(error)) {\n    const axiosError = error as AxiosError<{ detail?: string }>;\n    const status = axiosError.response?.status;\n    const detail = axiosError.response?.data?.detail;\n    const endpoint = axiosError.config?.url;\n\n    if (status === 401) {\n      return new ApiError(\n        `Authentication failed while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 403) {\n      return new ApiError(\n        `Access denied while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 404) {\n      return new ApiError(\n        `Resource not found while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    const message = detail || `Failed to ${operation}`;\n    return new ApiError(message, status, endpoint);\n  }\n\n  if (error instanceof z.ZodError) {\n    return new ApiError(`Invalid response format while trying to ${operation}`);\n  }\n\n  return new ApiError(\n    `Unexpected error while trying to ${operation}: ${\n      error instanceof Error ? error.message : 'Unknown error'\n    }`,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,gBAAgB,EAC1B,OAAO;CAEN,aAAa,EAAE,QAAQ;CACvB,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,IAAI,EAAE,QAAQ,CAAC,SAAS;CAGxB,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,mBAAmB,EAAE,SAAS,CAAC,SAAS;CACxC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACrC,UAAU,EAAE,SAAS,CAAC,SAAS;CAG/B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CAKrC,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAI1C,MAAM,EACH,OAAO;EACN,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM;EAC/B,WAAW,EAAE,QAAQ,CAAC,SAAS;EAC/B,YAAY,EAAE,QAAQ,CAAC,SAAS;EAChC,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,UAAU,EAAE,QAAQ,CAAC,SAAS;EAC/B,CAAC,CACD,aAAa;CAChB,cAAc,EACX,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACtC,aAAa,EAAE,QAAQ,CAAC,SAAS;EAIjC,gCAAgC,EAAE,SAAS,CAAC,SAAS;EACtD,CAAC,CACD,aAAa;CAChB,eAAe,EAAE,MACf,EACG,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACvC,CAAC,CACD,aAAa,CACjB;CACF,CAAC,CACD,aAAa;;;;;;;;;;;;AAahB,MAAa,yBAAyB,EACnC,OAAO;CACN,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,YAAY,EAAE,QAAQ,CAAC,SAAS;CACjC,CAAC,CACD,aAAa;AAGyB,EAAE,OAAO,EAChD,SAAS,EAAE,MAAM,uBAAuB,EACzC,CAAC;AAKF,MAAa,mBAAmB,EAAE,OAAO;CACvC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ,CAAC,MAAM;CACvB,cAAc,EAAE,QAAQ,CAAC,MAAM;CAC/B,WAAW,EAAE,QAAQ;CACrB,MAAM,EAAE,QAAQ;CAOhB,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,+BAA+B,EAAE,SAAS,CAAC,SAAS;CACpD,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACtC,CAAC;AAKF,IAAa,WAAb,cAA8B,MAAM;CAClC,YACE,SACA,YACA,UACA;AACA,QAAM,QAAQ;AAHE,OAAA,aAAA;AACA,OAAA,WAAA;AAGhB,OAAK,OAAO;;;AAIhB,eAAsB,cACpB,aACA,SACkB;AAClB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,kBAAkB,EAC5D,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,cAAc,MAAM,SAAS,KAAK;UAClC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,kBAAkB;AACzD,YAAU,iBAAiB,UAAU;GACnC,UAAU;GACV;GACD,CAAC;AACF,QAAM;;;AA+CV,eAAsB,iBACpB,aACA,WACA,SACqB;AACrB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,gBAAgB,UAAU,IAAI,EACxE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,iBAAiB,MAAM,SAAS,KAAK;UACrC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,qBAAqB;AAC5D,YAAU,iBAAiB,UAAU;GACnC,UAAU,iBAAiB,UAAU;GACrC;GACA;GACD,CAAC;AACF,QAAM;;;;AAKV,MAAM,6BAA6B,EAAE,OAAO,EAC1C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,EACzE,CAAC;;;;;;;AAQF,eAAsB,oBACpB,aACA,WACA,SACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,IAC3B,GAAG,QAAQ,gBAAgB,UAAU,iBACrC;EACE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf;EACD;EACD,CACF;CACD,MAAM,SAAS,2BAA2B,UAAU,SAAS,KAAK;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,QAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,QAAQ;;AAG5D,SAAgB,eAAe,OAAgB,WAA6B;AAC1E,KAAI,MAAM,aAAa,MAAM,EAAE;EAC7B,MAAM,aAAa;EACnB,MAAM,SAAS,WAAW,UAAU;EACpC,MAAM,SAAS,WAAW,UAAU,MAAM;EAC1C,MAAM,WAAW,WAAW,QAAQ;AAEpC,MAAI,WAAW,IACb,QAAO,IAAI,SACT,yCAAyC,aACzC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,iCAAiC,aACjC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,sCAAsC,aACtC,QACA,SACD;AAIH,SAAO,IAAI,SADK,UAAU,aAAa,aACV,QAAQ,SAAS;;AAGhD,KAAI,iBAAiB,EAAE,SACrB,QAAO,IAAI,SAAS,2CAA2C,YAAY;AAG7E,QAAO,IAAI,SACT,oCAAoC,UAAU,IAC5C,iBAAiB,QAAQ,MAAM,UAAU,kBAE5C"}
