@posthog/wizard 2.75.0 → 2.76.1

package/dist/analytics-CcHoyhE_.js

@@ -0,0 +1,2 @@
+import { n as analytics } from "./analytics-DSVyjIVF.js";
+export { analytics };

package/dist/{analytics-DSK0GXg1.js → analytics-DSVyjIVF.js}

@@ -1,4 +1,4 @@
-import { C as ANALYTICS_HOST_URL, T as ANALYTICS_TEAM_TAG, _t as RUN_SURFACE, ht as VERSION, r as debug, rt as WIZARD_FLAG_KEYS, s as logToFile, vt as TASK_ID, w as ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, yt as TASK_RUN_ID } from "./debug-DUmMVUHn.js";
+import { E as ANALYTICS_TEAM_TAG, T as ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, bt as TASK_RUN_ID, gt as VERSION, it as WIZARD_FLAG_KEYS, r as debug, s as logToFile, vt as RUN_SURFACE, w as ANALYTICS_HOST_URL, yt as TASK_ID } from "./debug-DWYDVp0B.js";
 import { c as reportablePosthogSdkDetected, s as reportableDiscoveredFeatures } from "./wizard-session-FSJCkTcP.js";
 import { PostHog } from "posthog-node";
 import { v4 } from "uuid";
@@ -42,6 +42,7 @@ function sessionProperties(session) {
 	const posthogSdkDetected = reportablePosthogSdkDetected(session);
 	return {
 		integration: session.integration,
+		skill_id: session.skillId,
 		detected_framework: session.detectedFrameworkLabel,
 		typescript: session.typescript,
 		project_id: session.credentials?.projectId,
@@ -293,4 +294,4 @@ const analytics = new Analytics();
 //#endregion
 export { ciExcludedTaskTypes as a, sessionProperties as i, analytics as n, groupsFromUser as r, Analytics as t };
 
-//# sourceMappingURL=analytics-DSK0GXg1.js.map
+//# sourceMappingURL=analytics-DSVyjIVF.js.map

package/dist/analytics-DSVyjIVF.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-DSVyjIVF.js","names":["uuidv4"],"sources":["../src/utils/ci-flag-overrides.ts","../src/utils/analytics.ts"],"sourcesContent":["/**\n * CI-only feature-flag overrides.\n *\n * CI must route deterministically: a run that tests the orchestrator arm says\n * so explicitly instead of depending on a live feature flag someone can edit\n * mid-week. The override env var (see the allowlist in `env.ts`) is a JSON\n * object of flag key → value, merged over whatever PostHog returned.\n *\n * The override path exists only in CI builds (`pnpm build:ci`). Published\n * builds inline NODE_ENV as the literal \"production\", the guards collapse,\n * and tsdown strips the rest from the bundle — and the smoke test asserts the\n * env var names are physically absent from production output (which is also\n * why no comment in this file may spell them out), so this can never quietly\n * become a production surface.\n */\nimport { runtimeEnv } from '@env';\nimport { logToFile } from './debug';\n\nexport function applyCiFlagOverrides(\n  flags: Record<string, string>,\n  payloads: Record<string, unknown> = {},\n): { flags: Record<string, string>; payloads: Record<string, unknown> } {\n  // Compared inline (not via env.ts's IS_PRODUCTION_BUILD) so tsdown replaces\n  // it with a literal right here and the bundler can prove the rest of this\n  // function unreachable in production builds. The smoke test enforces that.\n  if (process.env.NODE_ENV === 'production') return { flags, payloads };\n\n  const raw = runtimeEnv('WIZARD_CI_FLAG_OVERRIDES');\n  if (!raw) return { flags, payloads };\n\n  let overrides: Record<string, unknown>;\n  try {\n    overrides = JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    // A malformed override is a CI misconfiguration. Fail the run loudly\n    // rather than silently testing whatever the live flags happen to say.\n    throw new Error(\n      'The CI flag-override env var is not valid JSON (expected {\"flag-key\": value, ...}).',\n    );\n  }\n\n  const mergedFlags = { ...flags };\n  const mergedPayloads = { ...payloads };\n  for (const [key, value] of Object.entries(overrides)) {\n    // An object/array override is a flag payload: the flag reads 'true' and\n    // the value rides the payload channel, matching a payload-carrying flag.\n    if (typeof value === 'object' && value !== null) {\n      mergedFlags[key] = 'true';\n      mergedPayloads[key] = value;\n    } else {\n      mergedFlags[key] = String(value);\n    }\n  }\n  logToFile('[flags] CI overrides applied', overrides);\n  return { flags: mergedFlags, payloads: mergedPayloads };\n}\n\n/**\n * Task types excluded from this run. The exclusion env var (see the allowlist\n * in `env.ts`) is a comma-separated list (e.g. `dashboard`), set by the CI\n * harness that owns the policy — the wizard and the served content stay\n * run-mode agnostic. CI-build only, same as the flag overrides: published\n * builds strip this path.\n */\nexport function ciExcludedTaskTypes(): readonly string[] {\n  if (process.env.NODE_ENV === 'production') return [];\n\n  const raw = runtimeEnv('WIZARD_CI_EXCLUDE_TASKS');\n  if (!raw) return [];\n  const types = raw\n    .split(',')\n    .map((t) => t.trim())\n    .filter(Boolean);\n  if (types.length > 0) logToFile('[flags] CI task exclusions', types);\n  return types;\n}\n","import { PostHog } from 'posthog-node';\nimport {\n  ANALYTICS_HOST_URL,\n  ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY,\n  ANALYTICS_TEAM_TAG,\n  WIZARD_FLAG_KEYS,\n} from '@lib/constants';\nimport {\n  reportableDiscoveredFeatures,\n  reportablePosthogSdkDetected,\n  type WizardSession,\n} from '@lib/wizard-session';\nimport type { ApiUser } from '@lib/api';\nimport { v4 as uuidv4 } from 'uuid';\nimport { IS_PRODUCTION_BUILD, RUN_SURFACE, TASK_ID, TASK_RUN_ID } from '@env';\nimport { VERSION } from '@lib/version';\nimport { debug, logToFile } from './debug';\nimport { applyCiFlagOverrides } from './ci-flag-overrides';\n\n/**\n * The invocation, reduced to flag-safe strings: the command word (first\n * positional, 'default' for the bare flow) and the sorted option NAMES.\n * Option values never leave the machine — they carry paths, emails, keys.\n */\nfunction invocationProperties(): { command: string; cli_flags: string } {\n  const args = process.argv.slice(2);\n  const command = args.find((a) => !a.startsWith('-')) ?? 'default';\n  const flags = [\n    ...new Set(\n      args\n        .filter((a) => a.startsWith('--'))\n        .map((a) => a.slice(2).split('=')[0]),\n    ),\n  ].sort();\n  return { command, cli_flags: flags.join(',') };\n}\n\n/**\n * Extract a standard property bag from the current session.\n * Used by store-level analytics and available for ad-hoc captures.\n */\nexport function sessionProperties(\n  session: WizardSession,\n): Record<string, unknown> {\n  // reportableDiscoveredFeatures() owns the consent decision; this file\n  // never needs to know what `scanConsent` means, only that the result\n  // might be absent. An absent key is unambiguous, while an empty array\n  // would read as \"we looked and found nothing\" instead of \"not reported\".\n  const discoveredFeatures = reportableDiscoveredFeatures(session);\n  const posthogSdkDetected = reportablePosthogSdkDetected(session);\n\n  return {\n    integration: session.integration,\n    // Discriminates a family leaf: `command` is the first positional, so every\n    // `wizard audit <leaf>` reports the same `audit`.\n    skill_id: session.skillId,\n    detected_framework: session.detectedFrameworkLabel,\n    typescript: session.typescript,\n    project_id: session.credentials?.projectId,\n    ...(discoveredFeatures !== undefined\n      ? { discovered_features: discoveredFeatures }\n      : {}),\n    scan_consent: session.scanConsent,\n    additional_features: session.additionalFeatureQueue,\n    run_phase: session.runPhase,\n    ...(posthogSdkDetected !== undefined\n      ? { posthog_sdk_detected: posthogSdkDetected }\n      : {}),\n  };\n}\n\nexport function groupsFromUser(\n  user: ApiUser | null,\n  host: string,\n): Record<string, string> {\n  const groups: Record<string, string> = { instance: host };\n  if (!user) return groups;\n\n  const organizationId = user.organization?.id;\n  if (organizationId) groups.organization = organizationId;\n\n  const customerId = user.organization?.customer_id;\n  if (customerId) groups.customer = customerId;\n\n  const projectUuid = user.team?.uuid;\n  if (projectUuid) groups.project = projectUuid;\n\n  return groups;\n}\n\nconst WIZARD_FLAGS: ReadonlySet<string> = new Set(WIZARD_FLAG_KEYS);\n\n// Widen back to the SDK's shape — a filter on `true` never matches `'true'`.