@posthog/wizard 2.79.1 → 2.80.1

package/dist/setup-utils-B26Lf2yF.js

@@ -1,1512 +0,0 @@
-import { s as logToFile } from "./debug-kAHwWGg7.js";
-import { n as MCP_LOCAL_URL } from "./local-dev-McsurOC-.js";
-import { B as WIZARD_CONTACT_EMAIL, C as ISSUES_URL, E as OAUTH_TIMEOUT_MS, J as WIZARD_PROVISIONING_SCOPES, N as POSTHOG_PROXY_CLIENT_ID, O as POSTHOG_DEV_CLIENT_ID, P as POSTHOG_STATUS_PAGE_URL, Q as WIZARD_USER_AGENT, T as OAUTH_PORTS, W as WIZARD_OAUTH_SCOPES, d as DUMMY_PROJECT_API_KEY } from "./constants-DHCBSfnx.js";
-import "./wizard-session-2w4Ru-Wz.js";
-import { n as analytics } from "./analytics-DXK1gc12.js";
-import { i as withUtm, n as openTrackedLink, t as withProgress } from "./telemetry-B7zJdRmA.js";
-import { r as readFileHead } from "./bounded-fs-vAq-T-K7.js";
-import { t as getUI } from "./ui-Q6-RvERF.js";
-import { a as getCloudUrl, c as getOAuthUrl, i as detectRegion, l as getUiHostFromHost, n as provisionNewAccount, o as getHost, t as ProvisionedAccountUnreadableError, u as resolveBaseUrl } from "./provisioning-Bo2NRxFz.js";
-import { c as fetchUserData, o as fetchProjectData } from "./api-CrbCIQOz.js";
-import { i as wizardAbort } from "./wizard-abort-BPdv07np.js";
-import { major, minVersion } from "semver";
-import * as fs$2 from "fs";
-import * as path$2 from "path";
-import { basename, join as join$1 } from "node:path";
-import * as childProcess from "node:child_process";
-import { execSync } from "node:child_process";
-import * as fs$1 from "node:fs";
-import axios from "axios";
-import * as crypto from "node:crypto";
-import * as http from "node:http";
-import { z } from "zod";
-//#region src/shared/utils/package-manager.ts
-function hasLockfile(installDir, file) {
-	return fs$2.existsSync(path$2.join(installDir, file));
-}
-function lockfileHeaderContains(installDir, file, needle) {
-	return readFileHead(path$2.join(installDir, file), 500)?.includes(needle) ?? false;
-}
-async function writeOverride(slot, pkgName, pkgVersion, { installDir }) {
-	const pkg = await getPackageDotJson({ installDir });
-	let next;
-	if (slot === "yarn") next = {
-		...pkg,
-		resolutions: {
-			...pkg.resolutions ?? {},
-			[pkgName]: pkgVersion
-		}
-	};
-	else if (slot === "pnpm") next = {
-		...pkg,
-		pnpm: {
-			...pkg.pnpm ?? {},
-			overrides: {
-				...pkg.pnpm?.overrides ?? {},
-				[pkgName]: pkgVersion
-			}
-		}
-	};
-	else next = {
-		...pkg,
-		overrides: {
-			...pkg.overrides ?? {},
-			[pkgName]: pkgVersion
-		}
-	};
-	await updatePackageDotJson(next, { installDir });
-}
-const packageManagers = [
-	{
-		name: "bun",
-		label: "Bun",
-		installCommand: "bun add",
-		buildCommand: "bun run build",
-		runScriptCommand: "bun run",
-		flags: "",
-		detect: ({ installDir }) => hasLockfile(installDir, "bun.lockb") || hasLockfile(installDir, "bun.lock"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "yarn",
-		label: "Yarn V1",
-		installCommand: "yarn add",
-		buildCommand: "yarn build",
-		runScriptCommand: "yarn",
-		flags: "--ignore-workspace-root-check",
-		detect: ({ installDir }) => lockfileHeaderContains(installDir, "yarn.lock", "yarn lockfile v1"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("yarn", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "yarn",
-		label: "Yarn V2/3/4",
-		installCommand: "yarn add",
-		buildCommand: "yarn build",
-		runScriptCommand: "yarn",
-		flags: "",
-		detect: ({ installDir }) => lockfileHeaderContains(installDir, "yarn.lock", "__metadata"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("yarn", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "pnpm",
-		label: "pnpm",
-		installCommand: "pnpm add",
-		buildCommand: "pnpm build",
-		runScriptCommand: "pnpm",
-		flags: "--ignore-workspace-root-check",
-		detect: ({ installDir }) => hasLockfile(installDir, "pnpm-lock.yaml"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("pnpm", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "npm",
-		label: "npm",
-		installCommand: "npm add",
-		buildCommand: "npm run build",
-		runScriptCommand: "npm run",
-		flags: "",
-		detect: ({ installDir }) => hasLockfile(installDir, "package-lock.json"),
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
-	},
-	{
-		name: "expo",
-		label: "Expo",
-		installCommand: "npx expo install",
-		buildCommand: "npx expo build",
-		runScriptCommand: "npx expo run",
-		flags: "",
-		detect: () => false,
-		addOverride: (pkgName, pkgVersion, opts) => writeOverride("npm", pkgName, pkgVersion, opts)
-	}
-];
-function detectAllPackageManagers({ installDir }) {
-	return withProgress("detect-package-manager", () => {
-		const matches = packageManagers.filter((pm) => pm.detect({ installDir }));
-		if (matches.length === 0) analytics.setTag("package-manager", "not-detected");
-		return matches;
-	});
-}
-function serializeNodePM(pm) {
-	return {
-		name: pm.name,
-		label: pm.label,
-		installCommand: pm.installCommand,
-		runCommand: pm.runScriptCommand
-	};
-}
-/**
-* Detect Node.js package managers via lockfiles.
-* Wraps detectAllPackageManagers() above.
-*/
-function detectNodePackageManagers(installDir) {
-	const detected = detectAllPackageManagers({ installDir }).map(serializeNodePM);
-	if (detected.length === 0) return Promise.resolve({
-		detected: [],
-		primary: null,
-		recommendation: "No lockfile found. Default to npm (npm add, npm run)."
-	});
-	const primary = detected[0];
-	return Promise.resolve({
-		detected,
-		primary,
-		recommendation: detected.length === 1 ? `Use ${primary.label} (${primary.installCommand}).` : `Multiple package managers detected. Prefer ${primary.label} (${primary.installCommand}).`
-	});
-}
-//#endregion
-//#region src/programs/oauth/program-scopes.ts
-/**
-* Extra scopes the MCP tutorial needs on top of `WIZARD_OAUTH_SCOPES`.
-*
-* Every scope requested here must stay within the wizard OAuth app's
-* ceiling on the PostHog side (`OAuthApplication.scopes`) — the full
-* list lives in the README under "OAuth app scope ceiling". The
-* tutorial's prompts and follow-ups touch most of the read surface,
-* plus annotation write for the "PostHog wizard install" verify-prompt.
-*
-* Already in the base `WIZARD_OAUTH_SCOPES` (and therefore not
-* repeated here):
-*   • user:read, project:read, llm_gateway:read   — auth + gateway
-*   • query:read                                  — HogQL
-*   • dashboard:write, insight:write, notebook:write  — Phase-5 persist
-*
-* Deliberately omitted (writes on read-only product surfaces):
-*   • feature_flag:write, experiment:write, survey:write,
-*     cohort:write, session_recording:write, error_tracking:write,
-*     alert:write, subscription:write
-*/
-const MCP_TUTORIAL_SCOPE_ADDITIONS = [
-	"dashboard:read",
-	"insight:read",
-	"notebook:read",
-	"feature_flag:read",
-	"experiment:read",
-	"experiment_saved_metric:read",
-	"survey:read",
-	"session_recording:read",
-	"error_tracking:read",
-	"web_analytics:read",
-	"llm_analytics:read",
-	"cohort:read",
-	"person:read",
-	"annotation:read",
-	"annotation:write",
-	"activity_log:read",
-	"property_definition:read",
-	"event_definition:read",
-	"action:read",
-	"warehouse_table:read",
-	"warehouse_view:read",
-	"alert:read",
-	"subscription:read",
-	"integration:read"
-];
-/**
-* Extra scopes the agent-skill program needs on top of `WIZARD_OAUTH_SCOPES`.