+{"version":3,"file":"api-OHLXhKTy.js","names":[],"sources":["../src/lib/api.ts"],"sourcesContent":["import axios, { AxiosError } from 'axios';\nimport { z } from 'zod';\nimport { analytics } from '@utils/analytics';\nimport { WIZARD_USER_AGENT } from './constants';\n\n/**\n * User payload from `/api/users/@me/`. Schema typed for the fields the\n * wizard actually reads + passthrough on everything else so the full\n * upstream response rides through to the session for downstream features\n * (account-aware copy, plan-gated flows, org/team metadata, etc.).\n *\n * Top-level uses `.passthrough()` so unknown fields aren't stripped;\n * the few nested objects we care about (team, organization,\n * organizations[]) do the same so their additional fields survive too.\n *\n * Keep `distinct_id` required — analytics depends on it. Everything\n * else added here is nullish so partial responses don't fail parsing.\n */\nexport const ApiUserSchema = z\n  .object({\n    // Identifiers\n    distinct_id: z.string(),\n    uuid: z.string().nullish(),\n    id: z.number().nullish(),\n\n    // Profile\n    email: z.string().nullish(),\n    first_name: z.string().nullish(),\n    last_name: z.string().nullish(),\n    date_joined: z.string().nullish(),\n    is_email_verified: z.boolean().nullish(),\n    is_2fa_enabled: z.boolean().nullish(),\n    is_staff: z.boolean().nullish(),\n\n    // Preferences\n    theme_mode: z.string().nullish(),\n    toolbar_mode: z.string().nullish(),\n    hide_mcp_hints: z.boolean().nullish(),\n\n    // Optional / nullable on the backend — pre-onboarding signup paths\n    // return null and older accounts may not have it set. Treat as a\n    // hint, never a guarantee.\n    role_at_organization: z.string().nullish(),\n\n    // Current team + organization (objects from the API, kept typed on\n    // the fields the wizard uses; passthrough preserves the rest).\n    team: z\n      .object({\n        id: z.number(),\n        uuid: z.string().nullish(),\n        organization: z.string().uuid(),\n        api_token: z.string().nullish(),\n        project_id: z.number().nullish(),\n        name: z.string().nullish(),\n        timezone: z.string().nullish(),\n      })\n      .passthrough(),\n    organization: z\n      .object({\n        id: z.string().uuid(),\n        name: z.string().nullish(),\n        slug: z.string().nullish(),\n        membership_level: z.number().nullish(),\n        customer_id: z.string().nullish(),\n        // Org-level AI consent gate. Signals drops all findings while\n        // this is not true. Null on older orgs (pre-2026-05 default\n        // flip) — treat null as \"unknown\", not \"off\".\n        is_ai_data_processing_approved: z.boolean().nullish(),\n      })\n      .passthrough(),\n    organizations: z.array(\n      z\n        .object({\n          id: z.string().uuid(),\n          name: z.string().nullish(),\n          membership_level: z.number().nullish(),\n        })\n        .passthrough(),\n    ),\n  })\n  .passthrough();\n\n/**\n * Single activity log entry the wizard cares about. The PostHog endpoint\n * returns much more — schema kept minimal so changes upstream don't break us.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling. Deliberately retained: this is a thin,\n * well-typed wrapper around a stable PostHog endpoint, and we're likely\n * to want it again for a future feature (e.g. \"what changed in your\n * project recently\"). Re-deriving the schema is more work than letting\n * it sit dormant.\n */\nexport const ActivityLogEntrySchema = z\n  .object({\n    scope: z.string().nullish(),\n    activity: z.string().nullish(),\n    created_at: z.string().nullish(),\n  })\n  .passthrough();\n\n/** @unused — see ActivityLogEntrySchema. */\nexport const ActivityLogResponseSchema = z.object({\n  results: z.array(ActivityLogEntrySchema),\n});\n\n/** @unused — see ActivityLogEntrySchema. */\nexport type ActivityLogEntry = z.infer<typeof ActivityLogEntrySchema>;\n\nexport const ApiProjectSchema = z.object({\n  id: z.number(),\n  uuid: z.string().uuid(),\n  organization: z.string().uuid(),\n  api_token: z.string(),\n  name: z.string(),\n  // Product opt-ins (TeamSerializer-compat fields on /api/projects/:id).\n  // Project-level truth for \"is this product enabled\" — a product can be\n  // instrumented from another repo or the snippet, so these settings\n  // override repo-local evidence. Null/absent = unknown. Only the\n  // opt-ins a signals decision consumes: replay + exception autocapture\n  // feed signal-source choices; surveys feeds the surveys-scout tuning.\n  session_recording_opt_in: z.boolean().nullish(),\n  autocapture_exceptions_opt_in: z.boolean().nullish(),\n  surveys_opt_in: z.boolean().nullish(),\n});\n\nexport type ApiUser = z.infer<typeof ApiUserSchema>;\nexport type ApiProject = z.infer<typeof ApiProjectSchema>;\n\nexport class ApiError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode?: number,\n    public readonly endpoint?: string,\n  ) {\n    super(message);\n    this.name = 'ApiError';\n  }\n}\n\nexport async function fetchUserData(\n  accessToken: string,\n  baseUrl: string,\n): Promise<ApiUser> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/users/@me/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiUserSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch user data');\n    analytics.captureException(apiError, {\n      endpoint: '/api/users/@me/',\n      baseUrl,\n    });\n    throw apiError;\n  }\n}\n\n/**\n * Best-effort fetch of recent activity log entries. Returns [] on any error\n * so callers can treat absence of results as \"haven't detected anything yet\"\n * rather than a hard failure.