\nfunction flagResponseValue(value: string): string | boolean {\n  if (value === 'true') return true;\n  if (value === 'false') return false;\n  return value;\n}\n\nexport class Analytics {\n  private client: PostHog;\n  private tags: Record<string, string | boolean | number | null | undefined> =\n    {};\n  private distinctId?: string;\n  private anonymousId: string;\n  private _runId: string;\n  private sessionId: string | null = null;\n  private appName = 'wizard';\n  private activeFlags: Record<string, string> | null = null;\n  private activeFlagPayloads: Record<string, unknown> = {};\n  private groups: Record<string, string> = {};\n  private personProperties: Record<string, string> = {};\n  private terminalEventSent = false;\n\n  constructor() {\n    this.client = new PostHog(ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, {\n      host: ANALYTICS_HOST_URL,\n      flushAt: 1,\n      flushInterval: 0,\n      enableExceptionAutocapture: true,\n      before_send: (event) => {\n        if (!event) return event;\n        if (Object.keys(this.groups).length > 0) {\n          event.groups = { ...this.groups, ...event.groups };\n        }\n        // Autocaptured exceptions arrive with a random uuid and\n        // `$process_person_profile: false` — reattach the run's identity\n        // and tags so they land on the same person as everything else.\n        if (event.event === '$exception') {\n          event.distinctId = this.distinctId ?? this.anonymousId;\n          const { $process_person_profile, ...properties } =\n            event.properties ?? {};\n          void $process_person_profile;\n          event.properties = { ...this.tags, ...properties };\n        }\n        // The SDK captures this one itself, bypassing capture(), so tags merge here.\n        if (event.event === '$feature_flag_called') {\n          event.properties = { ...this.tags, ...(event.properties ?? {}) };\n        }\n        return event;\n      },\n    });\n\n    this.tags = { $app_name: this.appName };\n    // Tag every run with its build type so prod / dev / ci / headless segment\n    // cleanly in analytics. tsdown inlines IS_PRODUCTION_BUILD to `true` in\n    // published builds and `false` for dev/tsx/test runs. Non-interactive runs\n    // upgrade this in runWizardCI: dev `--ci` runs to 'ci', published headless\n    // runs to 'headless'.\n    this.tags.build = IS_PRODUCTION_BUILD ? 'prod' : 'dev';\n\n    this.tags.run_surface = RUN_SURFACE;\n\n    // The build this run came from. Already sent as a flag-evaluation person\n    // property; tagging it makes every event attributable to a release, so a\n    // regression can be bounded to the versions that carry it.\n    this.tags.version = VERSION;\n\n    // Cloud runs only: the task run that owns the sandbox. Without these the\n    // wizard's events and the run that launched it are two unrelated streams,\n    // since run_id above is minted per process and never leaves the wizard.\n    // Left unset for local runs so the properties stay absent rather than null.\n    if (TASK_RUN_ID) this.tags.task_run_id = TASK_RUN_ID;\n    if (TASK_ID) this.tags.task_id = TASK_ID;\n\n    this.anonymousId = uuidv4();\n\n    // One id per process = one id per wizard run, registered in the tag bag\n    // so it rides on every capture, exception, and autocaptured exception\n    // (all of which merge `this.tags`). Lets you separate two runs by the\n    // same logged-in user, who otherwise share one distinct id. Distinct\n    // from `anonymousId`, the pre-login *person* id that gets aliased onto\n    // the real user at login. `$session_id` is intentionally not set here —\n    // it stays null until OAuth completes (see identifyUser).\n    this._runId = uuidv4();\n    this.tags.run_id = this._runId;\n\n    this.distinctId = undefined;\n  }\n\n  /** Per-process run id, tagged on every event and gateway trace. */\n  get runId(): string {\n    return this._runId;\n  }\n\n  /** Build type for this run ('prod' | 'dev' | 'ci' | 'headless') — the same value tagged on every analytics event. */\n  get build(): string {\n    return String(this.tags.build ?? 'dev');\n  }\n\n  /**\n   * Associate the run with the logged-in user, once per id. Identifies them\n   * (email, name) and records those person properties so events carry them and\n   * feature flags can target the individual user — without the email here the\n   * wizard only sends `$app_name`, so email-targeted flags never match. Opens\n   * the analytics session on first login, then aliases the run's anonymous id\n   * onto the identified person so pre-login events merge in.\n   */\n  identifyUser(user: ApiUser) {\n    const distinctId = user.distinct_id;\n    if (this.distinctId === distinctId || distinctId === this.anonymousId) {\n      return;\n    }\n    this.distinctId = distinctId;\n    // Open the analytics session on first login. Null until here, so\n    // pre-OAuth events carry only `run_id`; from now on every event also\n    // carries `$session_id` and PostHog groups the authenticated run into a\n    // native Session. Stored in the tag bag so it rides on every subsequent\n    // capture and exception.\n    if (!this.sessionId) {\n      this.sessionId = uuidv4();\n      this.tags.$session_id = this.sessionId;\n    }\n    const props: Record<string, string> = {};\n    if (user.email) props.email = user.email;\n    const name = [user.first_name, user.last_name]\n      .filter(Boolean)\n      .join(' ')\n      .trim();\n    if (name) props.name = name;\n    this.personProperties = props;\n    this.client.identify({ distinctId, properties: { $set: props } });\n    this.client.alias({\n      distinctId,\n      alias: this.anonymousId,\n    });\n    // The flag snapshot is per identity. Anything evaluated before login (the\n    // intro screen reads the tools-menu flag) was anonymous — drop it so the\n    // next read re-evaluates as this user.\n    this.activeFlags = null;\n    this.activeFlagPayloads = {};\n  }\n\n  /** Person properties sent with flag evaluation: app name plus the user's. */\n  private flagPersonProperties(): Record<string, string> {\n    // Environment facts flag conditions can scope on — evaluation-time only,\n    // never persisted onto the person. `version` gates an experiment to\n    // releases that implement it (a condition on a property older builds\n    // don't send silently never matches them); `run_surface`/`build` scope\n    // by invocation surface; `command`/`cli_flags` by subcommand; `os`/\n    // `node_major` by platform.\n    return {\n      $app_name: this.appName,\n      version: VERSION,\n      run_surface: RUN_SURFACE,\n      build: String(this.tags.build ?? 'dev'),\n      os: process.platform,\n      node_major: process.versions.node.split('.')[0],\n      ...invocationProperties(),\n      ...this.personProperties,\n    };\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  setGroups(groups: Record<string, string>) {\n    this.groups = groups;\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    this.client.captureException(error, this.distinctId ?? this.anonymousId, {\n      team: ANALYTICS_TEAM_TAG,\n      ...this.tags,\n      ...properties,\n    });\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: eventName,\n      properties: {\n        ...this.tags,\n        ...this.wizardFlagFeatureProperties(),\n        ...properties,\n      },\n    });\n  }\n\n  groupIdentify(\n    groupType: string,\n    groupKey: string,\n    properties: Record<string, unknown>,\n  ) {\n    this.client.groupIdentify({ groupType, groupKey, properties });\n  }\n\n  // Built from the resolved map, not the SDK snapshot: a CI-forced variant must own its events.\n  private wizardFlagFeatureProperties(): Record<string, unknown> {\n    if (this.activeFlags === null) return {};\n    const props: Record<string, unknown> = {};\n    const active: string[] = [];\n    for (const [key, value] of Object.entries(this.activeFlags)) {\n      if (!WIZARD_FLAGS.has(key)) continue;\n      const resolved = flagResponseValue(value);\n      props[`$feature/${key}`] = resolved;\n      if (resolved !== false) active.push(key);\n    }\n    if (active.length > 0) props.$active_feature_flags = active.sort();\n    return props;\n  }\n\n  /**\n   * Capture a wizard-specific event. Automatically prepends \"wizard: \" to the event name.\n   * All new wizard analytics should use this method instead of capture() directly.\n   */\n  wizardCapture(eventName: string, properties?: Record<string, unknown>): void {\n    this.capture(`wizard: ${eventName}`, properties);\n  }\n\n  /**\n   * Flush pending events without firing the \"setup wizard finished\" terminal\n   * event. Use this from CLI error paths that exit before any wizard run\n   * starts — `shutdown()` would inflate the run count with a \"finished\" event\n   * for a parse error that never actually ran the wizard.\n   */\n  async flush(): Promise<void> {\n    await this.client.shutdown();\n  }\n\n  /**\n   * Evaluate all feature flags for the current user at the start of a run.\n   * Result is cached; subsequent calls in the same run return the same map.\n   * Returns flag key -> string value (booleans become 'true'/'false').\n   */\n  // Only a getFlag read records an exposure; the bulk response records none.\n  async getAllFlagsForWizard(): Promise<Record<string, string>> {\n    if (this.activeFlags !== null) {\n      return this.activeFlags;\n    }\n    const out: Record<string, string> = {};\n    const payloads: Record<string, unknown> = {};\n    try {\n      const distinctId = this.distinctId ?? this.anonymousId;\n      logToFile('[flags] evaluating as', {\n        distinctId,\n        identified: this.distinctId !