-*
-* Skills under this program (e.g. `creating-product-tours`) create feature
-* flags during the install flow. PostHog's consent grants exactly the scope
-* strings requested — `:write` does not imply `:read` — so listing existing
-* flags to avoid key collisions needs `feature_flag:read` explicitly.
-* `property_definition:read` lets the agent discover person properties when
-* building flag rollout filters instead of having to ask the user verbatim.
-*/
-const AGENT_SKILL_SCOPE_ADDITIONS = [
-	"feature_flag:read",
-	"feature_flag:write",
-	"property_definition:read"
-];
-/**
-* Extra scopes the self-driving program needs on top of
-* `WIZARD_OAUTH_SCOPES`. All consumed by the PostHog MCP tools the
-* agent drives during the run:
-*   • task:read / task:write — the signal source config API
-*     (`inbox-source-configs-*`) is permissioned under the generic
-*     `task` scope object, NOT a signals-specific one. Unrelated to
-*     the Tasks product.
-*   • integration:read — `integrations-list`, to check whether the
-*     team already has a GitHub integration and to verify the connect
-*     flow completed.
-*   • signal_scout:read / signal_scout:write — list, sync, and tune
-*     the Signals scout troop (`signals-scout-config-*`).
-*   • session_recording:read / survey:read / error_tracking:read —
-*     server-side product-usage probes (`query-session-recordings-list`,
-*     `survey-list`, `error-issue-list`). Product usage is a
-*     project-level fact (often instrumented in another repo or via
-*     the snippet), so the agent asks the server instead of inferring
-*     only from the local setup report. All three are read-only and
-*     already in the wizard OAuth app's production scope ceiling (the
-*     mcp-tutorial program requests them).
-*   • external_data_source:read / external_data_source:write — the
-*     connected-tools step creates the GitHub Issues / Linear warehouse
-*     sources directly (`external-data-sources-create`) and verifies
-*     what's actually connected (`external-data-sources-list`) instead
-*     of taking the user's word for it.
-*   • llm_skill:read / llm_skill:write — the custom-scouts step
-*     (skill step 6b): read the seeded `authoring-signals-scouts`
-*     guide and canonical scout bodies (`llma-skill-get` /
-*     `llma-skill-file-get`) and author the user-approved custom
-*     `signals-scout-*` skills (`llma-skill-create`). Canonical scout
-*     bodies are never edited.
-*   • product_enablement:write — the "Enable products" step turns on
-*     Session Replay / Error Tracking / Support so their sources have
-*     data to read (`products-enable`). A purpose-built scope: the
-*     server owns each enable recipe, so this can flip the product
-*     toggles without the far broader `project:write`.
-*   • replay_scanner:read / replay_scanner:write — the Replay Vision
-*     scanners step (skill step 6c) lists the team's existing scanners
-*     and creates the `emits_signals` ones whose findings land in the
-*     inbox (`vision-scanners-list` / `-create` / `-update`, and the
-*     advisory `vision-scanners-estimate-create` / `vision-quota-retrieve`).
-*     The scope OBJECT is `replay_scanner` — the `vision-scanners-*`
-*     names are MCP tool names, not scopes. Configuring a scanner also
-*     requires `session_recording:read` (the API pairs the two, since a
-*     scanner's config indirectly exposes recording contents); that one
-*     is already in this list for the step-2 usage probes.
-*
-* No OAuth-ceiling edit is needed for any scope here: they are all normal
-* public (unprivileged, non-internal, non-hidden) scope objects, and the
-* live wizard apps' ceiling is the `@default` sentinel, which resolves to
-* every such scope (`UNPRIVILEGED_SCOPES`) and auto-tracks new ones. Only a
-* privileged/internal/hidden object (e.g. `llm_gateway:*`) would need a
-* manual per-app edit. See README → "OAuth app scope ceiling".
-*/
-const SELF_DRIVING_SCOPE_ADDITIONS = [
-	"task:read",
-	"task:write",
-	"integration:read",
-	"signal_scout:read",
-	"signal_scout:write",
-	"session_recording:read",
-	"survey:read",
-	"error_tracking:read",
-	"external_data_source:read",
-	"external_data_source:write",
-	"llm_skill:read",
-	"llm_skill:write",
-	"product_enablement:write",
-	"replay_scanner:read",
-	"replay_scanner:write"
-];
-/**
-* Extra scopes the warehouse-source program needs on top of
-* `WIZARD_OAUTH_SCOPES`. The agent creates data warehouse sources directly
-* (`external-data-sources-create`) and lists what's connected
-* (`external-data-sources-list`) to verify the result. Both are already within
-* the wizard OAuth app's scope ceiling — the self-driving program requests the
-* same pair.
-*/
-const WAREHOUSE_SOURCE_SCOPE_ADDITIONS = ["external_data_source:read", "external_data_source:write"];
-/**
-* Extra scope the Connect-Slack step needs on top of `WIZARD_OAUTH_SCOPES`.
-*
-* The step polls `/api/projects/:id/integrations/` (`fetchSlackConnected`)
-* to render the already-connected variant and to flip live once the user
-* completes the Slack OAuth step in the browser. Without `integration:read`
-* the first poll 403s, the screen stops polling, and an already-connected
-* project is nagged with the connect nudge. Used by the default integration
-* run (the step ends the run) and by the standalone `wizard slack` flow
-* (the step is the whole program).
-*/
-const CONNECT_SLACK_SCOPE_ADDITIONS = ["integration:read"];
-/**
-* Extra scopes the replay-vision program needs on top of `WIZARD_OAUTH_SCOPES`.
-* The same set self-driving's step 6c uses, narrowed to just this flow:
-*   • replay_scanner:read / replay_scanner:write — the scanner tasks list the
-*     team's existing scanners and create the ones scoped to the product's key
-*     flows (`vision-scanners-list` / `-create`, plus the advisory
-*     `vision-scanners-estimate-create` / `vision-quota-retrieve`). The scope
-*     OBJECT is `replay_scanner`; `vision-scanners-*` are MCP tool names.
-*   • session_recording:read — the scanner API pairs it with
-*     `replay_scanner:*`, since a scanner's config indirectly exposes
-*     recording contents. Configuring a scanner fails without it.
-*   • product_enablement:write — the enable-replay task's server half turns on
-*     Session Replay (`products-enable`) so there are recordings to scan.
-*
-* Without these the PostHog MCP omits the tools from the catalog it serves
-* this token, every scanner task takes its "tool unknown" skip path, and the
-* run reports success having created nothing (run 69afc6f8).
-*
-* No OAuth-ceiling edit needed — all are unprivileged public scope objects
-* covered by the apps' `@default` sentinel, and self-driving already requests
-* every one of them.
-*/
-const REPLAY_VISION_SCOPE_ADDITIONS = [
-	"session_recording:read",
-	"product_enablement:write",
-	"replay_scanner:read",
-	"replay_scanner:write"
-];
-/**
-* Per-program scope additions, layered on top of `WIZARD_OAUTH_SCOPES`.
-*
-* Programs not listed here request the unchanged base set. Use this
-* map only for programs that need *more* than the base — never for
-* narrowing, since narrowing risks breaking shared infrastructure
-* (e.g. dropping `llm_gateway:read` would 401 every agent call).
-*
-* Keyed by `ProgramId` so TypeScript catches stale entries when a
-* program is renamed or removed.
-*/
-const PROGRAM_SCOPE_ADDITIONS = {
-	"mcp-tutorial": MCP_TUTORIAL_SCOPE_ADDITIONS,
-	"agent-skill": AGENT_SKILL_SCOPE_ADDITIONS,
-	"self-driving": SELF_DRIVING_SCOPE_ADDITIONS,
-	"warehouse-source": WAREHOUSE_SOURCE_SCOPE_ADDITIONS,
-	"posthog-integration": [...CONNECT_SLACK_SCOPE_ADDITIONS, ...WAREHOUSE_SOURCE_SCOPE_ADDITIONS],
-	slack: CONNECT_SLACK_SCOPE_ADDITIONS,
-	"replay-vision": REPLAY_VISION_SCOPE_ADDITIONS
-};
-/**
-* Resolve the OAuth scope list to request for a given program. Returns
-* `WIZARD_OAUTH_SCOPES` for programs without an addition entry; for
-* programs that do have one, returns the union of base + additions
-* with duplicates dropped (declaration order preserved, base first).