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling from McpSuggestedPromptsScreen.\n * Deliberately retained for future features that want a soft signal of\n * recent project changes (e.g. dashboards, audit summaries). See the\n * ActivityLogEntrySchema doc comment for the keep-vs-delete rationale.\n */\nexport async function fetchRecentActivity(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  since: Date,\n): Promise<ActivityLogEntry[]> {\n  try {\n    const response = await axios.get(\n      `${baseUrl}/api/projects/${projectId}/activity_log/`,\n      {\n        params: { limit: 10 },\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          'User-Agent': WIZARD_USER_AGENT,\n        },\n        // Short timeout — best-effort probe, not a critical path.\n        timeout: 4000,\n      },\n    );\n    const parsed = ActivityLogResponseSchema.safeParse(response.data);\n    if (!parsed.success) return [];\n    const sinceMs = since.getTime();\n    return parsed.data.results.filter((entry) => {\n      if (!entry.created_at) return false;\n      const t = Date.parse(entry.created_at);\n      return Number.isFinite(t) && t >= sinceMs;\n    });\n  } catch {\n    return [];\n  }\n}\n\nexport async function fetchProjectData(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n): Promise<ApiProject> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/projects/${projectId}/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiProjectSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch project data');\n    analytics.captureException(apiError, {\n      endpoint: `/api/projects/${projectId}/`,\n      baseUrl,\n      projectId,\n    });\n    throw apiError;\n  }\n}\n\n/** Minimal shape of `/api/projects/:id/integrations/` — we only read `kind`. */\nconst IntegrationsResponseSchema = z.object({\n  results: z.array(z.object({ kind: z.string().nullish() }).passthrough()),\n});\n\n/**\n * Check whether the project already has a Slack integration connected.\n * Requires the `integration:read` scope. Throws on failure — callers\n * (including the SlackConnectScreen poll) decide how to degrade and\n * are responsible for capturing the error exactly once.\n */\nexport async function fetchSlackConnected(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  signal?: AbortSignal,\n): Promise<boolean> {\n  const response = await axios.get(\n    `${baseUrl}/api/projects/${projectId}/integrations/`,\n    {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      signal,\n    },\n  );\n  const parsed = IntegrationsResponseSchema.safeParse(response.data);\n  if (!parsed.success) return false;\n  return parsed.data.results.some((i) => i.kind === 'slack');\n}\n\nexport function handleApiError(error: unknown, operation: string): ApiError {\n  if (axios.isAxiosError(error)) {\n    const axiosError = error as AxiosError<{ detail?: string }>;\n    const status = axiosError.response?.status;\n    const detail = axiosError.response?.data?.detail;\n    const endpoint = axiosError.config?.url;\n\n    if (status === 401) {\n      return new ApiError(\n        `Authentication failed while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 403) {\n      return new ApiError(\n        `Access denied while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 404) {\n      return new ApiError(\n        `Resource not found while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    const message = detail || `Failed to ${operation}`;\n    return new ApiError(message, status, endpoint);\n  }\n\n  if (error instanceof z.ZodError) {\n    return new ApiError(`Invalid response format while trying to ${operation}`);\n  }\n\n  return new ApiError(\n    `Unexpected error while trying to ${operation}: ${\n      error instanceof Error ? error.message : 'Unknown error'\n    }`,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,gBAAgB,EAC1B,OAAO;CAEN,aAAa,EAAE,QAAQ;CACvB,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,IAAI,EAAE,QAAQ,CAAC,SAAS;CAGxB,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,mBAAmB,EAAE,SAAS,CAAC,SAAS;CACxC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACrC,UAAU,EAAE,SAAS,CAAC,SAAS;CAG/B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CAKrC,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAI1C,MAAM,EACH,OAAO;EACN,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM;EAC/B,WAAW,EAAE,QAAQ,CAAC,SAAS;EAC/B,YAAY,EAAE,QAAQ,CAAC,SAAS;EAChC,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,UAAU,EAAE,QAAQ,CAAC,SAAS;EAC/B,CAAC,CACD,aAAa;CAChB,cAAc,EACX,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACtC,aAAa,EAAE,QAAQ,CAAC,SAAS;EAIjC,gCAAgC,EAAE,SAAS,CAAC,SAAS;EACtD,CAAC,CACD,aAAa;CAChB,eAAe,EAAE,MACf,EACG,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACvC,CAAC,CACD,aAAa,CACjB;CACF,CAAC,CACD,aAAa;;;;;;;;;;;;AAahB,MAAa,yBAAyB,EACnC,OAAO;CACN,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,YAAY,EAAE,QAAQ,CAAC,SAAS;CACjC,CAAC,CACD,aAAa;AAGyB,EAAE,OAAO,EAChD,SAAS,EAAE,MAAM,uBAAuB,EACzC,CAAC;AAKF,MAAa,mBAAmB,EAAE,OAAO;CACvC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ,CAAC,MAAM;CACvB,cAAc,EAAE,QAAQ,CAAC,MAAM;CAC/B,WAAW,EAAE,QAAQ;CACrB,MAAM,EAAE,QAAQ;CAOhB,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,+BAA+B,EAAE,SAAS,CAAC,SAAS;CACpD,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACtC,CAAC;AAKF,IAAa,WAAb,cAA8B,MAAM;CAClC,YACE,SACA,YACA,UACA;AACA,QAAM,QAAQ;AAHE,OAAA,aAAA;AACA,OAAA,WAAA;AAGhB,OAAK,OAAO;;;AAIhB,eAAsB,cACpB,aACA,SACkB;AAClB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,kBAAkB,EAC5D,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,cAAc,MAAM,SAAS,KAAK;UAClC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,kBAAkB;AACzD,YAAU,iBAAiB,UAAU;GACnC,UAAU;GACV;GACD,CAAC;AACF,QAAM;;;AA+CV,eAAsB,iBACpB,aACA,WACA,SACqB;AACrB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,gBAAgB,UAAU,IAAI,EACxE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,iBAAiB,MAAM,SAAS,KAAK;UACrC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,qBAAqB;AAC5D,YAAU,iBAAiB,UAAU;GACnC,UAAU,iBAAiB,UAAU;GACrC;GACA;GACD,CAAC;AACF,QAAM;;;;AAKV,MAAM,6BAA6B,EAAE,OAAO,EAC1C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,EACzE,CAAC;;;;;;;AAQF,eAAsB,oBACpB,aACA,WACA,SACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,IAC3B,GAAG,QAAQ,gBAAgB,UAAU,iBACrC;EACE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf;EACD;EACD,CACF;CACD,MAAM,SAAS,2BAA2B,UAAU,SAAS,KAAK;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,QAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,QAAQ;;AAG5D,SAAgB,eAAe,OAAgB,WAA6B;AAC1E,KAAI,MAAM,aAAa,MAAM,EAAE;EAC7B,MAAM,aAAa;EACnB,MAAM,SAAS,WAAW,UAAU;EACpC,MAAM,SAAS,WAAW,UAAU,MAAM;EAC1C,MAAM,WAAW,WAAW,QAAQ;AAEpC,MAAI,WAAW,IACb,QAAO,IAAI,SACT,yCAAyC,aACzC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,iCAAiC,aACjC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,sCAAsC,aACtC,QACA,SACD;AAIH,SAAO,IAAI,SADK,UAAU,aAAa,aACV,QAAQ,SAAS;;AAGhD,KAAI,iBAAiB,EAAE,SACrB,QAAO,IAAI,SAAS,2CAA2C,YAAY;AAG7E,QAAO,IAAI,SACT,oCAAoC,UAAU,IAC5C,iBAAiB,QAAQ,MAAM,UAAU,kBAE5C"}

package/dist/bin.js

@@ -1,23 +1,24 @@
 #!/usr/bin/env node
-import { Ct as regionOption, L as Integration, St as isHeadless, U as POSTHOG_DOCS_URL, a as getLogFilePath, f as getUI, ft as WIZARD_USER_AGENT, ht as VERSION, m as LoggingUI, p as setUI, pt as getSkillsBaseUrl, r as debug, s as logToFile, xt as headlessOption } from "./debug-Di-I0xld.js";
-import { n as analytics } from "./analytics-Bvq5-kCh.js";
-import { r as setEntryCommand } from "./telemetry-C5Aokvv-.js";
-import { a as safeReadFile, o as walkProjectFiles } from "./bounded-fs-B4JlDu5o.js";
-import { n as isUsingTypeScript } from "./setup-utils-DJzrAj8A.js";
-import { o as handleApiError } from "./api-Ca6ntEhK.js";
+import { Ct as regionOption, L as Integration, St as isHeadless, U as POSTHOG_DOCS_URL, a as getLogFilePath, f as getUI, ft as WIZARD_USER_AGENT, ht as VERSION, m as LoggingUI, p as setUI, pt as getSkillsBaseUrl, r as debug, s as logToFile, xt as headlessOption } from "./debug-D3Ucw2y1.js";
+import { n as analytics } from "./analytics-B9V7x1Ma.js";
+import { r as setEntryCommand } from "./telemetry-mi4dua6_.js";
+import { a as safeReadFile, o as walkProjectFiles } from "./bounded-fs-xkhfF3JS.js";
+import { n as isUsingTypeScript } from "./setup-utils-VtxhrSx8.js";
+import { o as handleApiError } from "./api-OHLXhKTy.js";
 import "./wizard-session-CwgR5y3-.js";
-import { r as runCleanups } from "./wizard-abort-XOuqDEDH.js";
-import { n as isNonInteractiveEnvironment } from "./environment-CDirVbtE.js";
-import { n as runAgent, o as authenticate } from "./agent-runner-Dp581Sva.js";
-import { S as WIZARD_TOOL_NAMES, T as fetchSkillMenu, l as recoverOrphanedSettingsBackups, p as AgentSignals } from "./agent-interface-DX6gTS9D.js";
-import { S as SETUP_REPORT_FILE, _ as AUDIT_CHECKS_KEY, g as AUDIT_CHECKS_FILE, v as AUDIT_REPORT_FILE } from "./yara-hooks-QuIJX1gt.js";
-import { i as SPINNER_MESSAGE } from "./registry-Cre35rWW.js";