== undefined,\n        personProperties: this.flagPersonProperties(),\n      });\n      const evaluation = await this.client.evaluateFlags(distinctId, {\n        personProperties: this.flagPersonProperties(),\n      });\n      for (const key of WIZARD_FLAG_KEYS) {\n        const value = evaluation.getFlag(key);\n        if (value === undefined) continue;\n        out[key] = String(value);\n        const payload = evaluation.getFlagPayload(key);\n        if (payload !== undefined) payloads[key] = payload;\n      }\n    } catch (error) {\n      debug('Failed to get all feature flags:', error);\n      this.captureException(\n        error instanceof Error ? error : new Error(String(error)),\n        { step: 'get_all_flags' },\n      );\n    }\n    // Outside the fetch guard on purpose: a malformed CI override must fail\n    // the run loudly, and a valid one applies even when the fetch failed —\n    // CI routing stays deterministic either way.\n    const merged = applyCiFlagOverrides(out, payloads);\n    this.activeFlags = merged.flags;\n    this.activeFlagPayloads = merged.payloads;\n    logToFile('[flags] evaluated', this.activeFlags);\n    return this.activeFlags;\n  }\n\n  /** Flag payloads from the same snapshot; empty until the flags are fetched. */\n  getWizardFlagPayloads(): Record<string, unknown> {\n    return this.activeFlagPayloads;\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (Object.keys(this.tags).length === 0) {\n      return;\n    }\n\n    // First status wins. The interrupt fallback in start-tui fires\n    // shutdown('cancelled') on every TUI teardown; without this guard a run\n    // that already reported 'success' would emit a second, contradicting\n    // terminal event when the user dismisses the outro.\n    if (this.terminalEventSent) {\n      return;\n    }\n    this.terminalEventSent = true;\n\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: 'setup wizard finished',\n      properties: {\n        // Flat for filtering; the nested `tags` snapshot stays for back-compat.\n        ...this.tags,\n        run_id: this._runId,\n        ...(this.sessionId ? { $session_id: this.sessionId } : {}),\n        status,\n        tags: this.tags,\n      },\n    });\n\n    await this.client.shutdown();\n  }\n}\n\nexport const analytics = new Analytics();\n"],"mappings":";;;;;AAkBA,SAAgB,qBACd,OACA,WAAoC,EAAE,EACgC;AAI3B,QAAO;EAAE;EAAO;EAAU;;;;;;;;;AAuCvE,SAAgB,sBAAyC;AACZ,QAAO,EAAE;;;;;;;;;ACzCtD,SAAS,uBAA+D;CACtE,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE;AASlC,QAAO;EAAE,SARO,KAAK,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC,IAAI;EAQtC,WAPJ,CACZ,GAAG,IAAI,IACL,KACG,QAAQ,MAAM,EAAE,WAAW,KAAK,CAAC,CACjC,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,CACxC,CACF,CAAC,MAAM,CAC2B,KAAK,IAAI;EAAE;;;;;;AAOhD,SAAgB,kBACd,SACyB;CAKzB,MAAM,qBAAqB,6BAA6B,QAAQ;CAChE,MAAM,qBAAqB,6BAA6B,QAAQ;AAEhE,QAAO;EACL,aAAa,QAAQ;EAGrB,UAAU,QAAQ;EAClB,oBAAoB,QAAQ;EAC5B,YAAY,QAAQ;EACpB,YAAY,QAAQ,aAAa;EACjC,GAAI,uBAAuB,KAAA,IACvB,EAAE,qBAAqB,oBAAoB,GAC3C,EAAE;EACN,cAAc,QAAQ;EACtB,qBAAqB,QAAQ;EAC7B,WAAW,QAAQ;EACnB,GAAI,uBAAuB,KAAA,IACvB,EAAE,sBAAsB,oBAAoB,GAC5C,EAAE;EACP;;AAGH,SAAgB,eACd,MACA,MACwB;CACxB,MAAM,SAAiC,EAAE,UAAU,MAAM;AACzD,KAAI,CAAC,KAAM,QAAO;CAElB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,KAAI,eAAgB,QAAO,eAAe;CAE1C,MAAM,aAAa,KAAK,cAAc;AACtC,KAAI,WAAY,QAAO,WAAW;CAElC,MAAM,cAAc,KAAK,MAAM;AAC/B,KAAI,YAAa,QAAO,UAAU;AAElC,QAAO;;AAGT,MAAM,eAAoC,IAAI,IAAI,iBAAiB;AAGnE,SAAS,kBAAkB,OAAiC;AAC1D,KAAI,UAAU,OAAQ,QAAO;AAC7B,KAAI,UAAU,QAAS,QAAO;AAC9B,QAAO;;AAGT,IAAa,YAAb,MAAuB;CACrB;CACA,OACE,EAAE;CACJ;CACA;CACA;CACA,YAAmC;CACnC,UAAkB;CAClB,cAAqD;CACrD,qBAAsD,EAAE;CACxD,SAAyC,EAAE;CAC3C,mBAAmD,EAAE;CACrD,oBAA4B;CAE5B,cAAc;AACZ,OAAK,SAAS,IAAI,QAAQ,4CAA4C;GACpE,MAAM;GACN,SAAS;GACT,eAAe;GACf,4BAA4B;GAC5B,cAAc,UAAU;AACtB,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,OAAO,KAAK,KAAK,OAAO,CAAC,SAAS,EACpC,OAAM,SAAS;KAAE,GAAG,KAAK;KAAQ,GAAG,MAAM;KAAQ;AAKpD,QAAI,MAAM,UAAU,cAAc;AAChC,WAAM,aAAa,KAAK,cAAc,KAAK;KAC3C,MAAM,EAAE,yBAAyB,GAAG,eAClC,MAAM,cAAc,EAAE;AAExB,WAAM,aAAa;MAAE,GAAG,KAAK;MAAM,GAAG;MAAY;;AAGpD,QAAI,MAAM,UAAU,uBAClB,OAAM,aAAa;KAAE,GAAG,KAAK;KAAM,GAAI,MAAM,cAAc,EAAE;KAAG;AAElE,WAAO;;GAEV,CAAC;AAEF,OAAK,OAAO,EAAE,WAAW,KAAK,SAAS;AAMvC,OAAK,KAAK,QAA8B;AAExC,OAAK,KAAK,cAAc;AAKxB,OAAK,KAAK,UAAU;AAMpB,MAAI,YAAa,MAAK,KAAK,cAAc;AACzC,MAAI,QAAS,MAAK,KAAK,UAAU;AAEjC,OAAK,cAAcA,IAAQ;AAS3B,OAAK,SAASA,IAAQ;AACtB,OAAK,KAAK,SAAS,KAAK;AAExB,OAAK,aAAa,KAAA;;;CAIpB,IAAI,QAAgB;AAClB,SAAO,KAAK;;;CAId,IAAI,QAAgB;AAClB,SAAO,OAAO,KAAK,KAAK,SAAS,MAAM;;;;;;;;;;CAWzC,aAAa,MAAe;EAC1B,MAAM,aAAa,KAAK;AACxB,MAAI,KAAK,eAAe,cAAc,eAAe,KAAK,YACxD;AAEF,OAAK,aAAa;AAMlB,MAAI,CAAC,KAAK,WAAW;AACnB,QAAK,YAAYA,IAAQ;AACzB,QAAK,KAAK,cAAc,KAAK;;EAE/B,MAAM,QAAgC,EAAE;AACxC,MAAI,KAAK,MAAO,OAAM,QAAQ,KAAK;EACnC,MAAM,OAAO,CAAC,KAAK,YAAY,KAAK,UAAU,CAC3C,OAAO,QAAQ,CACf,KAAK,IAAI,CACT,MAAM;AACT,MAAI,KAAM,OAAM,OAAO;AACvB,OAAK,mBAAmB;AACxB,OAAK,OAAO,SAAS;GAAE;GAAY,YAAY,EAAE,MAAM,OAAO;GAAE,CAAC;AACjE,OAAK,OAAO,MAAM;GAChB;GACA,OAAO,KAAK;GACb,CAAC;AAIF,OAAK,cAAc;AACnB,OAAK,qBAAqB,EAAE;;;CAI9B,uBAAuD;AAOrD,SAAO;GACL,WAAW,KAAK;GAChB,SAAS;GACT,aAAa;GACb,OAAO,OAAO,KAAK,KAAK,SAAS,MAAM;GACvC,IAAI,QAAQ;GACZ,YAAY,QAAQ,SAAS,KAAK,MAAM,IAAI,CAAC;GAC7C,GAAG,sBAAsB;GACzB,GAAG,KAAK;GACT;;CAGH,OAAO,KAAa,OAAqD;AACvE,OAAK,KAAK,OAAO;;CAGnB,UAAU,QAAgC;AACxC,OAAK,SAAS;;CAGhB,iBAAiB,OAAc,aAAsC,EAAE,EAAE;AACvE,OAAK,OAAO,iBAAiB,OAAO,KAAK,cAAc,KAAK,aAAa;GACvE,MAAM;GACN,GAAG,KAAK;GACR,GAAG;GACJ,CAAC;;CAGJ,QAAQ,WAAmB,YAAsC;AAC/D,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IACV,GAAG,KAAK;IACR,GAAG,KAAK,6BAA6B;IACrC,GAAG;IACJ;GACF,CAAC;;CAGJ,cACE,WACA,UACA,YACA;AACA,OAAK,OAAO,cAAc;GAAE;GAAW;GAAU;GAAY,CAAC;;CAIhE,8BAA+D;AAC7D,MAAI,KAAK,gBAAgB,KAAM,QAAO,EAAE;EACxC,MAAM,QAAiC,EAAE;EACzC,MAAM,SAAmB,EAAE;AAC3B,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,YAAY,EAAE;AAC3D,OAAI,CAAC,aAAa,IAAI,IAAI,CAAE;GAC5B,MAAM,WAAW,kBAAkB,MAAM;AACzC,SAAM,YAAY,SAAS;AAC3B,OAAI,aAAa,MAAO,QAAO,KAAK,IAAI;;AAE1C,MAAI,OAAO,SAAS,EAAG,OAAM,wBAAwB,OAAO,MAAM;AAClE,SAAO;;;;;;CAOT,cAAc,WAAmB,YAA4C;AAC3E,OAAK,QAAQ,WAAW,aAAa,WAAW;;;;;;;;CASlD,MAAM,QAAuB;AAC3B,QAAM,KAAK,OAAO,UAAU;;;;;;;CAS9B,MAAM,uBAAwD;AAC5D,MAAI,KAAK,gBAAgB,KACvB,QAAO,KAAK;EAEd,MAAM,MAA8B,EAAE;EACtC,MAAM,WAAoC,EAAE;AAC5C,MAAI;GACF,MAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,aAAU,yBAAyB;IACjC;IACA,YAAY,KAAK,eAAe,KAAA;IAChC,kBAAkB,KAAK,sBAAsB;IAC9C,CAAC;GACF,MAAM,aAAa,MAAM,KAAK,OAAO,cAAc,YAAY,EAC7D,kBAAkB,KAAK,sBAAsB,EAC9C,CAAC;AACF,QAAK,MAAM,OAAO,kBAAkB;IAClC,MAAM,QAAQ,WAAW,QAAQ,IAAI;AACrC,QAAI,UAAU,KAAA,EAAW;AACzB,QAAI,OAAO,OAAO,MAAM;IACxB,MAAM,UAAU,WAAW,eAAe,IAAI;AAC9C,QAAI,YAAY,KAAA,EAAW,UAAS,OAAO;;WAEtC,OAAO;AACd,SAAM,oCAAoC,MAAM;AAChD,QAAK,iBACH,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD,EAAE,MAAM,iBAAiB,CAC1B;;EAKH,MAAM,SAAS,qBAAqB,KAAK,SAAS;AAClD,OAAK,cAAc,OAAO;AAC1B,OAAK,qBAAqB,OAAO;AACjC,YAAU,qBAAqB,KAAK,YAAY;AAChD,SAAO,KAAK;;;CAId,wBAAiD;AAC/C,SAAO,KAAK;;CAGd,MAAM,SAAS,QAA2C;AACxD,MAAI,OAAO,KAAK,KAAK,KAAK,CAAC,WAAW,EACpC;AAOF,MAAI,KAAK,kBACP;AAEF,OAAK,oBAAoB;AAEzB,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IAEV,GAAG,KAAK;IACR,QAAQ,KAAK;IACb,GAAI,KAAK,YAAY,EAAE,aAAa,KAAK,WAAW,GAAG,EAAE;IACzD;IACA,MAAM,KAAK;IACZ;GACF,CAAC;AAEF,QAAM,KAAK,OAAO,UAAU;;;AAIhC,MAAa,YAAY,IAAI,WAAW"}

package/dist/{api-CwNulLDK.js → api-Ci0dZWLR.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";
-import { ft as WIZARD_USER_AGENT } from "./debug-DUmMVUHn.js";
-import { n as analytics } from "./analytics-DSK0GXg1.js";
+import { pt as WIZARD_USER_AGENT } from "./debug-DWYDVp0B.js";
+import { n as analytics } from "./analytics-DSVyjIVF.js";
 import axios from "axios";
 import { z } from "zod";
 //#region src/lib/api.ts
@@ -189,4 +189,4 @@ function handleApiError(error, operation) {
 //#endregion
 export { fetchSlackConnected as a, fetchProjectData as i, api_exports as n, fetchUserData as o, fetchGithubConnected as r, handleApiError as s, ApiError as t };
 
-//# sourceMappingURL=api-CwNulLDK.js.map
+//# sourceMappingURL=api-Ci0dZWLR.js.map

package/dist/{api-CwNulLDK.js.map → api-Ci0dZWLR.js.map}

@@ -1 +1 @@