-*
-* `null` / `undefined` programId falls through to the default — same
-* behavior as the historical hardcoded `WIZARD_OAUTH_SCOPES` reference
-* in `askForWizardLogin`, so call sites that haven't been updated to
-* pass a programId continue to work unchanged.
-*/
-function getOAuthScopesForProgram(programId) {
-	const additions = programId && PROGRAM_SCOPE_ADDITIONS[programId] || [];
-	if (additions.length === 0) return WIZARD_OAUTH_SCOPES;
-	const seen = /* @__PURE__ */ new Set();
-	const merged = [];
-	for (const s of [...WIZARD_OAUTH_SCOPES, ...additions]) {
-		if (seen.has(s)) continue;
-		seen.add(s);
-		merged.push(s);
-	}
-	return merged;
-}
-/**
-* Resolve the scope list for the signup provisioning path. Same
-* base-plus-additions shape as `getOAuthScopesForProgram`, but layered on
-* `WIZARD_PROVISIONING_SCOPES` so a program's extra scopes only reach
-* tokens provisioned for that program.
-*/
-function getProvisioningScopesForProgram(programId) {
-	const additions = programId && PROGRAM_SCOPE_ADDITIONS[programId] || [];
-	if (additions.length === 0) return WIZARD_PROVISIONING_SCOPES;
-	const seen = /* @__PURE__ */ new Set();
-	const merged = [];
-	for (const s of [...WIZARD_PROVISIONING_SCOPES, ...additions]) {
-		if (seen.has(s)) continue;
-		seen.add(s);
-		merged.push(s);
-	}
-	return merged;
-}
-//#endregion
-//#region src/shared/host-resolution.ts
-/**
-* HostResolution — the single, immutable snapshot of where the wizard talks to
-* PostHog for one run.
-*
-* One cloud region (or a pinned `--base-url`) implies a whole family of hosts:
-* the event-ingestion/API host, the user-facing web app host, the CDN asset
-* host, the LLM gateway, and the MCP server. Rather than re-deriving each of
-* these at every call site and threading `region` + `baseUrl` around as loose
-* params, resolve once at auth time and pass this frozen object around — read
-* the property you need.
-*
-* The actual region→URL math (and the `--base-url` override) lives in
-* `@utils/urls`; this class is a thin, immutable façade over those resolvers so
-* the override flows through every field without callers having to know about
-* it. The OAuth-server URL stays in `@utils/urls` (`getOAuthUrl`) because it is
-* needed *before* a region is known, so it can't come from this post-auth object.
-*/
-const MCP_PROD_URL = "https://mcp.posthog.com/mcp";
-function assetHostFor(region, baseUrl) {
-	const override = resolveBaseUrl(baseUrl);
-	if (override) return override;
-	return region === "eu" ? "https://eu-assets.i.posthog.com" : "https://us-assets.i.posthog.com";
-}
-function assetHostFromApiHost(apiHost) {
-	if (apiHost.includes("us.i.posthog.com")) return "https://us-assets.i.posthog.com";
-	if (apiHost.includes("eu.i.posthog.com")) return "https://eu-assets.i.posthog.com";
-	return apiHost;
-}
-/**
-* Dev/CI only: the env override (see env.ts) wins even under --local-mcp;
-* published builds strip the read. Don't name that env var in comments here —
-* smoke-test.sh greps dist/*.js for it, and JSDoc survives bundling.
-*/
-function mcpUrlFor(localMcp) {
-	return localMcp ? MCP_LOCAL_URL : MCP_PROD_URL;
-}
-var HostResolution = class HostResolution {
-	/** The resolved cloud region. `'us'` when a base URL is pinned. */
-	region;
-	/**
-	* Event-ingestion / REST API host (e.g. `https://us.i.posthog.com`, or the
-	* pinned `--base-url`). The SDK `host` written into the user's `.env`, the
-	* base for the wizard-session REST calls, and the host shown to the agent.
-	*/
-	apiHost;
-	/**
-	* User-facing web app host (e.g. `https://us.posthog.com`). Use for any link
-	* we hand to the user or open in their browser (dashboards, settings, inbox,
-	* deep-link base).
-	*/
-	appHost;
-	/** CDN asset host (e.g. `https://us-assets.i.posthog.com`). */
-	assetHost;
-	/**
-	* PostHog MCP server URL the agent connects to. Region-independent — the
-	* server resolves the user's region from the bearer token — so this is driven
-	* only by `--local-mcp` / `--local-dev` and the dev env override, not by
-	* region/base-url.
-	*/
-	mcpUrl;
-	constructor(fields) {
-		this.region = fields.region;
-		this.apiHost = fields.apiHost;
-		this.appHost = fields.appHost;
-		this.assetHost = fields.assetHost;
-		this.mcpUrl = fields.mcpUrl;
-		Object.freeze(this);
-	}
-	/**
-	* Canonical path: build the host family from a resolved region. A pinned
-	* `--base-url` (via `opts.baseUrl`) wins for every origin; otherwise the
-	* region's standard hosts are used. Honors IS_DEV through `resolveBaseUrl`.
-	*/
-	static fromRegion(region, opts = {}) {
-		return new HostResolution({
-			region,
-			apiHost: getHost(region, opts.baseUrl),
-			appHost: getCloudUrl(region, opts.baseUrl),
-			assetHost: assetHostFor(region, opts.baseUrl),
-			mcpUrl: mcpUrlFor(opts.localMcp ?? false)
-		});
-	}
-	/**
-	* Build from an ingestion host string (the provisioning API returns one). The
-	* given host is preserved verbatim as `apiHost`; the region and the derived
-	* app/asset/gateway hosts are inferred from it.
-	*/
-	static fromApiHost(apiHost, opts = {}) {
-		return new HostResolution({
-			region: apiHost.includes("eu.") ? "eu" : "us",
-			apiHost,
-			appHost: getUiHostFromHost(apiHost),
-			assetHost: assetHostFromApiHost(apiHost),
-			mcpUrl: mcpUrlFor(opts.localMcp ?? false)
-		});
-	}
-	/**
-	* Resolve the region from an access token (the us/eu probe, skipped when a
-	* base URL is pinned), then build the host family. Used after OAuth and after
-	* CI-mode API-key auth.
-	*/
-	static async fromAccessToken(accessToken, opts = {}) {
-		const region = opts.region ?? await detectRegion(accessToken, opts.baseUrl);
-		return HostResolution.fromRegion(region, opts);
-	}
-};
-//#endregion
-//#region src/shared/utils/oauth-errors.ts
-/**
-* OAuth failure presentation — the structured error the flow throws and the
-* user-facing messaging built from it.
-*
-* `oauth.ts` owns the flow machinery (callback server, token exchange, port
-* retries); this module owns what a failure *means*: the RFC 6749 error
-* fields (`error`, `error_description`, `error_uri`), per-code remediation
-* copy, and safe rendering for the browser callback page. Everything here is
-* pure so the copy can be unit-tested without the HTTP machinery.
-*/
-/**
-* A structured OAuth failure (RFC 6749 §4.1.2.1 authorize errors, §5.2 token
-* errors). Thrown by both the authorize callback and the token exchange so
-* the flow's error handler keys remediation copy and analytics fingerprints
-* off `code` instead of re-parsing `message`.
-*
-* The message stays exactly `OAuth error: <code>` — the analytics fingerprint
-* scheme (`wizard_oauth_<code>`) and the legacy message-prefix parsing both
-* depend on that shape. The description/uri ride along as properties.
-*
-* NAMING: never bind an instance to a variable or property whose name
-* contains "oauth" (use `flowError`, `callbackError`, ...). CodeQL's
-* clear-text-logging heuristic classifies any `*oauth*`-named variable read
-* as password data, and these errors are deliberately shown to the user, so
-* such a binding flags every log statement downstream of it (CWE-312).
-*/
-var OAuthError = class extends Error {
-	code;
-	/** The server's human-readable explanation (`error_description`), if sent. */
-	description;
-	/** The server's "more info" link (`error_uri`), if sent. */
-	uri;
-	constructor(code, description, uri) {
-		super(`OAuth error: ${code}`);
-		this.name = "OAuthError";
-		this.code = code;
-		this.description = description;
-		this.uri = uri;
-	}
-};
-/**
-* Sanitize an OAuth error param before logging or rendering it: these arrive
-* on a query string (or a token-endpoint body) that anything able to hit the
-* local callback port can populate. Strips non-printable/non-ASCII characters
-* and caps the length. Returns undefined when nothing printable remains.
