@whisperr/wizard 0.1.9 → 0.1.10

package/dist/index.js

@@ -6,8 +6,8 @@ import * as p from "@clack/prompts";
 
 // src/core/config.ts
 var DEFAULT_API_BASE = "https://api.whisperr.net";
-var DEFAULT_MODEL = "claude-sonnet-4-6";
-var DEFAULT_EFFORT = "medium";
+var DEFAULT_MODEL = "claude-opus-4-8";
+var DEFAULT_EFFORT = "low";
 var EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 function resolveEffort() {
   const raw = (process.env.WHISPERR_WIZARD_EFFORT ?? "").toLowerCase();
@@ -995,6 +995,33 @@ in the code. You will NOT find everything \u2014 some events live server-side or
 aren't in this codebase at all. That is expected and fine. Get what is here, get
 it right, report the rest. Know exactly what you're doing; never hunt blindly.
 
+WHO COUNTS AS "THE USER" \u2014 decide this BEFORE you place anything:
+Whisperr models churn for the product's END USERS: the customers/consumers who
+use the app and could leave. identify() and EVERY event must key to that person.
+Internal actors are NOT the user and must never be instrumented \u2014 doing so fills
+the churn model with the wrong people and is a serious miss:
+  admins \xB7 staff \xB7 operators \xB7 support / back-office agents \xB7 superusers \xB7
+  sellers/merchants/partners (unless the product is FOR them) \xB7 CMS / management
+  / admin-panel consoles.
+Real apps usually have SEVERAL auth/identity paths. Before wiring identify(),
+enumerate them (grep for login / signup / register / authenticate / session
+handlers) and pick the END-USER one. Treat any of these in a path, route,
+namespace, class, guard, model, or table name as a strong "WRONG subject \u2014 skip
+it" signal:
+  admin \xB7 adminpanel \xB7 backoffice \xB7 internal \xB7 staff \xB7 operator \xB7 seller \xB7
+  merchant \xB7 partner \xB7 cms \xB7 manage/management \xB7 console \xB7 dashboard \xB7 support \xB7
+  superuser \xB7 a dedicated admin guard/middleware (e.g. Laravel \`auth:admin\`) or
+  a separate Admin/Staff user model or table.
+If the only auth you can see sits on such a path, the real end-user auth is
+almost certainly elsewhere (a customer-facing API, the mobile backend, an SSO
+callback) \u2014 keep looking instead of settling for it. Only treat an operator as
+the user when the product itself is genuinely for operators (an internal tool).
+
+CONSISTENCY CHECK: identify() and the signup/login events (e.g. account_created)
+describe the SAME person, so they belong on the SAME surface. If you wired
+account_created into one controller and are about to put identify() in a
+different one, stop \u2014 that's the tell you've split the subject. Co-locate them.
+
 Every step costs time and the user is watching. Work FAST and DECISIVELY.
 
 EFFICIENCY \u2014 non-negotiable:
@@ -1010,6 +1037,10 @@ DECISIVENESS:
 - If you can't find a clear place for something within ~2 searches, STOP looking.
   Leave a one-line \`// TODO(whisperr): ...\` only if an obvious spot exists,
   otherwise just note it as a follow-up. Do not keep hunting.
+- ONE exception: choosing the correct user/subject (see WHO COUNTS AS "THE
+  USER") is worth a few extra searches. Do not grab the first thing named
+  "login" \u2014 confirm it's the end-user path first. Getting the subject wrong is
+  far more costly than a missed event.
 
 PROPERTY CAPTURE (this is the craft):
 - For each event you place, look at what's in scope AT THAT CALL SITE \u2014 function
@@ -1025,6 +1056,9 @@ CORRECTNESS:
 - Match the app's existing conventions (imports, state management, file layout).
 - Use the EXACT snake_case event names given. Never invent or rename events.
 - Only place an event where you're confident the user action truly happens.
+- Before writing a call, confirm the id in scope is the END-USER's \u2014 not an
+  admin/staff/operator/seller id. An admin acting on a user's behalf is still an
+  admin action; instrument where the end user themselves acts.
 
 FINAL SUMMARY (this is shown verbatim to a non-technical customer in a
 dashboard \u2014 write for a human, not a changelog):
@@ -1122,12 +1156,18 @@ async function runIntegrationAgent(opts) {
     "Do exactly these, then stop:",
     `1. Add the Whisperr SDK dependency and install it (${playbook.packageRef}).`,
     "2. Initialize it once at app startup with the key + base URL below.",
-    "3. Wire identify() at the PRIMARY place the user becomes authenticated",
-    "   (after a successful login) and on session restore at app startup; call",
-    "   reset() on logout. Do NOT enumerate every auth method \u2014 one primary",
-    "   login path plus session restore is enough. Keep channels minimal: pass",
-    "   email if it's readily at hand; phone/push are optional, skip them if not",
-    "   obvious. Do not go hunting through every auth file.",
+    "3. Wire identify() for the END USER \u2014 the paying customer/consumer, NEVER an",
+    '   admin, staff, operator, seller, or partner (see WHO COUNTS AS "THE USER"',
+    "   in your instructions). This app likely has several auth paths: enumerate",
+    "   them first (grep login/signup/register/authenticate) and instrument the",
+    '   end-user one \u2014 do NOT just take the first thing named "login". A path',
+    "   under admin/backoffice/staff/seller/cms is the wrong subject. Sanity",
+    "   check: identify() belongs on the SAME surface as account_created \u2014 if",
+    "   they'd land in different controllers, you've picked the wrong login.",
+    "   Wire it at the primary end-user login success and on session restore at",
+    "   startup; call reset() on logout. One end-user login path plus session",
+    "   restore is enough. Keep channels minimal: email if readily at hand;",
+    "   phone/push optional.",
     "",
     "This is a real app \u2014 be quick and decisive, aim to finish in ~15 steps.",
     "Do NOT instrument product events yet \u2014 that is a separate step. Do not run",
@@ -1157,10 +1197,12 @@ ${core.summary}`);
       "initialized, and identify() is wired. Now instrument the product events",
       "below with track().",
       "",
-      "Work in importance order. Place each event at its real call site and",
-      "attach the properties you can source from what's in scope there (see the",
-      "property-capture rule in your instructions). Skip fast when an event has",
-      "no clear client-side trigger \u2014 spend steps placing events, not exploring.",
+      "Work in importance order. Place each event at the real call site where the",
+      "END USER performs the action (not an admin/staff path \u2014 see WHO COUNTS AS",
+      `"THE USER"), and attach the properties you can source from what's in scope`,
+      "there (see the property-capture rule). These events describe the same",
+      "person identify() did, so they live on the same end-user surface. Skip fast",
+      "when an event has no clear trigger here \u2014 spend steps placing, not exploring.",
       "Stop once the events that clearly exist in this app are wired.",
       "",
       "----- EVENTS -----",
@@ -1785,7 +1827,7 @@ async function main() {
     return;
   }
   if ("version" in parsed) {
-    console.log("0.1.9");
+    console.log("0.1.10");
     return;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whisperr/wizard",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Whisperr Wizard — one command to integrate the Whisperr SDK into your app. Authenticates with your onboarded account and uses an AI coding agent to wire up identify() and your business events automatically.",
   "license": "UNLICENSED",
   "private": false,