-{"version":3,"file":"api-CwNulLDK.js","names":[],"sources":["../src/lib/api.ts"],"sourcesContent":["import axios, { AxiosError } from 'axios';\nimport { z } from 'zod';\nimport { analytics } from '@utils/analytics';\nimport { WIZARD_USER_AGENT } from './constants';\n\n/**\n * User payload from `/api/users/@me/`. Schema typed for the fields the\n * wizard actually reads + passthrough on everything else so the full\n * upstream response rides through to the session for downstream features\n * (account-aware copy, plan-gated flows, org/team metadata, etc.).\n *\n * Top-level uses `.passthrough()` so unknown fields aren't stripped;\n * the few nested objects we care about (team, organization,\n * organizations[]) do the same so their additional fields survive too.\n *\n * Keep `distinct_id` required — analytics depends on it. Everything\n * else added here is nullish so partial responses don't fail parsing.\n */\nexport const ApiUserSchema = z\n  .object({\n    // Identifiers\n    distinct_id: z.string(),\n    uuid: z.string().nullish(),\n    id: z.number().nullish(),\n\n    // Profile\n    email: z.string().nullish(),\n    first_name: z.string().nullish(),\n    last_name: z.string().nullish(),\n    date_joined: z.string().nullish(),\n    is_email_verified: z.boolean().nullish(),\n    is_2fa_enabled: z.boolean().nullish(),\n    is_staff: z.boolean().nullish(),\n\n    // Preferences\n    theme_mode: z.string().nullish(),\n    toolbar_mode: z.string().nullish(),\n    hide_mcp_hints: z.boolean().nullish(),\n\n    // Optional / nullable on the backend — pre-onboarding signup paths\n    // return null and older accounts may not have it set. Treat as a\n    // hint, never a guarantee.\n    role_at_organization: z.string().nullish(),\n\n    // Current team + organization (objects from the API, kept typed on\n    // the fields the wizard uses; passthrough preserves the rest).\n    team: z\n      .object({\n        id: z.number(),\n        uuid: z.string().nullish(),\n        organization: z.string().uuid(),\n        api_token: z.string().nullish(),\n        project_id: z.number().nullish(),\n        name: z.string().nullish(),\n        timezone: z.string().nullish(),\n      })\n      .passthrough(),\n    organization: z\n      .object({\n        id: z.string().uuid(),\n        name: z.string().nullish(),\n        slug: z.string().nullish(),\n        membership_level: z.number().nullish(),\n        customer_id: z.string().nullish(),\n        // Org-level AI consent gate. Signals drops all findings while\n        // this is not true. Null on older orgs (pre-2026-05 default\n        // flip) — treat null as \"unknown\", not \"off\".\n        is_ai_data_processing_approved: z.boolean().nullish(),\n      })\n      .passthrough(),\n    organizations: z.array(\n      z\n        .object({\n          id: z.string().uuid(),\n          name: z.string().nullish(),\n          membership_level: z.number().nullish(),\n        })\n        .passthrough(),\n    ),\n  })\n  .passthrough();\n\n/**\n * Single activity log entry the wizard cares about. The PostHog endpoint\n * returns much more — schema kept minimal so changes upstream don't break us.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling. Deliberately retained: this is a thin,\n * well-typed wrapper around a stable PostHog endpoint, and we're likely\n * to want it again for a future feature (e.g. \"what changed in your\n * project recently\"). Re-deriving the schema is more work than letting\n * it sit dormant.\n */\nexport const ActivityLogEntrySchema = z\n  .object({\n    scope: z.string().nullish(),\n    activity: z.string().nullish(),\n    created_at: z.string().nullish(),\n  })\n  .passthrough();\n\n/** @unused — see ActivityLogEntrySchema. */\nexport const ActivityLogResponseSchema = z.object({\n  results: z.array(ActivityLogEntrySchema),\n});\n\n/** @unused — see ActivityLogEntrySchema. */\nexport type ActivityLogEntry = z.infer<typeof ActivityLogEntrySchema>;\n\nexport const ApiProjectSchema = z.object({\n  id: z.number(),\n  uuid: z.string().uuid(),\n  organization: z.string().uuid(),\n  api_token: z.string(),\n  name: z.string(),\n  // Product opt-ins (TeamSerializer-compat fields on /api/projects/:id).\n  // Project-level truth for \"is this product enabled\" — a product can be\n  // instrumented from another repo or the snippet, so these settings\n  // override repo-local evidence. Null/absent = unknown. Only the\n  // opt-ins a signals decision consumes: replay + exception autocapture\n  // feed signal-source choices; surveys feeds the surveys-scout tuning.\n  session_recording_opt_in: z.boolean().nullish(),\n  autocapture_exceptions_opt_in: z.boolean().nullish(),\n  surveys_opt_in: z.boolean().nullish(),\n});\n\nexport type ApiUser = z.infer<typeof ApiUserSchema>;\nexport type ApiProject = z.infer<typeof ApiProjectSchema>;\n\nexport class ApiError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode?: number,\n    public readonly endpoint?: string,\n  ) {\n    super(message);\n    this.name = 'ApiError';\n  }\n}\n\nexport async function fetchUserData(\n  accessToken: string,\n  baseUrl: string,\n): Promise<ApiUser> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/users/@me/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiUserSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch user data');\n    analytics.captureException(apiError, {\n      endpoint: '/api/users/@me/',\n      baseUrl,\n    });\n    throw apiError;\n  }\n}\n\n/**\n * Best-effort fetch of recent activity log entries. Returns [] on any error\n * so callers can treat absence of results as \"haven't detected anything yet\"\n * rather than a hard failure.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling from McpSuggestedPromptsScreen.\n * Deliberately retained for future features that want a soft signal of\n * recent project changes (e.g. dashboards, audit summaries). See the\n * ActivityLogEntrySchema doc comment for the keep-vs-delete rationale.\n */\nexport async function fetchRecentActivity(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  since: Date,\n): Promise<ActivityLogEntry[]> {\n  try {\n    const response = await axios.get(\n      `${baseUrl}/api/projects/${projectId}/activity_log/`,\n      {\n        params: { limit: 10 },\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          'User-Agent': WIZARD_USER_AGENT,\n        },\n        // Short timeout — best-effort probe, not a critical path.\n        timeout: 4000,\n      },\n    );\n    const parsed = ActivityLogResponseSchema.safeParse(response.data);\n    if (!parsed.success) return [];\n    const sinceMs = since.getTime();\n    return parsed.data.results.filter((entry) => {\n      if (!entry.created_at) return false;\n      const t = Date.parse(entry.created_at);\n      return Number.isFinite(t) && t >= sinceMs;\n    });\n  } catch {\n    return [];\n  }\n}\n\nexport async function fetchProjectData(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n): Promise<ApiProject> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/projects/${projectId}/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiProjectSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch project data');\n    analytics.captureException(apiError, {\n      endpoint: `/api/projects/${projectId}/`,\n      baseUrl,\n      projectId,\n    });\n    throw apiError;\n  }\n}\n\n/** Minimal shape of `/api/projects/:id/integrations/` — we only read `kind`. */\nconst IntegrationsResponseSchema = z.object({\n  results: z.array(z.object({ kind: z.string().nullish() }).passthrough()),\n});\n\n/**\n * Check whether the project already has a Slack integration connected.\n * Requires the `integration:read` scope. Throws on failure — callers\n * (including the SlackConnectScreen poll) decide how to degrade and\n * are responsible for capturing the error exactly once.\n */\nexport async function fetchSlackConnected(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  signal?: AbortSignal,\n): Promise<boolean> {\n  const response = await axios.get(\n    `${baseUrl}/api/projects/${projectId}/integrations/`,\n    {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      signal,\n    },\n  );\n  const parsed = IntegrationsResponseSchema.safeParse(response.data);\n  if (!parsed.success) return false;\n  return parsed.data.results.some((i) => i.kind === 'slack');\n}\n\n/**\n * Check whether the project already has a GitHub App integration connected.\n * Requires the `integration:read` scope. Throws on failure — callers (the\n * SelfDrivingGitHubScreen poll) decide how to degrade and are responsible for\n * capturing the error exactly once.