-*/
-function sanitizeOAuthParam(value, maxLength = 200) {
-	if (!value) return void 0;
-	return value.replace(/[^\x20-\x7e]/g, "").slice(0, maxLength).trim() || void 0;
-}
-/** Description sentences get more room than bare codes/URIs. */
-const MAX_DESCRIPTION_LENGTH = 500;
-function escapeHtml(value) {
-	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-const OAuthErrorBodySchema = z.object({
-	error: z.string().min(1),
-	error_description: z.string().optional(),
-	error_uri: z.string().optional()
-});
-/**
-* Build an `OAuthError` from an authorize-callback's query params.
-* Sanitizes every field — the callback URL is attacker-reachable input.
-*/
-function oauthErrorFromCallbackParams(params) {
-	return new OAuthError(sanitizeOAuthParam(params.get("error")) ?? "unknown", sanitizeOAuthParam(params.get("error_description"), MAX_DESCRIPTION_LENGTH), sanitizeOAuthParam(params.get("error_uri")));
-}
-/**
-* Build an `OAuthError` from a token-endpoint JSON error body (RFC 6749
-* §5.2). Returns null when the body isn't an OAuth error shape (HTML error
-* pages, proxy bodies, network failures) — the caller rethrows the raw
-* error in that case.
-*/
-function oauthErrorFromTokenBody(data) {
-	const parsed = OAuthErrorBodySchema.safeParse(data);
-	if (!parsed.success) return null;
-	return new OAuthError(sanitizeOAuthParam(parsed.data.error) ?? "unknown", sanitizeOAuthParam(parsed.data.error_description, MAX_DESCRIPTION_LENGTH), sanitizeOAuthParam(parsed.data.error_uri));
-}
-/**
-* The error paragraphs for the browser callback page. The constant framing
-* (title, styles, "return to your terminal") stays in `oauth.ts`; this owns
-* the part that varies by error, with everything HTML-escaped since the
-* values come straight off the callback query string.
-*/
-function buildCallbackErrorHtml(error) {
-	if (error.code === "access_denied") return "<p>Authorization cancelled.</p>";
-	const paragraphs = [`<p>Authorization failed (${escapeHtml(error.code)}).</p>`];
-	if (error.description) paragraphs.push(`<p>${escapeHtml(error.description)}</p>`);
-	if (error.uri) paragraphs.push(`<p>More info: ${escapeHtml(error.uri)}</p>`);
-	return paragraphs.join("\n");
-}
-/**
-* Per-code headline + "what to do" remediation for the terminal failure
-* message. Codes not listed fall through to a generic rendering of the
-* error. `access_denied` and the flow timeout never reach this — they keep
-* their dedicated handling in `performOAuthFlow`.
-*/
-function headlineAndRemediation(params) {
-	const { error, oauthUrl, isDevStack } = params;
-	if (!(error instanceof OAuthError)) return { headline: error.message };
-	switch (error.code) {
-		case "invalid_scope": return {
-			headline: "PostHog rejected one or more of the requested scopes (invalid_scope).",
-			whatToDo: isDevStack ? "The wizard OAuth app on your local stack allows fewer scopes than the wizard requests (its OAuthApplication.scopes ceiling). Re-run your local wizard OAuth app setup so it allows every scope listed below, or add the missing ones in Django admin, then try again." : `The wizard OAuth app's server-side scope ceiling (OAuthApplication.scopes) is missing scopes the wizard requests. This needs a fix on the PostHog side, so email ${WIZARD_CONTACT_EMAIL} with the details below (PostHog staff: the "scope-ceiling-invalid-scope" runbook in PostHog/runbooks has the fix). Re-running the wizard will not help until the ceiling is updated.`
-		};
-		case "invalid_client": return {
-			headline: `PostHog at ${oauthUrl} does not recognize the wizard's OAuth client (invalid_client).`,
-			whatToDo: "The client ID below is not registered on the target instance. If you pointed the wizard at a local or self-hosted stack (--base-url), seed its wizard OAuth app first; otherwise re-run without --base-url to use PostHog Cloud."
-		};
-		case "invalid_grant": return {
-			headline: "The login code was rejected (invalid_grant): it expired or was already used.",
-			whatToDo: "Re-run the wizard and complete the browser login promptly. Login codes expire after 5 minutes and can only be used once."
-		};
-		case "server_error": return {
-			headline: "PostHog's OAuth server hit an internal error (server_error).",
-			whatToDo: `This is usually transient. Wait a moment and re-run the wizard. If it keeps failing, check ${POSTHOG_STATUS_PAGE_URL}.`
-		};
-		case "temporarily_unavailable": return {
-			headline: "PostHog's OAuth server is temporarily unavailable (temporarily_unavailable).",
-			whatToDo: `This is usually transient. Wait a moment and re-run the wizard. If it keeps failing, check ${POSTHOG_STATUS_PAGE_URL}.`
-		};
-		default: return {
-			headline: `PostHog returned an OAuth error: ${error.code}.`,
-			whatToDo: "Re-run the wizard. If the error persists, include the details below when asking for help."
-		};
-	}
-}
-/**
-* Terminal message for a failed OAuth flow. Always ends with the request
-* context (target host, client ID, requested scopes) so a pasted bug report
-* is actionable without follow-up questions, plus how to get help: the
-* support email (Zendesk-backed) and the issues link.
-*/
-function buildOAuthFailureMessage(params) {
-	const { error, requestedScopes, clientId, oauthUrl } = params;
-	const flowError = error instanceof OAuthError ? error : null;
-	const { headline, whatToDo } = headlineAndRemediation(params);
-	const sections = [`Authorization failed: ${headline}`];
-	if (flowError?.description) sections.push(`The server said: ${flowError.description}`);
-	if (flowError?.uri) sections.push(`More info: ${flowError.uri}`);
-	if (whatToDo) sections.push(`What to do: ${whatToDo}`);
-	sections.push([
-		"Details for bug reports:",
-		`  target host: ${oauthUrl}`,
-		`  client ID: ${clientId}`,
-		`  requested scopes: ${requestedScopes.join(" ")}`
-	].join("\n"));
-	sections.push(`Need help? Email ${WIZARD_CONTACT_EMAIL} with the details above, or create an issue:\n${ISSUES_URL}`);
-	return sections.join("\n\n");
-}
-//#endregion
-//#region src/shared/utils/oauth.ts
-const OAUTH_CALLBACK_STYLES = `
-  <style>
-    * {
-      font-family: monospace;
-      background-color: #1b0a00;
-      color: #F7A502;
-      font-weight: medium;
-      font-size: 24px;
-      margin: .25rem;
-    }
-
-    .blink {
-      animation: blink-animation 1s steps(2, start) infinite;
-    }
-
-    @keyframes blink-animation {
-      to {
-        opacity: 0;
-      }
-    }
-  </style>
-`;
-const OAuthTokenResponseSchema = z.object({
-	access_token: z.string(),
-	expires_in: z.number(),
-	token_type: z.string(),
-	scope: z.string(),
-	refresh_token: z.string().optional(),
-	scoped_teams: z.array(z.number()).optional(),
-	scoped_organizations: z.array(z.string()).optional(),
-	posthog_region: z.enum(["us", "eu"]).optional().catch(void 0),
-	posthog_base_url: z.string().optional().catch(void 0)
-});
-const WIZARD_COMPLETION_SCOPE = "event_definition:write";
-function parseOAuthScopes(scope) {
-	return scope.split(/\s+/).filter(Boolean);
-}
-/**
-* Requested scopes the grant came back without.
-*
-* A token can legitimately carry fewer scopes than the wizard asked for: the
-* consent screen lets the user deselect any scope the OAuth app doesn't mark
-* required, and anything outside the app's ceiling is clamped server-side.
-* Neither path is an error — `/oauth/token` just returns a narrower `scope`.
-* Diff it at login, where the gap is fixable, rather than letting the run
-* discover it as a permission failure on some API call minutes in.