-import { C as resolveProjectDir, _ as WAREHOUSE_ABORT_CASES, a as LINE_CHART_BLOCK, b as detectWarehouseSources, d as isClearBlock, g as HEALTH_CHECK_STEP, h as Icons, i as FUNNEL_BLOCK, m as Colors, n as integrationRunStep, o as PRODUCT_SUITE_BLOCK, r as posthogIntegrationConfig, s as StatusPeekTrigger, u as wordWrap, v as detectWarehousePrerequisites, w as gatherFrameworkContext, x as detectIntegrationProjects, y as getDetectedWarehouseSources } from "./posthog-integration-BbzluO9E.js";
+import { r as runCleanups } from "./wizard-abort-Bgx_JOfw.js";
+import { n as isNonInteractiveEnvironment } from "./environment-BN8ROaHv.js";
+import { n as runAgent, o as authenticate } from "./agent-runner-DUyxA1TQ.js";
+import { u as writeJsonAtomic } from "./queue-tools-QVKYMX_C.js";
+import { S as WIZARD_TOOL_NAMES, T as fetchSkillMenu, l as recoverOrphanedSettingsBackups, p as AgentSignals } from "./agent-interface-CybBFwnk.js";
+import { S as SETUP_REPORT_FILE, _ as AUDIT_CHECKS_KEY, g as AUDIT_CHECKS_FILE, v as AUDIT_REPORT_FILE } from "./yara-hooks-Cj8x2YV4.js";
+import { i as SPINNER_MESSAGE } from "./registry-CboWk-Ny.js";
+import { C as resolveProjectDir, _ as WAREHOUSE_ABORT_CASES, a as LINE_CHART_BLOCK, b as detectWarehouseSources, d as isClearBlock, g as HEALTH_CHECK_STEP, h as Icons, i as FUNNEL_BLOCK, m as Colors, n as integrationRunStep, o as PRODUCT_SUITE_BLOCK, r as posthogIntegrationConfig, s as StatusPeekTrigger, u as wordWrap, v as detectWarehousePrerequisites, w as gatherFrameworkContext, x as detectIntegrationProjects, y as getDetectedWarehouseSources } from "./posthog-integration-CxIj49T4.js";
 import { n as readApiKeyFromEnv } from "./env-api-key-cjD4yfGT.js";
 import { satisfies } from "semver";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import fs, { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
 import path, { join, relative } from "path";
 import * as os from "node:os";
 import * as path$1 from "node:path";
@@ -200,7 +201,7 @@ function runProvision(argv) {
 }
 async function provision({ email, region, name, baseUrl, jsonMode }) {
 	try {
-		const { provisionNewAccount } = await import("./provisioning-BiZdXls3.js").then((n) => n.r);
+		const { provisionNewAccount } = await import("./provisioning-BpqrbURn.js").then((n) => n.r);
 		if (!jsonMode) getUI().log.info(`Provisioning account for ${email} in ${region}...`);
 		emitResult(await provisionNewAccount(email, name, region, { baseUrl }), jsonMode);
 		process.exit(0);
@@ -267,22 +268,22 @@ const basicIntegrationCommand = {
 		setEntryCommand("integrate");
 		(async () => {
 			if (isHeadless(argv)) {
-				const { runHeadlessInstall } = await import("./ci-install-Dv13uR0A.js");
+				const { runHeadlessInstall } = await import("./ci-install-B31ciXo4.js");
 				return runHeadlessInstall(argv);
 			}
 			if (argv.ci) {
-				const { runCIInstall } = await import("./ci-install-Dv13uR0A.js");
+				const { runCIInstall } = await import("./ci-install-B31ciXo4.js");
 				return runCIInstall(argv);
 			}
 			if (isNonInteractiveEnvironment()) {
-				const { failNonInteractive } = await import("./non-interactive-B5Mw8p2W.js");
+				const { failNonInteractive } = await import("./non-interactive-BUmW9f9P.js");
 				return failNonInteractive();
 			}
 			if (argv.playground) {
-				const { runPlayground } = await import("./playground-BOiANd3j.js");
+				const { runPlayground } = await import("./playground-Df_ZzalF.js");
 				return runPlayground();
 			}
-			const { runInteractive } = await import("./interactive-CafIogBs.js");
+			const { runInteractive } = await import("./interactive-DeFFwXME.js");
 			runInteractive(argv);
 		})();
 	}
@@ -665,10 +666,18 @@ const AUDIT_ABORT_CASES = [{
 //#endregion
 //#region src/lib/programs/audit/seed.ts
 /**
-* The 10 data-integrity checks the audit runs, plus one workflow row for the
-* notebook upload at the end (so the skill's `audit_resolve_checks` call for
-* `upload-notebook` succeeds — the skill writes the report to a PostHog
-* notebook as its final step).
+* The 10 source-tree checks the audit runs, plus one row for the PostHog-side
+* sweep and two workflow rows at the end (so the skill's
+* `audit_resolve_checks` calls for `write-report` and `upload-notebook`
+* succeed — the skill writes the report to disk, then mirrors it into a
+* PostHog notebook as its final step).
+*
+* `posthog-side-findings` is a sweep row, not a rule: the skill reads what
+* PostHog itself already computed for this project (error-tracking
+* recommendations, health issues) and appends one row per open finding via
+* `audit_add_checks`. That's why the seed can't enumerate them — the list is
+* whatever the project's data says today, and it grows as PostHog ships new
+* checks, with no wizard release needed.