\n */\nexport async function fetchGithubConnected(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  signal?: AbortSignal,\n): Promise<boolean> {\n  const response = await axios.get(\n    `${baseUrl}/api/projects/${projectId}/integrations/`,\n    {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      signal,\n    },\n  );\n  const parsed = IntegrationsResponseSchema.safeParse(response.data);\n  if (!parsed.success) return false;\n  return parsed.data.results.some((i) => i.kind === 'github');\n}\n\nexport function handleApiError(error: unknown, operation: string): ApiError {\n  if (axios.isAxiosError(error)) {\n    const axiosError = error as AxiosError<{ detail?: string }>;\n    const status = axiosError.response?.status;\n    const detail = axiosError.response?.data?.detail;\n    const endpoint = axiosError.config?.url;\n\n    if (status === 401) {\n      return new ApiError(\n        `Authentication failed while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 403) {\n      return new ApiError(\n        `Access denied while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 404) {\n      return new ApiError(\n        `Resource not found while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    const message = detail || `Failed to ${operation}`;\n    return new ApiError(message, status, endpoint);\n  }\n\n  if (error instanceof z.ZodError) {\n    return new ApiError(`Invalid response format while trying to ${operation}`);\n  }\n\n  return new ApiError(\n    `Unexpected error while trying to ${operation}: ${\n      error instanceof Error ? error.message : 'Unknown error'\n    }`,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,gBAAgB,EAC1B,OAAO;CAEN,aAAa,EAAE,QAAQ;CACvB,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,IAAI,EAAE,QAAQ,CAAC,SAAS;CAGxB,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,mBAAmB,EAAE,SAAS,CAAC,SAAS;CACxC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACrC,UAAU,EAAE,SAAS,CAAC,SAAS;CAG/B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CAKrC,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAI1C,MAAM,EACH,OAAO;EACN,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM;EAC/B,WAAW,EAAE,QAAQ,CAAC,SAAS;EAC/B,YAAY,EAAE,QAAQ,CAAC,SAAS;EAChC,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,UAAU,EAAE,QAAQ,CAAC,SAAS;EAC/B,CAAC,CACD,aAAa;CAChB,cAAc,EACX,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACtC,aAAa,EAAE,QAAQ,CAAC,SAAS;EAIjC,gCAAgC,EAAE,SAAS,CAAC,SAAS;EACtD,CAAC,CACD,aAAa;CAChB,eAAe,EAAE,MACf,EACG,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACvC,CAAC,CACD,aAAa,CACjB;CACF,CAAC,CACD,aAAa;;;;;;;;;;;;AAahB,MAAa,yBAAyB,EACnC,OAAO;CACN,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,YAAY,EAAE,QAAQ,CAAC,SAAS;CACjC,CAAC,CACD,aAAa;AAGyB,EAAE,OAAO,EAChD,SAAS,EAAE,MAAM,uBAAuB,EACzC,CAAC;AAKF,MAAa,mBAAmB,EAAE,OAAO;CACvC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ,CAAC,MAAM;CACvB,cAAc,EAAE,QAAQ,CAAC,MAAM;CAC/B,WAAW,EAAE,QAAQ;CACrB,MAAM,EAAE,QAAQ;CAOhB,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,+BAA+B,EAAE,SAAS,CAAC,SAAS;CACpD,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACtC,CAAC;AAKF,IAAa,WAAb,cAA8B,MAAM;CAClC,YACE,SACA,YACA,UACA;AACA,QAAM,QAAQ;AAHE,OAAA,aAAA;AACA,OAAA,WAAA;AAGhB,OAAK,OAAO;;;AAIhB,eAAsB,cACpB,aACA,SACkB;AAClB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,kBAAkB,EAC5D,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,cAAc,MAAM,SAAS,KAAK;UAClC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,kBAAkB;AACzD,YAAU,iBAAiB,UAAU;GACnC,UAAU;GACV;GACD,CAAC;AACF,QAAM;;;AA+CV,eAAsB,iBACpB,aACA,WACA,SACqB;AACrB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,gBAAgB,UAAU,IAAI,EACxE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,iBAAiB,MAAM,SAAS,KAAK;UACrC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,qBAAqB;AAC5D,YAAU,iBAAiB,UAAU;GACnC,UAAU,iBAAiB,UAAU;GACrC;GACA;GACD,CAAC;AACF,QAAM;;;;AAKV,MAAM,6BAA6B,EAAE,OAAO,EAC1C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,EACzE,CAAC;;;;;;;AAQF,eAAsB,oBACpB,aACA,WACA,SACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,IAC3B,GAAG,QAAQ,gBAAgB,UAAU,iBACrC;EACE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf;EACD;EACD,CACF;CACD,MAAM,SAAS,2BAA2B,UAAU,SAAS,KAAK;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,QAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,QAAQ;;;;;;;;AAS5D,eAAsB,qBACpB,aACA,WACA,SACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,IAC3B,GAAG,QAAQ,gBAAgB,UAAU,iBACrC;EACE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf;EACD;EACD,CACF;CACD,MAAM,SAAS,2BAA2B,UAAU,SAAS,KAAK;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,QAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,SAAS;;AAG7D,SAAgB,eAAe,OAAgB,WAA6B;AAC1E,KAAI,MAAM,aAAa,MAAM,EAAE;EAC7B,MAAM,aAAa;EACnB,MAAM,SAAS,WAAW,UAAU;EACpC,MAAM,SAAS,WAAW,UAAU,MAAM;EAC1C,MAAM,WAAW,WAAW,QAAQ;AAEpC,MAAI,WAAW,IACb,QAAO,IAAI,SACT,yCAAyC,aACzC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,iCAAiC,aACjC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,sCAAsC,aACtC,QACA,SACD;AAIH,SAAO,IAAI,SADK,UAAU,aAAa,aACV,QAAQ,SAAS;;AAGhD,KAAI,iBAAiB,EAAE,SACrB,QAAO,IAAI,SAAS,2CAA2C,YAAY;AAG7E,QAAO,IAAI,SACT,oCAAoC,UAAU,IAC5C,iBAAiB,QAAQ,MAAM,UAAU,kBAE5C"}
+{"version":3,"file":"api-Ci0dZWLR.js","names":[],"sources":["../src/lib/api.ts"],"sourcesContent":["import axios, { AxiosError } from 'axios';\nimport { z } from 'zod';\nimport { analytics } from '@utils/analytics';\nimport { WIZARD_USER_AGENT } from './constants';\n\n/**\n * User payload from `/api/users/@me/`. Schema typed for the fields the\n * wizard actually reads + passthrough on everything else so the full\n * upstream response rides through to the session for downstream features\n * (account-aware copy, plan-gated flows, org/team metadata, etc.).\n *\n * Top-level uses `.passthrough()` so unknown fields aren't stripped;\n * the few nested objects we care about (team, organization,\n * organizations[]) do the same so their additional fields survive too.\n *\n * Keep `distinct_id` required — analytics depends on it. Everything\n * else added here is nullish so partial responses don't fail parsing.\n */\nexport const ApiUserSchema = z\n  .object({\n    // Identifiers\n    distinct_id: z.string(),\n    uuid: z.string().nullish(),\n    id: z.number().nullish(),\n\n    // Profile\n    email: z.string().nullish(),\n    first_name: z.string().nullish(),\n    last_name: z.string().nullish(),\n    date_joined: z.string().nullish(),\n    is_email_verified: z.boolean().nullish(),\n    is_2fa_enabled: z.boolean().nullish(),\n    is_staff: z.boolean().nullish(),\n\n    // Preferences\n    theme_mode: z.string().nullish(),\n    toolbar_mode: z.string().nullish(),\n    hide_mcp_hints: z.boolean().nullish(),\n\n    // Optional / nullable on the backend — pre-onboarding signup paths\n    // return null and older accounts may not have it set. Treat as a\n    // hint, never a guarantee.\n    role_at_organization: z.string().nullish(),\n\n    // Current team + organization (objects from the API, kept typed on\n    // the fields the wizard uses; passthrough preserves the rest).\n    team: z\n      .object({\n        id: z.number(),\n        uuid: z.string().nullish(),\n        organization: z.string().uuid(),\n        api_token: z.string().nullish(),\n        project_id: z.number().nullish(),\n        name: z.string().nullish(),\n        timezone: z.string().nullish(),\n      })\n      .passthrough(),\n    organization: z\n      .object({\n        id: z.string().uuid(),\n        name: z.string().nullish(),\n        slug: z.string().nullish(),\n        membership_level: z.number().nullish(),\n        customer_id: z.string().nullish(),\n        // Org-level AI consent gate. Signals drops all findings while\n        // this is not true. Null on older orgs (pre-2026-05 default\n        // flip) — treat null as \"unknown\", not \"off\".\n        is_ai_data_processing_approved: z.boolean().nullish(),\n      })\n      .passthrough(),\n    organizations: z.array(\n      z\n        .object({\n          id: z.string().uuid(),\n          name: z.string().nullish(),\n          membership_level: z.number().nullish(),\n        })\n        .passthrough(),\n    ),\n  })\n  .passthrough();\n\n/**\n * Single activity log entry the wizard cares about. The PostHog endpoint\n * returns much more — schema kept minimal so changes upstream don't break us.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling. Deliberately retained: this is a thin,\n * well-typed wrapper around a stable PostHog endpoint, and we're likely\n * to want it again for a future feature (e.g. \"what changed in your\n * project recently\"). Re-deriving the schema is more work than letting\n * it sit dormant.\n */\nexport const ActivityLogEntrySchema = z\n  .object({\n    scope: z.string().nullish(),\n    activity: z.string().nullish(),\n    created_at: z.string().nullish(),\n  })\n  .passthrough();\n\n/** @unused — see ActivityLogEntrySchema. */\nexport const ActivityLogResponseSchema = z.object({\n  results: z.array(ActivityLogEntrySchema),\n});\n\n/** @unused — see ActivityLogEntrySchema. */\nexport type ActivityLogEntry = z.infer<typeof ActivityLogEntrySchema>;\n\nexport const ApiProjectSchema = z.object({\n  id: z.number(),\n  uuid: z.string().uuid(),\n  organization: z.string().uuid(),\n  api_token: z.string(),\n  name: z.string(),\n  // Product opt-ins (TeamSerializer-compat fields on /api/projects/:id).\n  // Project-level truth for \"is this product enabled\" — a product can be\n  // instrumented from another repo or the snippet, so these settings\n  // override repo-local evidence. Null/absent = unknown. Only the\n  // opt-ins a signals decision consumes: replay + exception autocapture\n  // feed signal-source choices; surveys feeds the surveys-scout tuning.\n  session_recording_opt_in: z.boolean().nullish(),\n  autocapture_exceptions_opt_in: z.boolean().nullish(),\n  surveys_opt_in: z.boolean().nullish(),\n});\n\nexport type ApiUser = z.infer<typeof ApiUserSchema>;\nexport type ApiProject = z.infer<typeof ApiProjectSchema>;\n\nexport class ApiError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode?: number,\n    public readonly endpoint?: string,\n  ) {\n    super(message);\n    this.name = 'ApiError';\n  }\n}\n\nexport async function fetchUserData(\n  accessToken: string,\n  baseUrl: string,\n): Promise<ApiUser> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/users/@me/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiUserSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch user data');\n    analytics.captureException(apiError, {\n      endpoint: '/api/users/@me/',\n      baseUrl,\n    });\n    throw apiError;\n  }\n}\n\n/**\n * Best-effort fetch of recent activity log entries. Returns [] on any error\n * so callers can treat absence of results as \"haven't detected anything yet\"\n * rather than a hard failure.