-*/
-function missingOAuthScopes(requested, grantedScope) {
-	const granted = new Set(parseOAuthScopes(grantedScope));
-	return requested.filter((scope) => !granted.has(scope));
-}
-function assertWizardCompletionScope(scope) {
-	if (parseOAuthScopes(scope).includes("event_definition:write")) return;
-	throw new Error(`This run was authorized without the ${WIZARD_COMPLETION_SCOPE} permission, which the wizard needs to finish setup. Please try again, approving all permissions on the PostHog authorization screen. If that screen does not reappear, revoke the existing PostHog Wizard authorization in your PostHog settings first.`);
-}
-const AUTHORIZATION_TIMEOUT_MESSAGE = "Authorization timed out";
-function isAuthorizationTimeout(error) {
-	return error.message === AUTHORIZATION_TIMEOUT_MESSAGE;
-}
-/**
-* OAuth client ID for the current target. A pinned base URL (`--base-url`, or
-* IS_DEV's implicit localhost) means we're talking to a dev-seeded stack, which
-* registers the dev client; prod uses the proxy client.
-*
-* TODO: this assumes any pinned base URL is a dev-seeded instance that
-* registers POSTHOG_DEV_CLIENT_ID. If we ever point `--base-url` at a non-dev
-* instance with its own OAuth app, make the client ID configurable (e.g. a
-* `--oauth-client-id` flag) instead of always falling back to the dev client.
-*/
-function getOAuthClientId(baseUrl) {
-	return resolveBaseUrl(baseUrl) ? POSTHOG_DEV_CLIENT_ID : POSTHOG_PROXY_CLIENT_ID;
-}
-function getLocalOAuthOrigin(port) {
-	return `http://localhost:${port}`;
-}
-function getCallbackUrl(port) {
-	return `${getLocalOAuthOrigin(port)}/callback`;
-}
-function getLocalLoginUrl(port) {
-	return `${getLocalOAuthOrigin(port)}/authorize`;
-}
-function getLocalSignupUrl(port) {
-	return `${getLocalLoginUrl(port)}?signup=true`;
-}
-/**
-* Extract an OAuth authorization code from raw user input. Accepts either the
-* bare code, the full callback URL the browser was redirected to
-* (`http://localhost:8239/callback?code=abc123&...`), or just the query
-* string. Returns null when no code can be found.
-*
-* This backs the manual-entry fallback: in headless/remote environments the
-* browser can't reach the wizard's local callback server, so the user copies
-* the failed callback URL (or the code from it) back into the terminal.
-*/
-function extractOAuthCode(input) {
-	const trimmed = input.trim();
-	if (!trimmed) return null;
-	let looksLikeUrl = false;
-	try {
-		const url = new URL(trimmed);
-		looksLikeUrl = true;
-		const code = url.searchParams.get("code");
-		if (code) return code;
-	} catch {}
-	const match = trimmed.match(/[?&]?code=([^&\s]+)/);
-	if (match) return decodeURIComponent(match[1]);
-	if (looksLikeUrl) return null;
-	if (!/\s/.test(trimmed)) return trimmed;
-	return null;
-}
-function generateCodeVerifier() {
-	return crypto.randomBytes(32).toString("base64url");
-}
-function generateCodeChallenge(verifier) {
-	return crypto.createHash("sha256").update(verifier).digest("base64url");
-}
-async function startCallbackServer(authUrl, signupUrl, port) {
-	return new Promise((resolve, reject) => {
-		let callbackResolve;
-		let callbackReject;
-		const waitForCallback = () => new Promise((res, rej) => {
-			callbackResolve = res;
-			callbackReject = rej;
-		});
-		const server = http.createServer((req, res) => {
-			if (!req.url) {
-				res.writeHead(400);
-				res.end();
-				return;
-			}
-			const url = new URL(req.url, getLocalOAuthOrigin(port));
-			if (url.pathname === "/authorize") {
-				const redirectUrl = url.searchParams.get("signup") === "true" ? signupUrl : authUrl;
-				res.writeHead(302, { Location: redirectUrl });
-				res.end();
-				return;
-			}
-			const code = url.searchParams.get("code");
-			if (url.searchParams.get("error")) {
-				const callbackError = oauthErrorFromCallbackParams(url.searchParams);
-				const isAccessDenied = callbackError.code === "access_denied";
-				logToFile(`[oauth] callback received with error: ${callbackError.code}` + (callbackError.description ? ` (${callbackError.description})` : ""));
-				res.writeHead(isAccessDenied ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
-				res.end(`
-          <html>
-            <head>
-              <meta charset="UTF-8">
-              <title>PostHog wizard - Authorization ${isAccessDenied ? "cancelled" : "failed"}</title>
-              ${OAUTH_CALLBACK_STYLES}
-            </head>
-            <body>
-              ${buildCallbackErrorHtml(callbackError)}
-              <p>Return to your terminal. This window will close automatically.</p>
-              <script>window.close();<\/script>
-            </body>
-          </html>
-        `);
-				callbackReject(callbackError);
-				return;
-			}
-			if (code) {
-				logToFile("[oauth] callback received with authorization code");
-				res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-				res.end(`
-          <html>
-            <head>
-              <meta charset="UTF-8">
-              <title>PostHog wizard is ready</title>
-              ${OAUTH_CALLBACK_STYLES}
-            </head>
-            <body>
-              <p>PostHog login complete!</p>
-              <p>Return to your terminal: the wizard is hard at work on your project<span class="blink">█</span></p>
-              <script>window.close();<\/script>
-            </body>
-          </html>
-        `);
-				callbackResolve(code);
-			} else {
-				res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-				res.end(`
-          <html>
-            <head>
-              <meta charset="UTF-8">
-              <title>PostHog wizard - Invalid request</title>
-              ${OAUTH_CALLBACK_STYLES}
-            </head>
-            <body>
-              <p>Invalid request - no authorization code received.</p>
-              <p>You can close this window.</p>
-            </body>
-          </html>
-        `);
-			}
-		});
-		server.on("clientError", (error, socket) => {
-			if (socket.destroyed || socket.writableEnded) return;
-			if (error.code === "ECONNRESET" || !socket.writable) {
-				socket.destroy();
-				return;
-			}
-			logToFile(`[oauth] local HTTP request rejected: ${error.code ?? "unknown"}`);
-			const overflow = error.code === "HPE_HEADER_OVERFLOW";
-			let status = "400 Bad Request";
-			switch (error.code) {
-				case "HPE_HEADER_OVERFLOW":
-					status = "431 Request Header Fields Too Large";
-					break;
-				case "HPE_CHUNK_EXTENSIONS_OVERFLOW":
-					status = "413 Payload Too Large";
-					break;
-				case "ERR_HTTP_REQUEST_TIMEOUT":
-					status = "408 Request Timeout";
-					break;
-			}
-			const body = overflow ? `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8">
-    <title>PostHog wizard - Browser request too large</title>
-    ${OAUTH_CALLBACK_STYLES}
-  </head>
-  <body>
-    <p>Your browser sent more than ${http.maxHeaderSize / 1024} KiB of request headers.</p>
-    <p>This can happen when cookies from other localhost apps accumulate.</p>
-    <p>Clear cookies for localhost and retry, or open the login link from your terminal in a private/incognito window.</p>
-  </body>
-</html>` : "";
-			socket.end(`HTTP/1.1 ${status}\r\nContent-Type: text/html; charset=utf-8\r
-Content-Length: ${Buffer.byteLength(body)}\r\nConnection: close\r
-Cache-Control: no-store\r
-\r
-` + body);
-		});
-		server.listen(port, () => {
-			resolve({
-				port,
-				server,
-				waitForCallback
-			});
-		});
-		server.on("error", reject);
-	});
-}
-function getPortProcessInfo(port) {
-	try {
-		const lines = execSync(`lsof -i :${port} -sTCP:LISTEN 2>/dev/null`, {
-			encoding: "utf-8",
-			timeout: 3e3
-		}).trim().split("\n");
-		if (lines.length < 2) return {
-			command: "unknown",
-			pid: "unknown",
-			port,
-			user: "unknown"
-		};
-		const fields = lines[1].split(/\s+/);
-		return {
-			command: fields[0] ?? "unknown",
-			pid: fields[1] ?? "unknown",
-			port,
-			user: fields[2] ?? "unknown"
-		};
-	} catch {
-		return {
-			command: "unknown",
-			pid: "unknown",
-			port,
-			user: "unknown"
-		};
-	}
-}
-function isPortInUseError(error) {
-	return error instanceof Error && "code" in error && error.code === "EADDRINUSE";
-}
-async function exchangeCodeForToken(code, codeVerifier, callbackUrl, baseUrl) {
-	const clientId = getOAuthClientId(baseUrl);
-	const oauthUrl = getOAuthUrl(baseUrl);
-	logToFile(`[oauth] exchanging code for token at ${oauthUrl}/oauth/token`);
-	let response;
-	try {
-		response = await axios.post(`${oauthUrl}/oauth/token`, {