 */
 const AUDIT_SEED_CHECKS = [
 	{
@@ -731,6 +740,12 @@ const AUDIT_SEED_CHECKS = [
 		label: "Key activation events captured",
 		status: "pending"
 	},
+	{
+		id: "live-data-findings",
+		area: "Live Data",
+		label: "Open findings in PostHog",
+		status: "pending"
+	},
 	{
 		id: "write-report",
 		area: "Write report",
@@ -752,9 +767,7 @@ const AUDIT_SEED_CHECKS = [
 */
 function seedAuditLedger(installDir, checks = AUDIT_SEED_CHECKS) {
 	const target = path.join(installDir, AUDIT_CHECKS_FILE);
-	const tmp = `${target}.tmp`;
-	fs.writeFileSync(tmp, JSON.stringify(checks, null, 2), "utf8");
-	fs.renameSync(tmp, target);
+	writeJsonAtomic(target, checks);
 	logToFile(`seedAuditLedger: wrote ${checks.length} entries to ${target}`);
 }
 //#endregion
@@ -3058,7 +3071,7 @@ function buildSelfDrivingPrompt(ctx, detectedSources = []) {
 	const inboxUrl = `${projectBase}/inbox`;
 	const optIn = (value) => value === true ? "ON" : value === false ? "OFF" : "unknown";
 	const optIns = ctx.teamProductOptIns;
-	return `You are setting up PostHog Self-driving for this project: you will enable the right signal sources, make sure GitHub is connected, tune the scout troop, design custom scouts for what this product uniquely needs, and hand the user a configured inbox.
+	return `You are setting up PostHog Self-driving for this project: you will enable the right signal sources, make sure GitHub is connected, tune the scout troop, design custom scouts for what this product uniquely needs, put Replay Vision scanners on its key flows, and hand the user a configured inbox.
 
 Project URLs:
 - Integrations settings: ${integrationsSettingsUrl}
@@ -3093,6 +3106,7 @@ tasks, in this order:
   5. Offer issue-tracker integrations
   6. Configure the scout troop
   6b. Design custom scouts
+  6c. Set up Replay Vision scanners
   7. Write report and hand off
 Drive the list with TaskUpdate — mark a task in_progress when you start
 it and completed when done. If a step turns out to be a no-op (e.g.
@@ -3201,6 +3215,13 @@ STEP 6b — Design custom scouts for this product. (skill: "Custom scouts")
    no gap at all) is a valid outcome, not an abort. Mark the task
    completed either way.
 
+STEP 6c — Set up Replay Vision scanners. (skill: "Replay Vision scanners")
+   Create the scanner skeletons the skill defines, filling the per-product
+   blanks it leaves you from this repo's code. Scanners need Session Replay
+   on (STEP 3b). Every failure here — no recordings yet, a backend-only
+   project, the scanner API missing — is a follow-up, never an abort; mark
+   the task completed regardless.
+
 STEP 7 — Write the report and hand off. (skill: "Report")
    Write the report per the skill, including follow-ups for anything
    deferred. Tell the user findings will start appearing in their inbox
@@ -3219,6 +3240,11 @@ const SELF_DRIVING_TIPS = [
 		title: "Scout",
 		description: "An agent on a schedule, watching your sources for anomalies and patterns. Your project gets up to 100 scout runs a day by default."
 	},
+	{
+		id: "scanner",
+		title: "Scanner",
+		description: "Where a scout reads your data, a scanner watches session recordings — an LLM spotting what broke on screen. It spends Replay Vision quota, so it stays scoped to your key flows."
+	},
 	{
 		id: "signal-report",
 		title: "Signal → report",
@@ -3745,15 +3771,23 @@ const mcpAnalyticsConfig = createSkillProgram({
 	docsUrl: "https://posthog.com/docs/mcp-analytics",
 	spinnerMessage: "Setting up MCP analytics...",
 	estimatedDurationMinutes: 5,
-	abortCases: [{
-		match: /^not a javascript mcp server$/i,
-		message: "Not a JavaScript/TypeScript MCP server",
-		body: "MCP analytics is currently TypeScript/JavaScript-only — the `@posthog/mcp` SDK is a Node package (a Python SDK is on the roadmap). This project doesn't look like a JS/TS MCP server, so there's nothing to instrument. See https://posthog.com/docs/mcp-analytics for the supported setups."
-	}, {
-		match: /^no mcp server found$/i,
-		message: "No MCP server found",
-		body: "This command instruments an existing MCP server with PostHog analytics, but no MCP server was found in this project. If you just want PostHog product analytics, run `npx @posthog/wizard` instead."
-	}]
+	abortCases: [
+		{
+			match: /^unsupported language for mcp analytics$/i,
+			message: "Unsupported language for MCP analytics",
+			body: "MCP analytics supports TypeScript/JavaScript (`@posthog/mcp`) and Python (`posthog.mcp`, shipped inside the `posthog` package). This project doesn't look like either, so there's nothing to instrument. See https://posthog.com/docs/mcp-analytics for the supported setups."
+		},
+		{
+			match: /^no mcp server found$/i,
+			message: "No MCP server found",
+			body: "This command instruments an existing MCP server with PostHog analytics, but no MCP server was found in this project. If you just want PostHog product analytics, run `npx @posthog/wizard` instead."
+		},
+		{
+			match: /^could not locate the server entry point$/i,
+			message: "Could not locate the MCP server entry point",
+			body: "This project has MCP signals, but the agent couldn't find where the server is constructed or requests are dispatched, so there's nowhere safe to add instrumentation. See https://posthog.com/docs/mcp-analytics for the supported server styles, or point the wizard at the package that defines the server if it's in a monorepo subdirectory."