\n *\n * @unused — no current caller after the Phase 6 streaming-agent pivot\n * dropped activity_log polling from McpSuggestedPromptsScreen.\n * Deliberately retained for future features that want a soft signal of\n * recent project changes (e.g. dashboards, audit summaries). See the\n * ActivityLogEntrySchema doc comment for the keep-vs-delete rationale.\n */\nexport async function fetchRecentActivity(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  since: Date,\n): Promise<ActivityLogEntry[]> {\n  try {\n    const response = await axios.get(\n      `${baseUrl}/api/projects/${projectId}/activity_log/`,\n      {\n        params: { limit: 10 },\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          'User-Agent': WIZARD_USER_AGENT,\n        },\n        // Short timeout — best-effort probe, not a critical path.\n        timeout: 4000,\n      },\n    );\n    const parsed = ActivityLogResponseSchema.safeParse(response.data);\n    if (!parsed.success) return [];\n    const sinceMs = since.getTime();\n    return parsed.data.results.filter((entry) => {\n      if (!entry.created_at) return false;\n      const t = Date.parse(entry.created_at);\n      return Number.isFinite(t) && t >= sinceMs;\n    });\n  } catch {\n    return [];\n  }\n}\n\nexport async function fetchProjectData(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n): Promise<ApiProject> {\n  try {\n    const response = await axios.get(`${baseUrl}/api/projects/${projectId}/`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n    });\n\n    return ApiProjectSchema.parse(response.data);\n  } catch (error) {\n    const apiError = handleApiError(error, 'fetch project data');\n    analytics.captureException(apiError, {\n      endpoint: `/api/projects/${projectId}/`,\n      baseUrl,\n      projectId,\n    });\n    throw apiError;\n  }\n}\n\n/** Minimal shape of `/api/projects/:id/integrations/` — we only read `kind`. */\nconst IntegrationsResponseSchema = z.object({\n  results: z.array(z.object({ kind: z.string().nullish() }).passthrough()),\n});\n\n/**\n * Check whether the project already has a Slack integration connected.\n * Requires the `integration:read` scope. Throws on failure — callers\n * (including the SlackConnectScreen poll) decide how to degrade and\n * are responsible for capturing the error exactly once.\n */\nexport async function fetchSlackConnected(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  signal?: AbortSignal,\n): Promise<boolean> {\n  const response = await axios.get(\n    `${baseUrl}/api/projects/${projectId}/integrations/`,\n    {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      signal,\n    },\n  );\n  const parsed = IntegrationsResponseSchema.safeParse(response.data);\n  if (!parsed.success) return false;\n  return parsed.data.results.some((i) => i.kind === 'slack');\n}\n\n/**\n * Check whether the project already has a GitHub App integration connected.\n * Requires the `integration:read` scope. Throws on failure — callers (the\n * SelfDrivingGitHubScreen poll) decide how to degrade and are responsible for\n * capturing the error exactly once.\n */\nexport async function fetchGithubConnected(\n  accessToken: string,\n  projectId: number,\n  baseUrl: string,\n  signal?: AbortSignal,\n): Promise<boolean> {\n  const response = await axios.get(\n    `${baseUrl}/api/projects/${projectId}/integrations/`,\n    {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        'User-Agent': WIZARD_USER_AGENT,\n      },\n      signal,\n    },\n  );\n  const parsed = IntegrationsResponseSchema.safeParse(response.data);\n  if (!parsed.success) return false;\n  return parsed.data.results.some((i) => i.kind === 'github');\n}\n\nexport function handleApiError(error: unknown, operation: string): ApiError {\n  if (axios.isAxiosError(error)) {\n    const axiosError = error as AxiosError<{ detail?: string }>;\n    const status = axiosError.response?.status;\n    const detail = axiosError.response?.data?.detail;\n    const endpoint = axiosError.config?.url;\n\n    if (status === 401) {\n      return new ApiError(\n        `Authentication failed while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 403) {\n      return new ApiError(\n        `Access denied while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    if (status === 404) {\n      return new ApiError(\n        `Resource not found while trying to ${operation}`,\n        status,\n        endpoint,\n      );\n    }\n\n    const message = detail || `Failed to ${operation}`;\n    return new ApiError(message, status, endpoint);\n  }\n\n  if (error instanceof z.ZodError) {\n    return new ApiError(`Invalid response format while trying to ${operation}`);\n  }\n\n  return new ApiError(\n    `Unexpected error while trying to ${operation}: ${\n      error instanceof Error ? error.message : 'Unknown error'\n    }`,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,gBAAgB,EAC1B,OAAO;CAEN,aAAa,EAAE,QAAQ;CACvB,MAAM,EAAE,QAAQ,CAAC,SAAS;CAC1B,IAAI,EAAE,QAAQ,CAAC,SAAS;CAGxB,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,WAAW,EAAE,QAAQ,CAAC,SAAS;CAC/B,aAAa,EAAE,QAAQ,CAAC,SAAS;CACjC,mBAAmB,EAAE,SAAS,CAAC,SAAS;CACxC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACrC,UAAU,EAAE,SAAS,CAAC,SAAS;CAG/B,YAAY,EAAE,QAAQ,CAAC,SAAS;CAChC,cAAc,EAAE,QAAQ,CAAC,SAAS;CAClC,gBAAgB,EAAE,SAAS,CAAC,SAAS;CAKrC,sBAAsB,EAAE,QAAQ,CAAC,SAAS;CAI1C,MAAM,EACH,OAAO;EACN,IAAI,EAAE,QAAQ;EACd,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM;EAC/B,WAAW,EAAE,QAAQ,CAAC,SAAS;EAC/B,YAAY,EAAE,QAAQ,CAAC,SAAS;EAChC,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,UAAU,EAAE,QAAQ,CAAC,SAAS;EAC/B,CAAC,CACD,aAAa;CAChB,cAAc,EACX,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACtC,aAAa,EAAE,QAAQ,CAAC,SAAS;EAIjC,gCAAgC,EAAE,SAAS,CAAC,SAAS;EACtD,CAAC,CACD,aAAa;CAChB,eAAe,EAAE,MACf,EACG,OAAO;EACN,IAAI,EAAE,QAAQ,CAAC,MAAM;EACrB,MAAM,EAAE,QAAQ,CAAC,SAAS;EAC1B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;EACvC,CAAC,CACD,aAAa,CACjB;CACF,CAAC,CACD,aAAa;;;;;;;;;;;;AAahB,MAAa,yBAAyB,EACnC,OAAO;CACN,OAAO,EAAE,QAAQ,CAAC,SAAS;CAC3B,UAAU,EAAE,QAAQ,CAAC,SAAS;CAC9B,YAAY,EAAE,QAAQ,CAAC,SAAS;CACjC,CAAC,CACD,aAAa;AAGyB,EAAE,OAAO,EAChD,SAAS,EAAE,MAAM,uBAAuB,EACzC,CAAC;AAKF,MAAa,mBAAmB,EAAE,OAAO;CACvC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,QAAQ,CAAC,MAAM;CACvB,cAAc,EAAE,QAAQ,CAAC,MAAM;CAC/B,WAAW,EAAE,QAAQ;CACrB,MAAM,EAAE,QAAQ;CAOhB,0BAA0B,EAAE,SAAS,CAAC,SAAS;CAC/C,+BAA+B,EAAE,SAAS,CAAC,SAAS;CACpD,gBAAgB,EAAE,SAAS,CAAC,SAAS;CACtC,CAAC;AAKF,IAAa,WAAb,cAA8B,MAAM;CAClC,YACE,SACA,YACA,UACA;AACA,QAAM,QAAQ;AAHE,OAAA,aAAA;AACA,OAAA,WAAA;AAGhB,OAAK,OAAO;;;AAIhB,eAAsB,cACpB,aACA,SACkB;AAClB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,kBAAkB,EAC5D,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,cAAc,MAAM,SAAS,KAAK;UAClC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,kBAAkB;AACzD,YAAU,iBAAiB,UAAU;GACnC,UAAU;GACV;GACD,CAAC;AACF,QAAM;;;AA+CV,eAAsB,iBACpB,aACA,WACA,SACqB;AACrB,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,IAAI,GAAG,QAAQ,gBAAgB,UAAU,IAAI,EACxE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf,EACF,CAAC;AAEF,SAAO,iBAAiB,MAAM,SAAS,KAAK;UACrC,OAAO;EACd,MAAM,WAAW,eAAe,OAAO,qBAAqB;AAC5D,YAAU,iBAAiB,UAAU;GACnC,UAAU,iBAAiB,UAAU;GACrC;GACA;GACD,CAAC;AACF,QAAM;;;;AAKV,MAAM,6BAA6B,EAAE,OAAO,EAC1C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,EACzE,CAAC;;;;;;;AAQF,eAAsB,oBACpB,aACA,WACA,SACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,IAC3B,GAAG,QAAQ,gBAAgB,UAAU,iBACrC;EACE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf;EACD;EACD,CACF;CACD,MAAM,SAAS,2BAA2B,UAAU,SAAS,KAAK;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,QAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,QAAQ;;;;;;;;AAS5D,eAAsB,qBACpB,aACA,WACA,SACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,IAC3B,GAAG,QAAQ,gBAAgB,UAAU,iBACrC;EACE,SAAS;GACP,eAAe,UAAU;GACzB,cAAc;GACf;EACD;EACD,CACF;CACD,MAAM,SAAS,2BAA2B,UAAU,SAAS,KAAK;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,QAAO,OAAO,KAAK,QAAQ,MAAM,MAAM,EAAE,SAAS,SAAS;;AAG7D,SAAgB,eAAe,OAAgB,WAA6B;AAC1E,KAAI,MAAM,aAAa,MAAM,EAAE;EAC7B,MAAM,aAAa;EACnB,MAAM,SAAS,WAAW,UAAU;EACpC,MAAM,SAAS,WAAW,UAAU,MAAM;EAC1C,MAAM,WAAW,WAAW,QAAQ;AAEpC,MAAI,WAAW,IACb,QAAO,IAAI,SACT,yCAAyC,aACzC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,iCAAiC,aACjC,QACA,SACD;AAGH,MAAI,WAAW,IACb,QAAO,IAAI,SACT,sCAAsC,aACtC,QACA,SACD;AAIH,SAAO,IAAI,SADK,UAAU,aAAa,aACV,QAAQ,SAAS;;AAGhD,KAAI,iBAAiB,EAAE,SACrB,QAAO,IAAI,SAAS,2CAA2C,YAAY;AAG7E,QAAO,IAAI,SACT,oCAAoC,UAAU,IAC5C,iBAAiB,QAAQ,MAAM,UAAU,kBAE5C"}