-			grant_type: "authorization_code",
-			code,
-			redirect_uri: callbackUrl,
-			client_id: clientId,
-			code_verifier: codeVerifier
-		}, { headers: {
-			"Content-Type": "application/json",
-			"User-Agent": WIZARD_USER_AGENT
-		} });
-	} catch (e) {
-		const status = axios.isAxiosError(e) ? e.response?.status : void 0;
-		logToFile(`[oauth] token exchange failed${status ? ` (HTTP ${status})` : ""}:`, e instanceof Error ? e.message : e);
-		const exchangeError = axios.isAxiosError(e) ? oauthErrorFromTokenBody(e.response?.data) : null;
-		if (exchangeError) {
-			logToFile(`[oauth] token endpoint error: ${exchangeError.code}` + (exchangeError.description ? ` (${exchangeError.description})` : ""));
-			throw exchangeError;
-		}
-		throw e;
-	}
-	const token = OAuthTokenResponseSchema.parse(response.data);
-	logToFile(`[oauth] token exchange succeeded, granted scopes: ${token.scope}${token.posthog_region ? `, region: ${token.posthog_region}` : ""}${token.scoped_teams ? `, scoped_teams: [${token.scoped_teams.join(", ")}]` : ""}${token.scoped_organizations ? `, scoped_organizations: ${token.scoped_organizations.length}` : ""}`);
-	return token;
-}
-async function refreshAccessToken(refreshToken, baseUrl, clientId) {
-	const oauthUrl = getOAuthUrl(baseUrl);
-	logToFile(`[oauth] refreshing access token at ${oauthUrl}/oauth/token`);
-	try {
-		const response = await axios.post(`${oauthUrl}/oauth/token`, {
-			grant_type: "refresh_token",
-			refresh_token: refreshToken,
-			client_id: clientId ?? getOAuthClientId(baseUrl)
-		}, {
-			headers: {
-				"Content-Type": "application/json",
-				"User-Agent": WIZARD_USER_AGENT
-			},
-			timeout: 3e4
-		});
-		const token = OAuthTokenResponseSchema.parse(response.data);
-		logToFile("[oauth] access token refreshed");
-		return token;
-	} catch (e) {
-		logToFile("[oauth] token refresh failed:", e instanceof Error ? e.message : e);
-		throw (axios.isAxiosError(e) ? oauthErrorFromTokenBody(e.response?.data) : null) ?? e;
-	}
-}
-/**
-* Warn — at login, while the user is still watching — when the grant came back
-* narrower than the request, and record the gap so narrowed runs are countable.
-* Non-fatal by design: deselecting an optional scope is the user's call, and
-* most flows survive it. The one scope the wizard cannot run without has its
-* own hard check (`assertWizardCompletionScope`).
-*/
-function reportNarrowedGrant(requestedScopes, grantedScope) {
-	const missing = missingOAuthScopes(requestedScopes, grantedScope);
-	if (missing.length === 0) return;
-	logToFile(`[oauth] grant narrower than request, missing: ${missing.join(" ")}`);
-	analytics.wizardCapture("oauth grant narrowed", {
-		requested_scopes: [...requestedScopes].sort().join(" "),
-		granted_scopes: parseOAuthScopes(grantedScope).sort().join(" "),
-		missing_scopes: missing.join(" "),
-		missing_scope_count: missing.length
-	});
-	const plural = missing.length > 1;
-	getUI().log.warn(`Your PostHog authorization is missing ${plural ? `${missing.length} permissions` : "a permission"} the wizard asked for: ${missing.join(", ")}. Setup will continue, but steps that need ${plural ? "them" : "it"} may fail. To grant ${plural ? "them" : "it"}, re-run the wizard and approve all permissions on the authorization screen. If that screen does not reappear, revoke the existing PostHog Wizard authorization in your PostHog settings first.`);
-}
-async function performOAuthFlow(config) {
-	const clientId = getOAuthClientId(config.baseUrl);
-	const oauthUrl = getOAuthUrl(config.baseUrl);
-	const codeVerifier = generateCodeVerifier();
-	const codeChallenge = generateCodeChallenge(codeVerifier);
-	let shouldRetry = false;
-	logToFile(`[oauth] starting flow against ${oauthUrl}, requested scopes: ${config.scopes.join(" ")}`);
-	do {
-		shouldRetry = false;
-		let lastProcessInfo = null;
-		for (const port of OAUTH_PORTS) {
-			const callbackUrl = getCallbackUrl(port);
-			const authUrl = new URL(`${oauthUrl}/oauth/authorize`);
-			authUrl.searchParams.set("client_id", clientId);
-			authUrl.searchParams.set("redirect_uri", callbackUrl);
-			authUrl.searchParams.set("response_type", "code");
-			authUrl.searchParams.set("code_challenge", codeChallenge);
-			authUrl.searchParams.set("code_challenge_method", "S256");
-			authUrl.searchParams.set("scope", config.scopes.join(" "));
-			authUrl.searchParams.set("required_access_level", "project");
-			if (config.projectId !== void 0) authUrl.searchParams.set("team_id", String(config.projectId));
-			const taggedAuthUrl = withUtm(authUrl.toString(), "oauth-authorize");
-			const signupUrl = new URL(withUtm(`${oauthUrl}/signup?next=${encodeURIComponent(taggedAuthUrl)}`, "oauth-signup"));
-			const localSignupUrl = getLocalSignupUrl(port);
-			const localLoginUrl = getLocalLoginUrl(port);
-			const urlToOpen = config.signup ? localSignupUrl : localLoginUrl;
-			logToFile(`[oauth] attempting callback server on port ${port}`);
-			let server;
-			let waitForCallback;
-			try {
-				({server, waitForCallback} = await startCallbackServer(taggedAuthUrl, signupUrl.toString(), port));
-			} catch (e) {
-				if (!isPortInUseError(e)) throw e;
-				lastProcessInfo = getPortProcessInfo(port);
-				continue;
-			}
-			logToFile("[oauth] callback server ready, showing login URL");
-			getUI().setLoginUrl(urlToOpen);
-			getUI().setAuthorizeUrl(config.signup ? signupUrl.toString() : taggedAuthUrl);
-			openTrackedLink(urlToOpen, "oauth", {
-				auto: true,
-				skipUtm: true
-			});
-			const loginSpinner = getUI().spinner();
-			loginSpinner.start("Waiting for authorization...");
-			try {
-				const token = await exchangeCodeForToken(await Promise.race([
-					waitForCallback(),
-					getUI().waitForManualAuthCode(),
-					new Promise((_, reject) => setTimeout(() => reject(new Error(AUTHORIZATION_TIMEOUT_MESSAGE)), OAUTH_TIMEOUT_MS))
-				]), codeVerifier, callbackUrl, config.baseUrl);
-				server.close();
-				getUI().setLoginUrl(null);
-				getUI().setAuthorizeUrl(null);
-				loginSpinner.stop("Authorization complete!");
-				reportNarrowedGrant(config.scopes, token.scope);
-				return token;
-			} catch (e) {
-				const error = e instanceof Error ? e : /* @__PURE__ */ new Error("Unknown error");
-				const timedOut = isAuthorizationTimeout(error);
-				const flowError = error instanceof OAuthError ? error : null;
-				loginSpinner.stop(timedOut ? "Session timed out." : "Authorization failed.");
-				server.close();
-				logToFile("[oauth] flow failed:", error);
-				if (flowError?.description) logToFile(`[oauth] server error_description: ${flowError.description}`);
-				const accessDenied = flowError ? flowError.code === "access_denied" : error.message.includes("access_denied");
-				if (timedOut) getUI().showSessionTimeout();
-				else if (accessDenied) getUI().log.info(`Authorization was cancelled.\n\nYou denied access to PostHog. To use the wizard, you need to authorize access to your PostHog account.\n\nYou can try again by re-running the wizard.`);
-				else getUI().log.error(buildOAuthFailureMessage({
-					error,
-					requestedScopes: config.scopes,
-					clientId,
-					oauthUrl,
-					isDevStack: resolveBaseUrl(config.baseUrl) !== void 0
-				}));
-				const oauthErrorCode = flowError ? flowError.code : error.message.startsWith("OAuth error: ") ? error.message.slice(13) : timedOut ? "timeout" : "unknown";
-				analytics.captureException(error, {
-					step: "oauth_flow",
-					oauth_error_code: oauthErrorCode,
-					oauth_error_description: flowError?.description,
-					client_id: clientId,
-					requested_scopes: config.scopes.join(" "),
-					$exception_fingerprint: `wizard_oauth_${oauthErrorCode}`
-				});
-				await abort();
-				throw error;
-			}
-		}
-		if (!lastProcessInfo) throw new Error("No OAuth callback ports configured");
-		await getUI().showPortConflict(lastProcessInfo);
-		shouldRetry = true;
-	} while (shouldRetry);
-	throw new Error("OAuth port retry loop exited unexpectedly");
-}
-//#endregion
-//#region src/shared/utils/project-resolution.ts
-/**
-* Decide which project to use after OAuth. `--project-id` (when passed) is authoritative,
-* but only when the user granted access to it on the consent screen; a different grant is a
-* mismatch the caller must surface. With no `--project-id` this returns the granted project
-* (`scopedTeams[0]`), preserving the pre-flag behavior for every wizard program (the main
-* integration flow included).