+		}
+	]
 });
 //#endregion
 //#region src/lib/programs/ai-observability/index.ts
@@ -3924,7 +3958,7 @@ function runMcpAdd(argv) {
 		const debug = argv.debug;
 		const localMcp = argv.local;
 		try {
-			const { startTUI } = await import("./start-tui-DI-CdvAc.js");
+			const { startTUI } = await import("./start-tui-CzMiitZJ.js");
 			const { buildSession } = await import("./wizard-session-DsK16SGs.js");
 			const tui = startTUI(VERSION, Program.McpAdd);
 			tui.store.session = buildSession({
@@ -3937,7 +3971,7 @@ function runMcpAdd(argv) {
 		} catch (error) {
 			if (!isTUIUnavailable(error)) throw error;
 			setUI(new LoggingUI());
-			const { addMCPServerToClientsStep } = await import("./add-mcp-server-to-clients-63P59vxz.js").then((n) => n.r);
+			const { addMCPServerToClientsStep } = await import("./add-mcp-server-to-clients-CM30npkB.js").then((n) => n.r);
 			await addMCPServerToClientsStep({
 				local: localMcp,
 				features,
@@ -3976,7 +4010,7 @@ function runMcpRemove(argv) {
 		const debug = argv.debug;
 		const localMcp = argv.local;
 		try {
-			const { startTUI } = await import("./start-tui-DI-CdvAc.js");
+			const { startTUI } = await import("./start-tui-CzMiitZJ.js");
 			const { buildSession } = await import("./wizard-session-DsK16SGs.js");
 			const tui = startTUI(VERSION, Program.McpRemove);
 			tui.store.session = buildSession({
@@ -3986,7 +4020,7 @@ function runMcpRemove(argv) {
 			});
 		} catch {
 			setUI(new LoggingUI());
-			const { removeMCPServerFromClientsStep } = await import("./add-mcp-server-to-clients-63P59vxz.js").then((n) => n.r);
+			const { removeMCPServerFromClientsStep } = await import("./add-mcp-server-to-clients-CM30npkB.js").then((n) => n.r);
 			await removeMCPServerFromClientsStep({ local: localMcp });
 		}
 	})();
@@ -4008,7 +4042,7 @@ function runMcpTutorial(argv) {
 		const debug = argv.debug;
 		const localMcp = argv.local;
 		try {
-			const { startTUI } = await import("./start-tui-DI-CdvAc.js");
+			const { startTUI } = await import("./start-tui-CzMiitZJ.js");
 			const { buildSession } = await import("./wizard-session-DsK16SGs.js");
 			const tui = startTUI(VERSION, Program.McpTutorial);
 			tui.store.session = buildSession({
@@ -4090,10 +4124,10 @@ function runWizard(config, options) {
 	(async () => {
 		try {
 			const installDir = options.installDir || process.cwd();
-			const { startTUI } = await import("./start-tui-DI-CdvAc.js");
+			const { startTUI } = await import("./start-tui-CzMiitZJ.js");
 			const { buildSession, RunPhase } = await import("./wizard-session-DsK16SGs.js");
-			const { TaskStreamPush } = await import("./task-stream-CkkIJLFH.js");
-			const { PostHogDestination } = await import("./posthog-Dz1JvV4p.js");
+			const { TaskStreamPush } = await import("./task-stream-CFAXlJLv.js");
+			const { PostHogDestination } = await import("./posthog-DLklk2yT.js");
 			tui = startTUI(WIZARD_VERSION, config.id);
 			const activeTui = tui;
 			const session = buildSession({
@@ -4159,7 +4193,7 @@ function runWizard(config, options) {
 				if (shown(step)) await advanceStep(step, activeTui.store, config);
 			}
 			else if (skipAgent) {
-				const { getOrAskForProjectData } = await import("./setup-utils-DJzrAj8A.js").then((n) => n.r);
+				const { getOrAskForProjectData } = await import("./setup-utils-VtxhrSx8.js").then((n) => n.r);
 				const { projectApiKey, host, accessToken, projectId } = await getOrAskForProjectData({
 					signup: session.signup,
 					ci: session.ci,
@@ -4261,10 +4295,10 @@ function runNonInteractive(config, options, mode) {
 	(async () => {
 		const path = await import("path");
 		const { buildSession, RunPhase, OutroKind } = await import("./wizard-session-DsK16SGs.js");
-		const { readEnvironment } = await import("./environment-CDirVbtE.js").then((n) => n.t);
+		const { readEnvironment } = await import("./environment-BN8ROaHv.js").then((n) => n.t);
 		const { readApiKeyFromEnv } = await import("./env-api-key-cjD4yfGT.js").then((n) => n.t);
-		const { configureLogFileFromEnvironment, logToFile } = await import("./debug-CXSslVYE.js");
-		const { wizardAbort, WizardError } = await import("./wizard-abort-DjVeqr37.js");
+		const { configureLogFileFromEnvironment, logToFile } = await import("./debug-Cx9Delbc.js");
+		const { wizardAbort, WizardError } = await import("./wizard-abort-D0HFMYCV.js");
 		configureLogFileFromEnvironment();
 		const env = readEnvironment();
 		const apiKey = options.apiKey ?? readApiKeyFromEnv() ?? void 0;
@@ -4297,9 +4331,9 @@ function runNonInteractive(config, options, mode) {
 		let store = null;
 		let taskStream = null;
 		if (mode === "headless") {
-			const { WizardStore } = await import("./store-DM0yBeJ8.js").then((n) => n.n);
-			const { HeadlessUI } = await import("./headless-ui-DdWlD7hz.js");