package/dist/bin.js

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
 import { d as ErrorCodes, i as detectErrorCode, t as classifyRunFailure, u as emitWizardError } from "./errors--OqLxmWR.js";
-import { Ct as regionOption, G as POSTHOG_DOCS_URL, St as isHeadless, a as getLogFilePath, f as getUI, ht as VERSION, m as LoggingUI, p as setUI, pt as getSkillsBaseUrl, s as logToFile, xt as headlessOption } from "./debug-DUmMVUHn.js";
+import { Ct as isHeadless, K as POSTHOG_DOCS_URL, St as headlessOption, a as getLogFilePath, gt as VERSION, h as LoggingUI, m as setUI, mt as getSkillsBaseUrl, p as getUI, s as logToFile, wt as regionOption } from "./debug-DWYDVp0B.js";
 import { a as getLocalDev, i as checkLocalServices, o as initLocalDev, r as POSTHOG_LOCAL_URL, s as localMcpSkillsNotice } from "./local-dev-DPZiIPCK.js";
 import "./wizard-session-FSJCkTcP.js";
-import { n as analytics } from "./analytics-DSK0GXg1.js";
-import { r as setEntryCommand } from "./telemetry-QpeVhVtU.js";
-import { r as runCleanups } from "./wizard-abort-B0c5VDie.js";
-import { n as isNonInteractiveEnvironment } from "./environment-DC4RDnzR.js";
-import { L as fetchSkillMenu, u as recoverOrphanedSettingsBackups } from "./agent-interface-BKLTDSyN.js";
-import { c as maybeStampAiSdkDetected, n as runAgent, x as authenticate } from "./agent-runner-BkQontri.js";
-import { $ as wordWrap, A as installOrUpdatePostHogCli, B as webAnalyticsDoctorConfig, D as CLI_STEERING_TARGETS, E as errorTrackingUploadSourceMapsConfig, G as createSkillProgram, H as getKindMeta, K as warehouseSourceConfig, O as detectTargets, S as errorTrackingConfig, T as replayVisionConfig, U as fetchHealthIssues, V as posthogDoctorConfig, W as auditConfig, d as metricsConfig, f as aiObservabilityConfig, i as isRunFailure, it as Icons, j as installSteeringSnippet, k as findTarget, m as selfDrivingConfig, o as Program, p as mcpAnalyticsConfig, q as revenueAnalyticsConfig, rt as Colors, s as agentSkillConfig, u as getProgramConfig, z as migrationConfig } from "./mint-failure-CQqypC_v.js";
-import { n as readApiKeyFromEnv } from "./env-api-key-CGC1Bqwq.js";
+import { n as analytics } from "./analytics-DSVyjIVF.js";
+import { r as setEntryCommand } from "./telemetry-PD7bhcda.js";
+import { r as runCleanups } from "./wizard-abort-hqHF-9xD.js";
+import { n as isNonInteractiveEnvironment } from "./environment-1wA7uwAS.js";
+import { G as fetchSkillMenu, R as WIZARD_TOOL_NAMES, u as recoverOrphanedSettingsBackups } from "./agent-interface-DPaPdIjS.js";
+import { c as maybeStampAiSdkDetected, n as runAgent, x as authenticate } from "./agent-runner-JFwQQj2k.js";
+import { g as AUDIT_CHECKS_FILE, x as getAuditChecks } from "./yara-hooks-BaPKsm-B.js";
+import { $ as wordWrap, A as installOrUpdatePostHogCli, B as webAnalyticsDoctorConfig, D as CLI_STEERING_TARGETS, E as errorTrackingUploadSourceMapsConfig, G as createSkillProgram, H as getKindMeta, K as warehouseSourceConfig, O as detectTargets, S as errorTrackingConfig, T as replayVisionConfig, U as fetchHealthIssues, V as posthogDoctorConfig, W as auditConfig, d as metricsConfig, f as aiObservabilityConfig, i as isRunFailure, it as Icons, j as installSteeringSnippet, k as findTarget, m as selfDrivingConfig, o as Program, p as mcpAnalyticsConfig, q as revenueAnalyticsConfig, rt as Colors, s as agentSkillConfig, u as getProgramConfig, z as migrationConfig } from "./mint-failure-C82j0RMC.js";
+import { n as readApiKeyFromEnv } from "./env-api-key-DwmkB3fm.js";
 import { satisfies } from "semver";
 import { Agent, setGlobalDispatcher } from "undici";
 import yargs from "yargs";
@@ -229,7 +230,7 @@ function runProvision(argv) {
 }
 async function provision({ email, region, name, baseUrl, jsonMode }) {
 	try {
-		const { provisionNewAccount } = await import("./provisioning-B74q1uSQ.js").then((n) => n.r);
+		const { provisionNewAccount } = await import("./provisioning-B-tzjG4r.js").then((n) => n.r);
 		if (!jsonMode) getUI().log.info(`Provisioning account for ${email} in ${region}...`);
 		emitResult(await provisionNewAccount(email, name, region, { baseUrl }), jsonMode);
 		process.exit(0);
@@ -296,22 +297,22 @@ const basicIntegrationCommand = {
 		setEntryCommand("integrate");
 		(async () => {
 			if (isHeadless(argv)) {
-				const { runHeadlessInstall } = await import("./ci-install-CQLi_a-r.js");
+				const { runHeadlessInstall } = await import("./ci-install-CEVCqahf.js");
 				return runHeadlessInstall(argv);
 			}
 			if (argv.ci) {
-				const { runCIInstall } = await import("./ci-install-CQLi_a-r.js");
+				const { runCIInstall } = await import("./ci-install-CEVCqahf.js");
 				return runCIInstall(argv);
 			}
 			if (isNonInteractiveEnvironment()) {
-				const { failNonInteractive } = await import("./non-interactive-D5-lCBy6.js");
+				const { failNonInteractive } = await import("./non-interactive-DGT2H_n4.js");
 				return failNonInteractive();
 			}
 			if (argv.playground) {
-				const { runPlayground } = await import("./playground-Djabnagq.js");
+				const { runPlayground } = await import("./playground-UFSHP-Yn.js");
 				return runPlayground();
 			}
-			const { runInteractive } = await import("./interactive-5O4XQf59.js");
+			const { runInteractive } = await import("./interactive-B6OlvhSf.js");
 			runInteractive(argv);
 		})();
 	}
@@ -353,7 +354,7 @@ const mcpAddCommand = {
 function runMcpAdd(argv) {
 	const features = parseFeatures(argv.features);
 	(async () => {
-		const { readApiKeyFromEnv } = await import("./env-api-key-CGC1Bqwq.js").then((n) => n.t);
+		const { readApiKeyFromEnv } = await import("./env-api-key-DwmkB3fm.js").then((n) => n.t);
 		const apiKey = argv.apiKey || readApiKeyFromEnv();
 		const debug = argv.debug;
 		const localMcp = argv.local;
@@ -367,7 +368,7 @@ function runMcpAdd(argv) {
 			return;
 		}
 		try {
-			const { startTUI } = await import("./start-tui-BXjJGNx2.js");
+			const { startTUI } = await import("./start-tui-BowrTPXm.js");
 			const { buildSession } = await import("./wizard-session-CYvyYnti.js");
 			const tui = startTUI(VERSION, Program.McpAdd);
 			tui.store.session = buildSession({
@@ -385,7 +386,7 @@ function runMcpAdd(argv) {
 }
 async function runHeadlessAdd(args) {
 	setUI(new LoggingUI());
-	const { addMCPServerToClientsStep } = await import("./add-mcp-server-to-clients-CjfnPMbO.js").then((n) => n.r);
+	const { addMCPServerToClientsStep } = await import("./add-mcp-server-to-clients-4yHaRvOo.js").then((n) => n.r);
 	const { installed, failed } = await addMCPServerToClientsStep(args);
 	if (failed.length > 0 || installed.length === 0) process.exitCode = 1;
 }
@@ -417,7 +418,7 @@ function runMcpRemove(argv) {
 			return;
 		}
 		try {
-			const { startTUI } = await import("./start-tui-BXjJGNx2.js");
+			const { startTUI } = await import("./start-tui-BowrTPXm.js");
 			const { buildSession } = await import("./wizard-session-CYvyYnti.js");
 			const tui = startTUI(VERSION, Program.McpRemove);
 			tui.store.session = buildSession({
@@ -434,7 +435,7 @@ function runMcpRemove(argv) {
 /** No exit code on an empty result: nothing to remove is the requested end state. */
 async function runHeadlessRemove(local) {
 	setUI(new LoggingUI());
-	const { removeMCPServerFromClientsStep } = await import("./add-mcp-server-to-clients-CjfnPMbO.js").then((n) => n.r);
+	const { removeMCPServerFromClientsStep } = await import("./add-mcp-server-to-clients-4yHaRvOo.js").then((n) => n.r);
 	await removeMCPServerFromClientsStep({ local });
 }
 //#endregion
@@ -454,7 +455,7 @@ function runMcpTutorial(argv) {
 		const debug = argv.debug;
 		const localMcp = argv.local;
 		try {
-			const { startTUI } = await import("./start-tui-BXjJGNx2.js");
+			const { startTUI } = await import("./start-tui-BowrTPXm.js");
 			const { buildSession } = await import("./wizard-session-CYvyYnti.js");
 			const tui = startTUI(VERSION, Program.McpTutorial);
 			tui.store.session = buildSession({
@@ -542,17 +543,18 @@ function runWizard(config, options) {
 	(async () => {
 		try {
 			const installDir = options.installDir || process.cwd();
-			const { startTUI } = await import("./start-tui-BXjJGNx2.js");
+			const { startTUI } = await import("./start-tui-BowrTPXm.js");
 			const { buildSession, RunPhase } = await import("./wizard-session-CYvyYnti.js");
-			const { TaskStreamPush } = await import("./task-stream-h-b1nWdM.js");
-			const { PostHogDestination } = await import("./posthog-C3Sncfan.js");
+			const { TaskStreamPush } = await import("./task-stream-C9BLiAhz.js");
+			const { PostHogDestination } = await import("./posthog-O9kKcnda.js");
+			const { createFileDestination } = await import("./file-C3HGL1IM.js");
 			const local = getLocalDev();
 			const localServicesError = await checkLocalServices({
 				...local,
 				localPosthog: local.localPosthog && !options.baseUrl
 			});
 			if (localServicesError) {
-				const { wizardAbort } = await import("./wizard-abort-C9Jbm-m7.js");
+				const { wizardAbort } = await import("./wizard-abort-D3YA1hXX.js");