-*/
-function resolveGrantedProject(requestedProjectId, scopedTeams) {
-	if (requestedProjectId === void 0) return {
-		ok: true,
-		projectId: scopedTeams?.[0]
-	};
-	if (scopedTeams?.includes(requestedProjectId)) return {
-		ok: true,
-		projectId: requestedProjectId
-	};
-	if (scopedTeams && scopedTeams.length > 0) return {
-		ok: false,
-		requested: requestedProjectId,
-		granted: scopedTeams[0]
-	};
-	return {
-		ok: true,
-		projectId: void 0
-	};
-}
-//#endregion
-//#region src/shared/utils/semver.ts
-/**
-* Version strings from package.json that are not semver ranges.
-* URLs, git refs, dist-tags, local paths, workspace protocol, npm aliases, etc.
-* These should be rejected early — we can't determine a clear version from them.
-*/
-function isNonSemverVersion(version) {
-	const v = version.trim();
-	return v === "" || v.startsWith("http://") || v.startsWith("https://") || v.startsWith("git+") || v.startsWith("git://") || v.startsWith("file:") || v.startsWith("npm:") || v.startsWith("workspace:") || v.startsWith("/") || v.includes("/");
-}
-/**
-* Creates a version bucket function for analytics.
-* Converts versions like "1.2.3" to "1.x" for grouping in analytics.
-*
-* @param minMajorVersion - Optional minimum major version threshold.
-*   Versions below this will be bucketed as "<{min}.0.0"
-*
-* @example
-* const getVersionBucket = createVersionBucket(); // no minimum
-* getVersionBucket("1.2.3") // "1.x"
-*
-* const getVersionBucket = createVersionBucket(11);
-* getVersionBucket("15.3.0") // "15.x"
-* getVersionBucket("10.0.0") // "<11.0.0"
-*/
-function createVersionBucket(minMajorVersion) {
-	return (version) => {
-		if (!version) return "none";
-		if (isNonSemverVersion(version)) return "unknown";
-		try {
-			const minVer = minVersion(version);
-			if (!minVer) return "invalid";
-			const majorVersion = major(minVer);
-			if (minMajorVersion !== void 0 && majorVersion < minMajorVersion) return `<${minMajorVersion}.0.0`;
-			return `${majorVersion}.x`;
-		} catch {
-			return "unknown";
-		}
-	};
-}
-//#endregion
-//#region src/shared/utils/setup-utils.ts
-/** @deprecated Use wizardAbort() directly for new code. */
-async function abort(message, status) {
-	return wizardAbort({
-		message,
-		exitCode: status
-	});
-}
-const FREEMAIL_DOMAINS = new Set([
-	"gmail.com",
-	"googlemail.com",
-	"hotmail.com",
-	"outlook.com",
-	"yahoo.com",
-	"icloud.com",
-	"me.com",
-	"mail.com",
-	"protonmail.com",
-	"proton.me",
-	"live.com",
-	"aol.com",
-	"yandex.com",
-	"zoho.com",
-	"gmx.com",
-	"fastmail.com"
-]);
-function parseGitRemote() {
-	try {
-		const match = childProcess.execSync("git remote get-url origin", { stdio: [
-			"ignore",
-			"pipe",
-			"ignore"
-		] }).toString().trim().match(/[/:]([\w.-]+)\/([\w.-]+?)(?:\.git)?$/);
-		if (match) return {
-			org: match[1],
-			repo: match[2]
-		};
-	} catch {}
-	return null;
-}
-function detectOrgAndProject(email) {
-	const remote = parseGitRemote();
-	const projectName = remote?.repo || basename(process.cwd()) || void 0;
-	let orgName;
-	if (remote?.org) orgName = remote.org;
-	else {
-		const domain = email.split("@")[1]?.toLowerCase();
-		if (domain && !FREEMAIL_DOMAINS.has(domain)) orgName = domain.split(".")[0];
-	}
-	return {
-		orgName,
-		projectName
-	};
-}
-/**
-* Get package.json or abort the wizard if not found.
-* Only use where package.json is required (e.g., package install, overrides).
-* For detection/version-checks, use tryGetPackageJson() instead.
-*/
-async function getPackageDotJson({ installDir }) {
-	const pkgPath = join$1(installDir, "package.json");
-	let raw;
-	try {
-		raw = await fs$1.promises.readFile(pkgPath, "utf8");
-	} catch {
-		getUI().log.error("Could not find package.json. Make sure to run the wizard in the root of your app!");
-		await abort();
-		return {};
-	}
-	try {
-		return JSON.parse(raw) ?? {};
-	} catch {
-		getUI().log.error(`Unable to parse your package.json. Make sure it has a valid format!`);
-		await abort();
-		return {};
-	}
-}
-/**
-* Try to get package.json, returning null if it doesn't exist.
-* Use this for detection purposes where missing package.json is expected (e.g., Python projects).
-*/
-async function tryGetPackageJson({ installDir }) {
-	try {
-		const packageJsonFileContents = await fs$1.promises.readFile(join$1(installDir, "package.json"), "utf8");
-		return JSON.parse(packageJsonFileContents);
-	} catch {
-		return null;
-	}
-}
-async function updatePackageDotJson(packageDotJson, { installDir }) {
-	const pkgPath = join$1(installDir, "package.json");
-	const serialized = JSON.stringify(packageDotJson, null, 2);
-	try {
-		await fs$1.promises.writeFile(pkgPath, serialized, {
-			encoding: "utf8",
-			flag: "w"
-		});
-		return;
-	} catch {
-		getUI().log.error(`Unable to update your package.json.`);
-		await abort();
-	}
-}
-function isUsingTypeScript({ installDir }) {
-	try {
-		fs$1.accessSync(join$1(installDir, "tsconfig.json"));
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Get project data for the wizard via OAuth or CI API key.
-*/
-async function getOrAskForProjectData(_options) {
-	if (_options.ci && _options.apiKey) {
-		getUI().log.info("Using provided API key (CI mode - OAuth bypassed)");
-		const host = await HostResolution.fromAccessToken(_options.apiKey, {
-			region: _options.region,
-			localMcp: _options.localMcp,
-			baseUrl: _options.baseUrl
-		});
-		const cloudUrl = host.appHost;
-		const projectData = _options.projectId != null ? await fetchProjectDataById(_options.apiKey, _options.projectId, cloudUrl) : await fetchProjectDataWithApiKey(_options.apiKey, cloudUrl);
-		let user = null;
-		let roleAtOrganization = null;
-		try {
-			user = await fetchUserData(_options.apiKey, cloudUrl);
-			roleAtOrganization = user.role_at_organization ?? null;
-		} catch (err) {
-			logToFile("[ci-auth] user lookup failed:", err instanceof Error ? err.message : String(err));
-		}
-		if (user) {
-			analytics.identifyUser(user);
-			logToFile("[ci-auth] identified via API key; flags evaluate as the key owner");
-		} else getUI().log.warn("Could not resolve the API key user (key needs user:read scope) — feature flags evaluate anonymously; user-targeted flags will not match.");
-		return {
-			host,
-			projectApiKey: projectData.api_token,
-			accessToken: _options.apiKey,
-			projectId: projectData.id,
-			roleAtOrganization,
-			user,
-			project: projectData.project,
-			missingScopes: []
-		};
-	}
-	const { host, projectApiKey, accessToken, refreshToken, expiresAt, oauthClientId, projectId, roleAtOrganization, user, project, missingScopes } = await withProgress("login", () => askForWizardLogin({
-		signup: _options.signup,
-		email: _options.email,
-		region: _options.region,
-		baseUrl: _options.baseUrl,
-		programId: _options.programId,
-		projectId: _options.projectId,
-		localMcp: _options.localMcp
-	}));
-	if (!projectApiKey) {
-		const cloudUrl = host.appHost;
-		getUI().log.error(`Didn't receive a project token. This shouldn't happen :(
-
-Please let us know if you think this is a bug in the wizard:
-${ISSUES_URL}`);
-		getUI().log.info(`In the meantime, we'll add a dummy project token ("${DUMMY_PROJECT_API_KEY}") for you to replace later.