-			const { TaskStreamPush, PostHogDestination } = await import("./task-stream-CkkIJLFH.js");
+			const { WizardStore } = await import("./store-V71P5KpB.js").then((n) => n.n);
+			const { HeadlessUI } = await import("./headless-ui-DoQlIoeh.js");
+			const { TaskStreamPush, PostHogDestination } = await import("./task-stream-CFAXlJLv.js");
 			store = new WizardStore(config.id);
 			store.session = session;
 			setUI(new HeadlessUI(store));
@@ -4355,7 +4389,7 @@ function runNonInteractive(config, options, mode) {
 					});
 				}
 			}
-			const { runAgent } = await import("./agent-runner-Dp581Sva.js").then((n) => n.t);
+			const { runAgent } = await import("./agent-runner-DUyxA1TQ.js").then((n) => n.t);
 			await runAgent(config, session);
 			await settleStream(RunPhase.Completed);
 		} catch (error) {
@@ -5437,7 +5471,7 @@ async function runDoctorCI(options) {
 	getUI().intro("Welcome to the PostHog setup wizard");
 	getUI().log.info("Running posthog-doctor in CI mode");
 	try {
-		const { getOrAskForProjectData } = await import("./setup-utils-DJzrAj8A.js").then((n) => n.r);
+		const { getOrAskForProjectData } = await import("./setup-utils-VtxhrSx8.js").then((n) => n.r);
 		const { host, accessToken, projectId } = await getOrAskForProjectData({
 			signup: false,
 			ci: true,
@@ -5455,7 +5489,7 @@ async function runDoctorCI(options) {
 		for (const issue of sorted) getUI().log.info(`  • [${issue.severity}] ${getKindMeta(issue.kind).title}`);
 		process.exit(1);
 	} catch (error) {
-		const { ApiError } = await import("./api-Ca6ntEhK.js").then((n) => n.n);
+		const { ApiError } = await import("./api-OHLXhKTy.js").then((n) => n.n);
 		const message = error instanceof ApiError && error.statusCode === 401 ? "Your PostHog API key is invalid or expired." : error instanceof Error ? error.message : String(error);
 		getUI().log.error(`Doctor failed: ${message}`);
 		process.exit(1);
@@ -5537,7 +5571,7 @@ function runSlackConnect(argv) {
 	(async () => {
 		const debug = argv.debug;
 		try {
-			const { startTUI } = await import("./start-tui-DI-CdvAc.js");
+			const { startTUI } = await import("./start-tui-CzMiitZJ.js");
 			const { buildSession } = await import("./wizard-session-DsK16SGs.js");
 			const tui = startTUI(VERSION, Program.SlackConnect);
 			tui.store.session = buildSession({
@@ -5601,6 +5635,36 @@ function readSkillName(argv) {
 	return String(argv.skillName ?? argv["skill-name"] ?? "").trim();
 }
 const BROWSABLE_ROLES = new Set(["command", "skill"]);
+/**
+* Reject an unknown skill id before the wizard authenticates.
+*
+* Without this, `readSkillName` accepts any non-empty string and the name is
+* only validated far downstream, when the agent tries to download it — after
+* the user has already logged in. A typo then costs a full auth round-trip
+* (the concern raised in review). We resolve against the same set
+* `downloadSkill` uses (`categories` flattened by `id`), so this never
+* false-rejects a skill the download would have accepted.
+*
+* If the registry is unreachable we stay silent and defer to the download
+* step's own `menu-fetch-failed` handling, rather than adding a second network
+* dependency that could block an otherwise-valid run.
+*/
+async function assertSkillExists(skillName, localMcp) {
+	const skillsBaseUrl = getSkillsBaseUrl(localMcp);
+	const menu = await fetchSkillMenu(skillsBaseUrl);
+	if (!menu) return;
+	if (Object.values(menu.categories).flat().some((s) => s.id === skillName)) return;
+	analytics.wizardCapture("cli dispatch error", {
+		reason: "unknown skill",
+		family: "skill",
+		sub: skillName,
+		skillsBaseUrl
+	});
+	try {
+		await analytics.flush();
+	} catch {}
+	throw new Error(`Unknown skill "${skillName}". Run \`wizard skill list\` to see available skills.`);
+}
 function formatEntry(entry) {
 	const path = entry.parentCommand ? `wizard ${entry.parentCommand} ${entry.command}` : entry.command ? `wizard ${entry.command}` : `wizard skill ${entry.skillId}`;
 	return `  ${entry.skillId.padEnd(38)}  ${path.padEnd(36)}  ${entry.description}`;
@@ -5648,15 +5712,23 @@ const skillCommand = {
 		}
 	}],
 	options: { ...skillProgramOptions },
+	positionals: { "skill-name": {
+		type: "string",
+		describe: "Skill id to run (e.g. audit-events), or `list`"
+	} },
 	check: (argv) => {
 		if (argv.skillName == null && argv["skill-name"] == null) return true;
 		if (!readSkillName(argv)) throw new Error("skill needs a skill name, e.g. `wizard skill audit-events`");
 		return true;
 	},
 	handler: (argv) => {
-		runSkillMode({
-			...argv,
-			skill: readSkillName(argv)
+		runCommandHandler(async () => {
+			const skillName = readSkillName(argv);
+			await assertSkillExists(skillName, Boolean(argv["local-mcp"]));
+			runSkillMode({
+				...argv,
+				skill: skillName
+			});
 		});
 	}
 };