 				await wizardAbort({ message: localServicesError });
 				return;
 			}
@@ -612,15 +614,18 @@ function runWizard(config, options) {
 				if (active === config.id) break;
 				config = getProgramConfig(active);
 			}
-			const taskStreamEnabled = !session.noTelemetry;
+			const fileDestination = createFileDestination(options.taskStreamLog);
+			const destinations = [...session.noTelemetry ? [] : [new PostHogDestination({
+				getCredentials: () => activeTui.store.session.credentials,
+				onError: (err) => logToFile("[task-stream-push]", err.message)
+			})], ...fileDestination ? [fileDestination] : []];
+			const taskStreamEnabled = destinations.length > 0;
 			const activeStream = new TaskStreamPush({
 				store: activeTui.store,
-				programId: config.id,
-				destinations: [new PostHogDestination({
-					getCredentials: () => activeTui.store.session.credentials,
-					onError: (err) => logToFile("[task-stream-push]", err.message)
-				})],
+				programId: config.streamWorkflowId ?? config.id,
+				destinations,
 				eventPlanPath: config.eventPlanFile ? join(session.installDir, config.eventPlanFile) : void 0,
+				auditChecks: config.auditLedgerFile ? () => getAuditChecks(activeTui.store.session) : void 0,
 				enabled: taskStreamEnabled
 			});
 			taskStream = activeStream;
@@ -634,7 +639,7 @@ function runWizard(config, options) {
 				if (shown(step)) await advanceStep(step, activeTui.store, config);
 			}
 			else if (skipAgent) {
-				const { getOrAskForProjectData } = await import("./setup-utils-C3tsa6D6.js").then((n) => n.r);
+				const { getOrAskForProjectData } = await import("./setup-utils-Bj0gejEf.js").then((n) => n.r);
 				const { projectApiKey, host, accessToken, projectId } = await getOrAskForProjectData({
 					signup: session.signup,
 					ci: session.ci,
@@ -757,10 +762,10 @@ function runNonInteractive(config, options, mode) {
 	(async () => {
 		const path = await import("path");
 		const { buildSession, RunPhase, OutroKind } = await import("./wizard-session-CYvyYnti.js");
-		const { readEnvironment } = await import("./environment-DC4RDnzR.js").then((n) => n.t);
-		const { readApiKeyFromEnv } = await import("./env-api-key-CGC1Bqwq.js").then((n) => n.t);
-		const { configureLogFileFromEnvironment, logToFile } = await import("./debug-CBmI5YUF.js");
-		const { wizardAbort, WizardError } = await import("./wizard-abort-C9Jbm-m7.js");
+		const { readEnvironment } = await import("./environment-1wA7uwAS.js").then((n) => n.t);
+		const { readApiKeyFromEnv } = await import("./env-api-key-DwmkB3fm.js").then((n) => n.t);
+		const { configureLogFileFromEnvironment, logToFile } = await import("./debug-C6KWXbQi.js");
+		const { wizardAbort, WizardError } = await import("./wizard-abort-D3YA1hXX.js");
 		configureLogFileFromEnvironment();
 		const env = readEnvironment();
 		const apiKey = options.apiKey ?? readApiKeyFromEnv() ?? void 0;
@@ -806,25 +811,31 @@ function runNonInteractive(config, options, mode) {
 		}
 		let store = null;
 		let taskStream = null;
-		if (mode === "headless") {
-			const { WizardStore } = await import("./store-DN_6FaoQ.js").then((n) => n.n);
-			const { HeadlessUI } = await import("./headless-ui-CQ46FOTh.js");
-			const { TaskStreamPush, PostHogDestination } = await import("./task-stream-h-b1nWdM.js");
-			store = new WizardStore(config.id);
-			store.session = session;
-			setUI(new HeadlessUI(store));
+		{
+			const { WizardStore } = await import("./store-CVkJKlny.js").then((n) => n.n);
+			const { HeadlessUI } = await import("./headless-ui-DRGWDg9Z.js");
+			const { TaskStreamPush, PostHogDestination, createFileDestination } = await import("./task-stream-C9BLiAhz.js");
+			const fileDestination = createFileDestination(mode === "ci" ? options.taskStreamLog ?? "" : options.taskStreamLog);
+			const posthogDestination = mode === "headless" && !session.noTelemetry ? new PostHogDestination({
+				getCredentials: () => session.credentials,
+				onError: (e) => logToFile("[headless task-stream]", e.message)
+			}) : null;
+			const destinations = [...posthogDestination ? [posthogDestination] : [], ...fileDestination ? [fileDestination] : []];
+			const headlessStore = new WizardStore(config.id);
+			store = headlessStore;
+			headlessStore.session = session;
+			setUI(new HeadlessUI(headlessStore));
 			taskStream = new TaskStreamPush({
-				store,
-				programId: config.id,
-				destinations: [new PostHogDestination({
-					getCredentials: () => session.credentials,
-					onError: (e) => logToFile("[headless task-stream]", e.message)
-				})],
+				store: headlessStore,
+				programId: config.streamWorkflowId ?? config.id,
+				destinations,
 				eventPlanPath: config.eventPlanFile ? join(session.installDir, config.eventPlanFile) : void 0,
-				enabled: !session.noTelemetry
+				auditChecks: config.auditLedgerFile ? () => getAuditChecks(headlessStore.session) : void 0,
+				enabled: destinations.length > 0
 			});
 			taskStream.attach();
-			store.setRunPhase(RunPhase.Running);
+			headlessStore.setRunPhase(RunPhase.Running);
+			if (fileDestination) logToFile(`[task-stream] ${mode} dump: ${fileDestination.path}`);
 		}
 		const settleStream = async (phase, outroData) => {
 			if (!store || !taskStream) return;
@@ -834,7 +845,7 @@ function runNonInteractive(config, options, mode) {
 		};
 		try {
 			if (mode === "ci") {
-				const { configureGatewayFromCIEnvironment } = await import("./gateway-session-zwwZAyTt.js");
+				const { configureGatewayFromCIEnvironment } = await import("./gateway-session-s1xr8b48.js");
 				configureGatewayFromCIEnvironment(Number(session.projectId), session.region ?? "us");
 			}
 			if (config.ciPreRun) await config.ciPreRun(session);
@@ -899,7 +910,7 @@ function runNonInteractive(config, options, mode) {
 					});
 				}
 			}
-			const { runAgent } = await import("./agent-runner-BkQontri.js").then((n) => n.t);
+			const { runAgent } = await import("./agent-runner-JFwQQj2k.js").then((n) => n.t);
 			await runAgent(config, session);
 			await settleStream(RunPhase.Completed);
 		} catch (error) {
@@ -1130,12 +1141,25 @@ const NATIVE_HANDLERS = { audit: { "web-analytics": webAnalyticsDoctorConfig } }
 * `skillId` injected. The comprehensive `audit all` is the one exception —
 * skillId 'audit' triggers the specialized auditConfig (custom hooks,
 * content blocks, screens).
+*
+* This is the one place that knows a subcommand belongs to `audit`, so the
+* generic skill program picks up the ledger here rather than for every skill.
 */
-function configForCliEntry(entry) {
+function configForCliEntry(entry, family) {
 	if (entry.skillId === "audit") return auditConfig;
 	return {
 		...agentSkillConfig,
-		skillId: entry.skillId
+		skillId: entry.skillId,
+		...family === "audit" ? {
+			auditLedgerFile: AUDIT_CHECKS_FILE,
+			streamWorkflowId: family,
+			allowedTools: [
+				...agentSkillConfig.allowedTools ?? [],
+				WIZARD_TOOL_NAMES.auditSeedChecks,
+				WIZARD_TOOL_NAMES.auditAddChecks,
+				WIZARD_TOOL_NAMES.auditResolveChecks
+			]
+		} : {}
 	};
 }
 function familyEntries(family, entries) {
@@ -1167,7 +1191,7 @@ async function dispatchFamily(family, argv) {
 	const entries = menu.cliEntries ?? [];
 	const entry = familyEntries(family, entries).find((e) => e.command === sub);
 	if (entry) {
-		dispatchProgram(configForCliEntry(entry), argv);
+		dispatchProgram(configForCliEntry(entry, family), argv);
 		return;
 	}
 	const available = [...Object.keys(NATIVE_HANDLERS[family] ?? {}), ...familyEntries(family, entries).map((e) => e.command)].sort();
@@ -2150,7 +2174,7 @@ async function runDoctorCI(options) {
 	getUI().intro("Welcome to the PostHog setup wizard");
 	getUI().log.info("Running posthog-doctor in CI mode");
 	try {
-		const { getOrAskForProjectData } = await import("./setup-utils-C3tsa6D6.js").then((n) => n.r);
+		const { getOrAskForProjectData } = await import("./setup-utils-Bj0gejEf.js").then((n) => n.r);
 		const { host, accessToken, projectId } = await getOrAskForProjectData({
 			signup: false,
 			ci: true,
@@ -2168,7 +2192,7 @@ async function runDoctorCI(options) {
 		for (const issue of sorted) getUI().log.info(`  • [${issue.severity}] ${getKindMeta(issue.kind).title}`);
 		process.exit(1);
 	} catch (error) {
-		const { ApiError } = await import("./api-CwNulLDK.js").then((n) => n.n);
+		const { ApiError } = await import("./api-Ci0dZWLR.js").then((n) => n.n);
 		const message = error instanceof ApiError && error.statusCode === 401 ? "Your PostHog API key is invalid or expired." : error instanceof Error ? error.message : String(error);
 		getUI().log.error(`Doctor failed: ${message}`);
 		emitWizardError({
@@ -2254,7 +2278,7 @@ function runSlackConnect(argv) {
 	(async () => {
 		const debug = argv.debug;
 		try {
-			const { startTUI } = await import("./start-tui-BXjJGNx2.js");
+			const { startTUI } = await import("./start-tui-BowrTPXm.js");
 			const { buildSession } = await import("./wizard-session-CYvyYnti.js");
 			const tui = startTUI(VERSION, Program.SlackConnect);
 			tui.store.session = buildSession({