-You can find your project token here:
-${cloudUrl}/settings/project#variables`);
-	}
-	return {
-		accessToken,
-		refreshToken,
-		expiresAt,
-		oauthClientId,
-		host,
-		projectApiKey: projectApiKey || "_YOUR_POSTHOG_PROJECT_TOKEN_",
-		projectId,
-		roleAtOrganization: roleAtOrganization ?? null,
-		user: user ?? null,
-		project: project ?? null,
-		missingScopes: missingScopes ?? []
-	};
-}
-async function fetchProjectDataWithApiKey(apiKey, cloudUrl) {
-	const projectId = (await fetchUserData(apiKey, cloudUrl)).team?.id;
-	if (!projectId) throw new Error("Could not determine project ID from API key. Please ensure your API key has access to a project in this cloud region.");
-	const projectData = await fetchProjectData(apiKey, projectId, cloudUrl);
-	return {
-		api_token: projectData.api_token,
-		id: projectId,
-		project: projectData
-	};
-}
-async function fetchProjectDataById(apiKey, projectId, cloudUrl) {
-	const projectData = await fetchProjectData(apiKey, projectId, cloudUrl);
-	return {
-		api_token: projectData.api_token,
-		id: projectId,
-		project: projectData
-	};
-}
-async function askForWizardLogin(options) {
-	if (options.signup) return askForProvisioningSignup(options.email, options.region, options.baseUrl, options.localMcp, options.programId);
-	const requestedScopes = [...getOAuthScopesForProgram(options.programId)];
-	const tokenResponse = await performOAuthFlow({
-		scopes: requestedScopes,
-		signup: false,
-		projectId: options.projectId,
-		baseUrl: options.baseUrl
-	});
-	try {
-		assertWizardCompletionScope(tokenResponse.scope);
-	} catch (error) {
-		const scopeError = error instanceof Error ? error : /* @__PURE__ */ new Error("OAuth scope check failed");
-		const missing = missingOAuthScopes(requestedScopes, tokenResponse.scope);
-		analytics.captureException(scopeError, {
-			step: "wizard_login",
-			missing_scope: "event_definition:write"
-		});
-		await wizardAbort({
-			message: scopeError.message,
-			outroData: {
-				kind: "error",
-				message: "Setup needs permissions that were not granted",
-				body: [
-					"Missing permissions:",
-					...missing.map((scope) => `  • ${scope}`),
-					"",
-					"Re-run the wizard and approve all permissions on the PostHog authorization screen.",
-					"If that screen does not reappear, revoke the existing PostHog Wizard authorization in your PostHog settings first."
-				].join("\n")
-			}
-		});
-	}
-	const resolution = resolveGrantedProject(options.projectId, tokenResponse.scoped_teams);
-	if (!resolution.ok) {
-		const error = /* @__PURE__ */ new Error(`You authorized project ${resolution.granted}, but setup is targeting project ${resolution.requested} (from --project-id). If ${resolution.requested} is not a project you own — a copy-pasted example value, say — re-run without --project-id, or with the id shown in your PostHog project settings. If it is yours, re-run and grant access to project ${resolution.requested} on the authorization screen.`);
-		analytics.captureException(error, {
-			step: "wizard_login",
-			requested_project_id: resolution.requested,
-			granted_project_id: resolution.granted
-		});
-		getUI().log.error(error.message);
-		await abort(error.message);
-	}
-	const projectId = resolution.ok ? resolution.projectId : void 0;
-	if (projectId === void 0) {
-		const error = /* @__PURE__ */ new Error("No project access granted. Please authorize with project-level access.");
-		analytics.captureException(error, {
-			step: "wizard_login",
-			has_scoped_teams: !!tokenResponse.scoped_teams
-		});
-		getUI().log.error(error.message);
-		await abort(error.message);
-	}
-	const host = await HostResolution.fromAccessToken(tokenResponse.access_token, {
-		region: tokenResponse.posthog_region,
-		localMcp: options.localMcp,
-		baseUrl: options.baseUrl
-	});
-	const cloudUrl = host.appHost;
-	const projectData = await fetchProjectData(tokenResponse.access_token, projectId, cloudUrl);
-	const userData = await fetchUserData(tokenResponse.access_token, cloudUrl);
-	const data = {
-		accessToken: tokenResponse.access_token,
-		refreshToken: tokenResponse.refresh_token,
-		expiresAt: Date.now() + tokenResponse.expires_in * 1e3,
-		projectApiKey: projectData.api_token,
-		host,
-		distinctId: userData.distinct_id,
-		projectId,
-		roleAtOrganization: userData.role_at_organization ?? null,
-		user: userData,
-		project: projectData,
-		missingScopes: missingOAuthScopes(requestedScopes, tokenResponse.scope)
-	};
-	getUI().log.success("Login complete.");
-	analytics.setTag("opened-wizard-link", true);
-	analytics.identifyUser(userData);
-	return data;
-}
-async function askForProvisioningSignup(email, region, baseUrl, localMcp, programId) {
-	if (!email || !email.includes("@")) {
-		getUI().log.error("Email is required for signup. Use --email your@email.com with --signup.");
-		await abort();
-		throw new Error("unreachable");
-	}
-	const spinner = getUI().spinner();
-	spinner.start("Creating your PostHog account...");
-	try {
-		const provisionRegion = (region ?? "us").toUpperCase();
-		const { orgName, projectName } = detectOrgAndProject(email);
-		const result = await provisionNewAccount(email, "", provisionRegion, {
-			orgName,
-			projectName,
-			baseUrl,
-			scopes: getProvisioningScopesForProgram(programId)
-		});
-		spinner.stop("Account created!");
-		getUI().log.success("Welcome to PostHog!");
-		const host = HostResolution.fromApiHost(result.host, { localMcp });
-		analytics.setTag("provisioning-signup", true);
-		return {
-			accessToken: result.accessToken,
-			refreshToken: result.refreshToken,
-			expiresAt: result.expiresAt,
-			oauthClientId: result.oauthClientId,
-			projectApiKey: result.projectApiKey,
-			host,
-			distinctId: email,
-			projectId: parseInt(result.projectId, 10) || 0
-		};
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Unknown error";
-		if (error instanceof ProvisionedAccountUnreadableError) {
-			spinner.stop("Account created, but the project could not be read back.");
-			getUI().log.warn(message);
-			getUI().log.info("Signing you in to your new account instead...");
-			return askForWizardLogin({
-				signup: false,
-				baseUrl,
-				localMcp
-			});
-		}
-		spinner.stop("Account creation failed.");
-		if (message.includes("already associated")) {
-			getUI().log.info("This email already has a PostHog account. Switching to login flow...");
-			return askForWizardLogin({
-				signup: false,
-				baseUrl,
-				localMcp
-			});
-		}
-		getUI().log.error(`Failed to create account: ${message}`);
-		analytics.captureException(error instanceof Error ? error : new Error(message), { step: "provisioning_signup" });
-		await abort();
-		throw error;
-	}
-}
-//#endregion
-export { isUsingTypeScript as a, createVersionBucket as c, refreshAccessToken as d, OAuthError as f, detectNodePackageManagers as g, detectAllPackageManagers as h, getPackageDotJson as i, extractOAuthCode as l, mcpUrlFor as m, detectOrgAndProject as n, tryGetPackageJson as o, HostResolution as p, getOrAskForProjectData as r, updatePackageDotJson as s, abort as t, missingOAuthScopes as u };
-
-//# sourceMappingURL=setup-utils-B26Lf2yF.js.map